I85PREP
⌘ K
IR Level I study materials
IR Level I study resources

IR Level I practice questions

One question at a time. Build your IR Level I understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Incident Response Fundamentals and Frameworks

Which statement best defines a security incident?

  1. Any alert generated by monitoring tools, even if unverified or benign
  2. A confirmed or suspected security policy violation with potential harm Correct answer.
  3. A routine configuration change recorded in the change log
  4. An outage caused solely by scheduled maintenance work

Explanation

A security incident is an actual or suspected adverse event that threatens confidentiality, integrity, or availability, or violates policy. Alerts and maintenance events only become incidents after analysis shows meaningful security impact.

Question 2Incident Response Fundamentals and Frameworks

Under the NIST SP 800-61 incident response lifecycle, which phase immediately follows detection and analysis?

  1. Coordination and information sharing
  2. Containment, eradication, and recovery Correct answer.
  3. Preparation
  4. Post-incident activity

Explanation

NIST SP 800-61 organizes response into preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Once an incident is detected and analyzed, the team moves into containment, eradication, and recovery.

Question 3Incident Response Fundamentals and Frameworks

In the SANS PICERL model, what does the letter 'C' represent?

  1. Containment Correct answer.
  2. Collection
  3. Communication
  4. Classification

Explanation

PICERL stands for Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Containment limits the incident's spread and impact before eradication and recovery.

Question 4Incident Response Fundamentals and Frameworks

An organization keeps offline forensic images, contact lists, and preconfigured jump bags ready before any incident occurs. Which incident response phase does this best illustrate?

  1. Identification
  2. Eradication
  3. Preparation Correct answer.
  4. Lessons learned

Explanation

Preparation covers building plans, teams, tools, communications, and evidence-collection capability before an incident. Maintaining jump bags and offline images is readiness work performed in advance.

Question 5Incident Response Fundamentals and Frameworks

Who typically authorizes major containment actions that may disrupt business operations?

  1. The endpoint agent that detected the malware
  2. The first responder who noticed the alert
  3. The incident commander or another designated management authority Correct answer.
  4. The service desk analyst who opened the ticket

Explanation

Disruptive containment decisions require accountable authority, usually the incident commander or a designated management role defined in the response plan. First responders collect information but may not hold the authority to halt business services.

Question 6Incident Response Fundamentals and Frameworks

A production database server is encrypted and unavailable. Backups exist but are 24 hours old. Which severity is most appropriate?

  1. Low, because backups exist
  2. Low, because the incident affects only one server
  3. Informational, because no data exfiltration is confirmed
  4. Critical, because a core production service is unavailable Correct answer.

Explanation

Severity should reflect business impact, and loss of a core production database is a major availability and recovery event even when backups exist. The age of backups affects recovery time and data loss, but it does not make the incident low severity.

Question 7Incident Response Fundamentals and Frameworks

What is the primary purpose of a chain-of-custody record?

  1. To document the cost of the investigation
  2. To record the antivirus signatures used during scanning
  3. To track every person who handled evidence and when Correct answer.
  4. To list all employees who must be notified

Explanation

Chain of custody creates an auditable history of evidence handling so its integrity can be defended. It records transfers, times, purposes, and storage conditions from collection through disposal or return.

Question 8Incident Response Fundamentals and Frameworks

When collecting digital evidence from a running system, which source should generally be collected first?

  1. A printout of system logs
  2. Files in the disk's archive partition
  3. Contents of RAM on the running host Correct answer.
  4. Backup tapes stored offsite

Explanation

Order of volatility says to collect the most perishable evidence first. RAM changes constantly and disappears on shutdown, so it precedes more stable disk and archival data.

Question 9Incident Response Fundamentals and Frameworks

What is the main purpose of an incident response plan?

  1. To guarantee that no security incident will ever occur
  2. To replace all preventive security controls
  3. To document the company's marketing strategy
  4. To define roles, steps, and authorities for handling incidents Correct answer.

Explanation

An incident response plan establishes how the organization prepares for, detects, contains, eradicates, and recovers from incidents, including who decides what. It complements preventive controls rather than replacing them.

Question 10Incident Response Fundamentals and Frameworks

An analyst receives five alerts at once. Which triage approach is best?

