Incident Response Theory: Ep.5 – Quiz

You should use a _____________ approach to eradication and recovery.

The best way to monitor an attacker’s activity is by redirecting them to a ________ environment.

When documenting evidence, ___________ should be used to track when evidence was gathered or handled.

________ evidence activity should be recorded.

Preservation of ____________ must be considered when choosing a containment strategy.

The purpose of __________ is to restore operations to normal.

Identifying an attacking host is usually ____________ .

Service availability must be considered when choosing a ________ strategy.

Eradication is often required to ________ components of an incident.

Identifying the attacking host __________ help achieve the main goal of reducing business impact.