Incident response process and activities

3 quick checks≈3% of the testCore

Reading is free. Sign in to tick off lessons, keep your place and track your mastery.

By the end you’ll be able to

Order the incident response process: preparation, detection/identification, analysis, containment, eradication, recovery and lessons learned (SY0-801 adds investigation, negotiation and notification/external reporting)
Prepare with training, roles, playbooks, tabletop exercises and simulations
Select the correct next action at each stage (for example, contain before eradicating, and preserve evidence before reimaging)

0% read

Handle notification to stakeholders, customers, law enforcement and regulators, including ransomware negotiation considerations (SY0-801)

This lesson hasn’t been written yet

Security+ lessons are written from the official syllabus the first time a learner opens them, then saved for everyone. Sign in and this one is written for you in a minute or two. It’s free.

Sign in Create a free account