  1. Assign all five to the newest analyst
  2. Prioritize by business impact and confidence of compromise Correct answer.
  3. Wait until all five become critical
  4. Handle them alphabetically by hostname

Explanation

Effective triage ranks alerts by potential impact and the strength of evidence that compromise occurred. This focuses limited responder time on the greatest risk first.

Question 11Incident Response Fundamentals and Frameworks

A workstation is actively spreading ransomware across the local network. Which containment action is most appropriate first?

  1. Power off the workstation immediately
  2. Email all staff to unplug their computers
  3. Isolate the host while keeping it powered on Correct answer.
  4. Reimage the workstation before collecting evidence

Explanation

Network isolation stops propagation while preserving volatile memory that may hold encryption keys, processes, and network connections. Powering off can destroy that evidence and is usually avoided during active containment.

Question 12Incident Response Fundamentals and Frameworks

After containing a web server compromise, the team finds a vulnerable plugin and a stolen credential. What does eradication require?

  1. Removing the plugin, rotating the credential, and checking for persistence Correct answer.
  2. Only restoring the server from a two-week-old backup
  3. Only adding a WAF rule to block the exploit
  4. Only resetting the stolen credential

Explanation

Eradication removes every root cause and attacker foothold before recovery. That means fixing the vulnerable component, invalidating compromised credentials, and confirming no persistence remains.

Question 13Incident Response Fundamentals and Frameworks

When should a post-incident review normally occur?

  1. At the next annual audit
  2. Soon after recovery, while details are still fresh Correct answer.
  3. Only if the incident caused data loss
  4. Before containment begins

Explanation

Lessons learned should be captured soon after recovery so participants remember decisions, timelines, and gaps accurately. Reviews are useful for every significant incident, not only those with data loss.

Question 14Incident Response Fundamentals and Frameworks

During a major incident, what is the best role of a designated communications lead?

  1. Delay all internal communication until the root cause is known
  2. Share raw forensic evidence on social media
  3. Allow every technician to speak directly to the press
  4. Provide approved, consistent updates to stakeholders and the public Correct answer.

Explanation

A communications lead centralizes accurate, approved messaging so stakeholders receive consistent information and responders can focus on technical work. Updates should be timely even before root cause is fully known.

Question 15Incident Response Fundamentals and Frameworks

A breach exposes customer personal data. Which factor most directly determines whether breach notification laws apply?

  1. The antivirus vendor used by the company
  2. The time of day the breach was discovered
  3. The jurisdiction and the type of data involved Correct answer.
  4. The number of analysts on the response team

Explanation

Notification duties depend on legal jurisdiction and the categories of data affected, such as personal or health information. Organizations must involve legal counsel to map applicable statutes and deadlines.

Question 16Incident Response Fundamentals and Frameworks

A responder needs to image a running server's disk. Which practice best preserves evidentiary value?

  1. Image the disk, verify its hash, and analyze the copy Correct answer.
  2. Boot the server normally and copy files to a USB drive
  3. Use the original disk for analysis and return it afterward
  4. Compress the disk image with a password shared by email

Explanation

Forensic imaging with hash verification preserves integrity and lets investigators analyze a copy while the original remains protected. Working from the copy reduces alteration risk and supports chain of custody.

Question 17Incident Response Fundamentals and Frameworks

MTTD and MTTR measure, respectively, what aspects of incident response?

  1. Control cost and incident cost
  2. Alert volume and analyst headcount
  3. Detection time and full resolution time Correct answer.
  4. Containment time and communication time

Explanation

Mean time to detect measures how long it takes to identify an incident, while mean time to resolve measures elapsed time until it is fully resolved or recovered. Together they show detection and response efficiency.

Question 18Incident Response Fundamentals and Frameworks

Which team is typically responsible for receiving, triaging, and responding to security incidents?

  1. The sales department
  2. The facilities maintenance crew
  3. The CSIRT or SOC Correct answer.
  4. The external marketing agency

Explanation

A computer security incident response team or security operations center owns monitoring, triage, and coordinated response. Other business units support the process but do not normally lead technical incident handling.

Question 19Incident Response Fundamentals and Frameworks

What is the best use of an incident response playbook?

