IR Level I study guide
IR Level I · Work through your exam, one topic at a time.
IR Level I is a foundational incident-response credential for people who are entering, or have recently entered, a hands-on response role: tier-one SOC analysts, junior CSIRT members, IT or network administrators who now carry escalation duty for security events, and career-changers coming from a general security fundamentals course who want a response-specific qualification on top of it. It is designed to test whether you can work a structured response lifecycle - recognise, triage, scope, contain, clean up, learn - rather than whether you know one vendor's console. The IR Level I study guide has 7 sections and about 2,080 words.
01Incident Response Fundamentals and Frameworks
An event is any observable occurrence in a system or network; an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability, or violates policy. Most classification questions hinge on this line: an alert is not automatically an incident, and a vulnerability is not an incident until it is exploited or exposure is confirmed.
295 words, about 1 min02Preparation and Capability Building
Preparation decides how much of an incident you control. Questions test whether you understand that a signed plan on a shelf is not a capability.
301 words, about 2 min03Detection and Analysis
Detection and Analysis turns alerts into confirmed, scoped incidents. Triage answers five questions in order: what happened, is it real, what is the impact, what is the scope, and what happens next.
338 words, about 2 min04Containment, Eradication, and Recovery
Containment buys time and limits spread. Short-term containment is fast and reversible: network isolation of a host, blocking a domain or IP, disabling a compromised account, segmenting a VLAN.
275 words, about 1 min05Post-Incident Activity and Continuous Improvement
Post-incident activity converts a costly event into durable improvement. It is a phase output, not an optional debrief.
281 words, about 1 min06Threat Intelligence and Proactive Hunting
Threat intelligence operates at four levels: strategic (risk and trends for leadership), operational (campaigns and actor intent), tactical (adversary TTPs), and technical (indicators such as hashes, domains, IPs). The intelligence lifecycle runs direction, collection, processing, analysis, dissemination, and feedback - direction and feedback are what separate intelligence from a feed.
286 words, about 1 min07Legal, Ethical, and Reporting Obligations
Obligations arrive from four directions: regulatory (GDPR, HIPAA, NIS2, sector rules), contractual (customer agreements, SLAs, NDAs, insurer terms), statutory breach notification to individuals and authorities, and internal policy . Know which apply to the data involved, not merely to where the server sits.
304 words, about 2 min