UNIT 3- INCIDENT RESPONSE AND DISASTER RECOVERY

The primary goal of the initial situational awareness phase in incident response is to:

• Eradicate the threat completely.

• Gather preliminary information to understand the scope and nature of the incident.

• Notify all stakeholders about the security breach.

• Restore affected systems to their original state.

Which of the following is a crucial piece of information to gather during the initial hours of a suspected security incident?

• The attacker's motivation and long-term goals

• The exact vulnerability exploited by the attacker

• Detailed forensic analysis of every compromised endpoint

• The affected systems, data, and potential impact on business operations

Maintaining a detailed and chronological log of all actions taken during an incident response is critical for:

• Automatically patching vulnerable systems

• Immediately blocking all suspicious network traffic

• Accurate analysis, legal defensibility, and future lessons learned

• Generating executive summary reports in real-time

It is Incident Response Fundamentals wherein it defined clear communication channels, implement response checklist and provide staff with the quality cybersecurity training.

• Preparing for Potential Incidents

• Identifying and Assessing Threats

• Recovering and Restoring Operations

• Learning from the incident

Incident Response Fundamentals that restore the affected systems to their pre-incident state to get your business back up and running as normal.

• Ongoing Testing and Evaluation

• Learning from the Incident

• Recovering and Restoring Operations

• Containing the Impact

Incident Response is a set of ___________________ that organizations use to identify, investigate and respond to security incidents

Containing the impact wherein it Isolate the affected systems and impede the incident from ______________________________ further.

Incident Response (IR) and Disaster Recovery (DR) are two critical __________________ of an organization's overall security strategy.

What is the difference between Incident Response and Disaster Recovery Plan?