  1. To store all evidence permanently without access controls
  2. To serve as a legal contract with the attacker
  3. To replace all analyst judgment with automated scripts
  4. Predefined steps for a specific incident type Correct answer.

Explanation

A playbook provides structured, repeatable steps for a defined incident type such as ransomware or phishing. It supports responder judgment and consistency rather than eliminating either.

Question 20Incident Response Fundamentals and Frameworks

A tabletop exercise's main value is that it...

  1. proves the organization can prevent all incidents
  2. replaces the need for a written response plan
  3. reveals decision-making, communication, and coordination gaps Correct answer.
  4. tests only the technical detection tools

Explanation

Tabletops simulate a scenario discussion to test roles, decisions, escalation, and communication under realistic pressure. They expose coordination gaps that technical testing alone may miss.

Question 21Incident Response Fundamentals and Frameworks

An analyst confirms active data exfiltration to an unknown external IP address. What should happen next?

  1. Escalate, begin containment, and preserve evidence Correct answer.
  2. Post the external IP publicly and ask for help
  3. Wait for the attacker to stop before notifying anyone
  4. Close the ticket because the traffic has already left the network

Explanation

Confirmed exfiltration is a high-severity event that requires escalation, coordinated containment, and evidence preservation. Delaying action allows further data loss and complicates recovery.

Question 22Incident Response Fundamentals and Frameworks

What is the goal of the recovery phase?

  1. To identify the attacker's motive
  2. Restore affected systems to trusted, normal operation Correct answer.
  3. To delete all logs to save storage
  4. To punish employees who caused the incident

Explanation

Recovery returns affected services to normal operation with confidence that the threat has been removed. It includes validation, monitoring, and restoration from trusted sources.

Question 23Incident Response Fundamentals and Frameworks

After a phishing incident, which finding is a root cause rather than a symptom?

  1. Email filtering accepted a spoofed sender domain Correct answer.
  2. A user clicked a link in an email
  3. Malware beaconed to a command server
  4. The SOC received a malware alert

Explanation

A root cause is the underlying control failure that allowed the event, such as inadequate sender authentication or filtering. User clicks, beacons, and alerts are observable symptoms or intermediate events.

Question 24Incident Response Fundamentals and Frameworks

Why should one person be designated incident commander?

  1. To centralize decision authority and coordinate responders Correct answer.
  2. To eliminate the need for documentation
  3. To ensure the attacker is prosecuted
  4. To perform all forensic analysis personally

Explanation

A single incident commander prevents conflicting decisions and ensures priorities, communications, and resources are coordinated. The commander may delegate technical work rather than perform it personally.

Question 25Incident Response Fundamentals and Frameworks

How does incident response differ from business continuity and disaster recovery?

  1. IR is a subset of marketing; BCP/DR is a subset of sales
  2. IR only applies to natural disasters; BCP/DR only to cyberattacks
  3. IR and BCP/DR are identical and use the same plans
  4. IR manages security events; BCP/DR sustains and restores business operations Correct answer.

Explanation

Incident response focuses on detecting, containing, eradicating, and recovering from security incidents. Business continuity and disaster recovery focus more broadly on keeping critical business functions available and restoring operations after disruption.

Question 26Incident Response Fundamentals and Frameworks

Which statement best distinguishes a security event from a security incident?

  1. An event is confirmed data theft; an incident is any alert raised by a monitoring tool.
  2. An event requires management approval to investigate, while an incident is logged by the service desk.
  3. Any observable occurrence is an event; an incident is one that harms or threatens the organization. Correct answer.
  4. An event is routine only; an incident is any scheduled maintenance activity recorded in the change log.

Explanation

An event is any observable occurrence in a system or network, while an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability. Not every event is an incident, and an alert is only a signal until triage confirms harm or threat. This distinction keeps routine noise from being treated as confirmed compromise.

Question 27Incident Response Fundamentals and Frameworks

Which sequence lists the NIST SP 800-61 incident response life-cycle phases in the correct order?

