IR Level I study plan

Map each stage of the incident-handling lifecycle to at least two concrete analyst actions you would personally perform during detection and analysis.

Construct a triage decision tree that classifies a reported event as benign, suspicious, or confirmed incident within a 15-minute investigation window.

Rank at least eight telemetry sources (endpoint EDR, DNS, proxy, authentication logs, cloud audit logs, email gateway, network flow, asset inventory) by detection value for three attack scenarios.

Write a 10-item evidence-collection checklist that preserves volatile data before any host is isolated or reimaged.

Corroborate five sample alerts against a second independent data source and document whether each is a true positive, false positive, or benign trigger.

Draft a four-tier incident severity matrix that names the escalation trigger and decision authority for each tier.

Match five attacker behaviors to the detection opportunity each creates, using a public adversary-tactic taxonomy rather than vendor tooling.

Select a containment action (host isolation, account disable, indicator block, network segmentation, full shutdown) for four scenarios and justify each choice in three sentences covering business impact and attacker spread.

Separate containment, eradication, and recovery actions into three distinct columns and place 15 sample response tasks into the correct column.

Sequence an eradication plan for a compromised-credentials scenario, ordering every step and stating the verification that proves each step succeeded.

Define recovery validation criteria, including integrity confirmation and a defined monitoring window, for three distinct incident types.

Explain the trade-off between full and partial containment in terms of business downtime versus residual attacker access, using two contrasting examples.

Compare three lifecycle models (NIST-style, SANS-style, and ISO-style) and note where they diverge on evidence handling and stakeholder communication.

Distinguish event, alert, incident, and breach, giving one concrete example of each.

Describe how a CSIRT interacts with legal, human resources, communications, and executive leadership during an active incident, naming the decision each function owns.

Build a responsibility matrix assigning accountable, responsible, consulted, and informed roles for a ransomware scenario spanning six functions.

Outline an incident response plan covering scope, authority, roles, communication paths, and review cadence, keeping it to three pages.

Design a tabletop exercise with a scenario narrative, five escalating injects, and explicit success criteria per inject.

Assess your own readiness against ten capability criteria (logging coverage, contact lists, playbooks, tooling access, training currency) and score each gap as high, medium, or low.

Draft three communication templates: internal escalation, executive status update, and external customer notice.

Build a post-incident review template capturing timeline reconstruction, root cause, response gaps, and corrective actions with named owners and due dates.

Convert three observed response weaknesses into measurable metrics such as mean time to detect, mean time to contain, and percentage of playbooks exercised.

Specify a training and exercise cadence for responders, stating frequency, audience, and the evidence that proves completion.

Define plan-maintenance triggers, including contact-list validation intervals and the events that force an out-of-cycle plan review.

Formulate five hunting hypotheses from a published threat report and specify, for each, the data source and query logic needed to test it.

Differentiate tactical, operational, and strategic threat intelligence and match each level to its intended consumer and decision.

Map four categories of reporting obligation (regulatory, law enforcement, contractual, and customer or consumer notification) and identify which carry fixed clocks versus open-ended requirements.

Apply an ethical decision framework to two dilemmas, such as monitoring employee-owned devices and whether to pay a ransom demand, documenting the competing obligations in each.

Rebuild the triage decision tree and severity matrix from memory, then compare against your week 1 and week 2 versions to identify drift and gaps.

Recite the full incident lifecycle and every containment, eradication, and recovery decision point without notes, then check against source material.

Answer 20 scenario-based questions under a 90-second-per-question time limit to build pacing discipline.

Review every previously missed quiz item and confirm you can explain the correct answer and why each distractor is wrong.