Security+ Incident Response and Computer Forensics

Which of the following best describes the primary goal of incident response?

• Minimize the impact of security incidents
• Prevent all security incidents from occurring
• Identify and punish perpetrators
• Ignore security incidents to avoid escalating them

The first step in incident response is to identify a security incident.

• True
• False

Which of the following are examples of security incidents?

(Choose All That Apply)

• Unauthorized access to a system
• Successful system patching
• Malware infection
• Routine system backup

What is the primary purpose of computer forensics?

• Identifying and analyzing digital evidence
• Recovering lost data
• Preventing future security incidents
• Installing security software

Computer forensics is only concerned with recovering deleted files.

• True
• False

Which of the following are common steps in the incident response process?

(Choose All That Apply)

• Recovery
• Erasure
• Identification
• Detection

What is the primary purpose of a chain of custody in computer forensics?

• To ensure only authorized personnel handle evidence
• To speed up the forensic investigation process
• To hide evidence from unauthorized access
• To delete evidence permanently

Incident response plans are static documents that do not need regular updating.

• True
• False

Which of the following are examples of evidence in computer forensics?

(Choose All That Apply)

• Email communications
• System logs
• Employee opinions
• Printed documents

What is the purpose of a root cause analysis in incident response?

• To determine who is responsible for the incident
• To identify the underlying cause of the incident
• To delete all evidence related to the incident
• To ignore the incident and move on