  1. Detection and Analysis; Preparation; Containment, Eradication, and Recovery; Post-Incident Activity
  2. Detection and Analysis; Containment, Eradication, and Recovery; Preparation; Post-Incident Activity
  3. Preparation; Containment, Eradication, and Recovery; Detection and Analysis; Post-Incident Activity
  4. Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity Correct answer.

Explanation

NIST SP 800-61 organizes incident response into four life-cycle phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Preparation builds capability before an incident occurs, and post-incident activity captures lessons after recovery. The other options reorder these phases.

Question 28Incident Response Fundamentals and Frameworks

Which best describes the relationship between incident severity and incident priority?

  1. Severity and priority are synonyms and should always be assigned the same value.
  2. Severity is set by the responder's seniority; priority is set by the tool that raised the alert.
  3. Priority reflects technical impact, while severity reflects the ticket queue position assigned by the service desk.
  4. Severity reflects potential impact; priority reflects urgency and business context for sequencing. Correct answer.

Explanation

Severity expresses the potential business and technical impact of an incident, while priority expresses how urgently it should be worked relative to other incidents. A high-severity issue on an isolated test system may have lower priority than a moderate issue on a critical production service. Responders assign both, but priority is what drives queue order and escalation.

Question 29Incident Response Fundamentals and Frameworks

An analyst sees signs that a domain controller may be compromised, but the available playbook covers only workstation malware. What is the most appropriate next action?

  1. Escalate per the escalation matrix because the asset and scope exceed the playbook. Correct answer.
  2. Close the alert as a false positive because no matching playbook exists.
  3. Continue investigating without notifying anyone until the full scope is known.
  4. Apply the workstation playbook steps to the domain controller.

Explanation

Escalation matrices define when an incident exceeds a responder's authority, playbook coverage, or technical scope. A possible domain controller compromise is a high-impact, high-uncertainty event that typically requires senior analysts, system owners, and management notification. Continuing silently, improvising a workstation playbook, or closing the alert would all delay containment and evidence preservation.

Question 30Incident Response Fundamentals and Frameworks

A team contains a compromised server within minutes, rebuilds it from a known-good image, restores data, and closes the ticket. Which gap in the incident response life cycle is most significant?

  1. Preparation was skipped because the team never verified that the backup was free of malware before restoring it.
  2. Recovery was skipped because the server was rebuilt from a known-good image and returned to service.
  3. Post-incident activity was skipped because the ticket was closed without a formal survey of the response.
  4. Detection and analysis were skipped, leaving scope, root cause, and evidence unknown. Correct answer.

Explanation

A disciplined response establishes scope, root cause, and evidence during detection and analysis before containment and eradication. Immediate rebuilding destroys volatile and disk evidence and may leave the initial access vector in place, allowing reinfection. Closing the ticket without a post-incident review also skips lessons learned, but the loss of analysis is the most consequential gap described.

Question 31Preparation and Capability Building

What is the primary purpose of an incident response policy?

  1. To set authority, scope, and requirements for handling security incidents Correct answer.
  2. To replace technical incident playbooks with one consolidated policy document
  3. To list every malware signature that the organization currently blocks in production
  4. To assign all incident decisions to the external security operations vendor

Explanation

A policy establishes management intent, scope, roles, and mandatory requirements for handling security incidents. It sits above tactical playbooks and does not list malware signatures, replace procedures, or outsource accountability.

Question 32Preparation and Capability Building

Which role typically owns coordinating the overall response across technical, legal, and business teams during a major incident?

  1. The incident response coordinator Correct answer.
  2. The human resources generalist
  3. The backup administrator
  4. The help desk shift supervisor on duty

Explanation

The incident response coordinator or manager orchestrates cross-functional activities, tracks status, and escalates to executives. Other roles contribute within narrow functional areas rather than owning overall coordination.

Question 33Preparation and Capability Building

Why should an incident response plan include out-of-band communication methods?

  1. To let employees share passwords more securely across teams
  2. To comply with software licensing terms and vendor support agreements
  3. To let responders communicate when primary email or chat is unavailable Correct answer.
  4. To reduce the cost of routine help desk calls and ordinary service ticket handling

Explanation

Attackers often disable or monitor primary email and chat, so alternate channels such as phone bridges or secondary messaging preserve coordination. Out-of-band methods are a resilience measure, not a cost, licensing, or password-sharing control.

