CompTIA A+ Certification Core 2 (220-1102) - Incident Response

The video tutorial explains the concept of incident response, emphasizing that an incident is defined by the organization. It outlines the responsibilities of IT personnel in identifying and reporting incidents, preserving data and devices, and maintaining documentation. The importance of understanding the chain of custody when handling evidence is highlighted, especially in legal contexts. The tutorial concludes by advising that incident response is often handled by specialized personnel.

What is the primary role of IT personnel in incident response?

• To fix the issue immediately

• To handle all legal aspects of the incident

• To ignore minor incidents

• To be the first responder and report the incident

What should you do first when you identify an incident?

• Wait for someone else to notice

• Ignore it if it's minor

• Report it through the proper channels

• Try to solve it yourself

Why is it important to document the surroundings during an incident?

• To create a backup of the data

• To ensure the device is working properly

• To provide context for the incident

• To make the area look organized

What is the chain of custody in the context of incident response?

• A method to fix the incident

• A process to track evidence handling

• A technique to preserve data

• A way to document software changes

What is a common rule regarding computers during an incident?

• Reboot the system to clear the issue

• Unplug it from the network but leave it running

• Turn off the computer immediately

• Disconnect all peripherals