CFE Incident Response and Reporting

Question 1

What is the first step in the incident response process?

Accepted Answer

Preparation

Answer

Containment

Answer

Eradication

Answer

Recovery

Question 2

Why is it important to document each step of incident response?

Accepted Answer

To provide legal and audit evidence

Answer

To reduce investigation time

Answer

To create incident response playbooks

Answer

To support post-incident reviews

Question 3

Which phase of incident response involves eliminating the root cause of an incident?

Accepted Answer

Eradication

Answer

Identification

Answer

Containment

Answer

Recovery

Question 4

What is the purpose of containment during an incident?

Accepted Answer

To isolate affected systems

Answer

To delete infected files

Answer

To notify stakeholders

Answer

To stop the attacker permanently

Question 5

What should be included in an incident report?

Accepted Answer

Timeline, actions taken, and recommendations

Answer

Only the list of affected users

Answer

High-level summary of the incident

Answer

Details of the attack only

Question 6

Why is post-incident review critical in the response process?

Accepted Answer

To improve future incident handling

Answer

To punish those responsible

Answer

To close the investigation quickly

Answer

To delete logs and reports