Question 34Preparation and Capability Building

What is the main objective of a tabletop exercise in incident response preparation?

  1. To practice decision-making and coordination using a simulated scenario Correct answer.
  2. To certify all responders in forensic tool operation
  3. To validate every production failover under full load and peak traffic
  4. To test whether malware can evade endpoint agents

Explanation

Tabletop exercises are discussion-based sessions that test plans, roles, and decisions without disrupting production. They do not validate full failover, measure malware evasion, or certify tool skills.

Question 35Preparation and Capability Building

How often should incident responders receive role-specific training?

  1. Only after a major incident has already occurred
  2. Whenever the marketing team updates its campaign calendar
  3. At a defined interval and after major plan or environment changes Correct answer.
  4. Only once when first hired, with no refresher training or exercises at any later point

Explanation

Regular refreshers and change-triggered updates keep responder skills and plan knowledge current. One-time training, post-incident-only training, and unrelated triggers leave readiness stale.

Question 36Preparation and Capability Building

What information should a third-party contact list in an incident response plan contain?

  1. Only the vendor's public website address
  2. The personal social media accounts of vendor sales staff
  3. Escalation contacts, service scope, and contractual notification timeframes Correct answer.
  4. A list of competitor vendors for price comparison

Explanation

A usable contact list includes operational escalation paths, the services covered, and contractual notification windows. Public websites, sales social media, and competitor lists do not support rapid incident escalation.

Question 37Preparation and Capability Building

What is a reasonable practice for maintaining an incident response plan?

  1. Review it annually and after major incidents or organizational changes Correct answer.
  2. Rewrite it from scratch after every low-severity help desk ticket is closed
  3. Freeze it permanently once approved by legal
  4. Keep it confidential from all technical staff

Explanation

Plans should be reviewed periodically and after significant events or organizational change to remain accurate. Permanent freezing, overreacting to minor tickets, and withholding the plan from responders undermine usability.

Question 38Preparation and Capability Building

Why is executive sponsorship important for an incident response program?

  1. It allows responders to skip documentation during incidents
  2. It guarantees that no security incident will ever occur in the organization
  3. It provides authority, resources, and cross-organizational priority for preparedness Correct answer.
  4. It removes the need for any technical controls

Explanation

Executive sponsorship secures funding, resolves priority conflicts, and reinforces accountability across business units. It does not replace controls, prevent all incidents, or waive documentation.

Question 39Preparation and Capability Building

A team wants to test its incident response plan by having responders execute actions in a simulated environment without affecting production. Which exercise type best fits?

  1. A post-incident review
  2. A functional exercise Correct answer.
  3. A code review
  4. A tabletop discussion

Explanation

Functional exercises simulate operations and require responders to perform actions in a controlled setting. Tabletops are discussion-based, post-incident reviews look backward, and code reviews examine source code.

Question 40Preparation and Capability Building

How should an incident response playbook differ from a high-level incident response plan?

  1. The playbook should restate only the policy's legal disclaimers and approval signatures
  2. A playbook gives step-by-step actions for one incident type; the plan sets overall strategy Correct answer.
  3. The playbook should be kept secret from responders to prevent operational leaks and unauthorized use
  4. The playbook replaces the need for defined roles, escalation paths, and response ownership

Explanation

Playbooks are tactical, scenario-specific guides, while plans define governance, roles, and the response lifecycle. Playbooks do not replace structure, legal text, or the need for responder access.

Question 41Preparation and Capability Building

What is the main benefit of defining incident severity levels in advance?

  1. It guarantees attackers cannot escalate privileges or move laterally after initial access
  2. It guides consistent escalation, resourcing, and notification based on impact Correct answer.
  3. It eliminates the need to document incidents
  4. It allows all incidents to receive identical treatment

Explanation

Severity levels create consistent triage and response proportional to business and technical impact. They do not remove documentation, equalize treatment, or prevent attacker actions.

Question 42Preparation and Capability Building

An analyst confirms a ransomware infection on a single workstation that is isolated and has no domain connectivity. According to a typical escalation model, what should happen next?

