Incident Analysis and Response
Incident Analysis and Response
This domain tests structured incident handling: scoping, evidence preservation, containment decisions, and recovery. Expect scenario questions where the order of actions matters.
Core rules and concepts
- Use the NIST SP 800-61 lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
- Follow the order of volatility: CPU and cache, memory, network state, disk, logs, archival media. Capture volatile data before shutdown when it is safe to do so.
- Preserve chain of custody: document who handled evidence, when, and where; hash images with SHA-256; use write blockers for disk acquisition.
- Scope before you eradicate. Identify initial access, persistence, and all affected hosts. Blocking one IP rarely contains an intrusion.
- Containment options include host isolation, account disablement, network segmentation, and domain/IP blocking. Weigh spread risk against business impact.
Worked example
Ransomware is encrypting files on a file server reached over SMB. The reasoning: first isolate the server from the network at the switch or VLAN level to stop propagation, but do not power it off if memory evidence may be needed. Disable any compromised service account, identify other hosts with SMB sessions to the server, and check backup integrity before restoration. Only after scoping should you eradicate persistence and restore from a known-good backup, then verify before reconnecting.
Traps that cost marks
- Reimaging before capturing evidence.
- Shutting down and losing memory.
- Declaring containment after blocking a single indicator.
- Restoring from backups that were also encrypted.
- Skipping documentation of evidence handling.