  1. Escalate to the IR team and begin containment and impact assessment Correct answer.
  2. Close the ticket immediately because only one host is affected
  3. Notify all customers before any internal assessment
  4. Wait for the workstation user to propose a remediation plan and timeline

Explanation

Confirmed ransomware triggers escalation and containment even for one host because spread and data impact are uncertain. Immediate closure, premature external notification, and user-led remediation are unsafe.

Question 43Preparation and Capability Building

Which practice best supports forensic readiness before an incident occurs?

  1. Centralizing time-synchronized logs with defined retention Correct answer.
  2. Allowing responders to alter evidence freely during collection
  3. Disabling system logging to save storage
  4. Storing all logs only on the affected endpoint

Explanation

Centralized, time-synchronized, retained logs preserve evidence and enable timeline reconstruction. Disabling logging, endpoint-only storage, and uncontrolled alteration undermine forensic value.

Question 44Preparation and Capability Building

What should a logging and monitoring baseline for incident detection include?

  1. A complete copy of every employee's personal email
  2. Logs that are overwritten every hour to reduce storage cost and administrative effort
  3. Security events such as authentication, privilege changes, and network connections with alerts Correct answer.
  4. Only application error logs from the finance department

Explanation

A baseline covers security-relevant telemetry and alerting across critical systems. Narrow finance-only logs, personal email, and rapid overwrite fail detection and privacy expectations.

Question 45Preparation and Capability Building

How does an up-to-date asset inventory improve incident response preparation?

  1. It removes the need for network segmentation
  2. It replaces the incident response plan
  3. It maps critical systems to owners for prioritization Correct answer.
  4. It automatically patches all vulnerable software across every environment

Explanation

Inventory ties systems to business criticality and ownership, speeding prioritization and communication. It does not patch software, replace segmentation, or substitute for a plan.

Question 46Preparation and Capability Building

Why should incident response planning be coordinated with business continuity planning?

  1. To merge all security and facilities budgets permanently into one shared cost center
  2. To eliminate the need for incident documentation
  3. To ensure responders can ignore business priorities during containment
  4. To align recovery priorities and avoid conflicting shutdown or restoration decisions Correct answer.

Explanation

IR containment can affect operations, so coordination with BCP aligns recovery objectives and decision authority. It does not permit ignoring business priorities, force budget mergers, or remove documentation.

Question 47Preparation and Capability Building

What is a recommended characteristic of a secure incident communication channel?

  1. It is restricted to authorized responders and preserves a record of messages Correct answer.
  2. It allows anonymous unauthenticated posting
  3. It is accessible to all employees by default to encourage rapid information sharing
  4. It is the same public social media channel used for marketing

Explanation

Secure channels limit access to authorized responders and preserve records for coordination and review. Open access, public marketing channels, and anonymous posting increase leak and integrity risk.

Question 48Preparation and Capability Building

What is the primary purpose of an on-call rotation in an incident response program?

  1. To reduce the number of security controls required
  2. To replace the need for an incident response plan and escalation procedures
  3. To ensure responders are reachable and can start triage promptly Correct answer.
  4. To guarantee that every alert is a confirmed incident

Explanation

On-call coverage provides timely human response outside business hours. It does not validate alerts, replace plans and escalation procedures, or reduce the need for controls.

Question 49Preparation and Capability Building

Which pair of metrics measures how quickly an organization detects and contains incidents?

  1. Backup frequency settings and archive retention depth
  2. Patch compliance percentage and average password length
  3. Mean time to detect and mean time to respond Correct answer.
  4. Number of employees and total number of managed servers in production

Explanation

Mean time to detect and mean time to respond measure how quickly incidents are identified and handled. Patch compliance, password length, headcount, server counts, and backup settings are not direct incident timing metrics.

Question 50Preparation and Capability Building

How can threat intelligence best support incident response preparation?

  1. By guaranteeing that no future security incidents will ever occur in the organization
  2. By replacing all internal logging
  3. By allowing responders to skip containment steps during active incidents
  4. By providing context on actors, tactics, and indicators to prioritize detection Correct answer.

Explanation

Tailored threat intelligence informs risk prioritization and detection content by providing context on relevant actors, tactics, and indicators. It complements internal logging, cannot guarantee prevention, and does not waive containment.