Loading course title...

Loading assessment title...

Connecting to LMS... Progress: in progress

Assessment

1. What is the main purpose of the incident response lifecycle?

A. Replace all security controls

B. Guarantee that incidents never happen

C. Provide a repeatable process for handling suspected or confirmed security incidents

D. Teach offensive exploitation steps

2. What does preparation include?

A. Roles, playbooks, logging, tools, backups, communication paths, and exercises

B. Waiting until an incident starts

C. Removing all monitoring

D. Ignoring escalation paths

3. What is the difference between detection and analysis?

A. Detection always proves the full incident

B. Analysis happens before any signal exists

C. Detection is only about backups

D. Detection finds possible signals; analysis determines meaning, severity, scope, and evidence

4. What is the goal of containment?

A. Delete all evidence immediately

B. Limit spread or impact while considering evidence and business continuity

C. Skip communication

D. Restore systems without analysis

5. What does eradication focus on?

A. Public relations only

B. Turning off all systems forever

C. Removing the active cause or root cause of the incident

D. Avoiding verification

6. What does recovery mean in incident response?

A. Re-enable everything as quickly as possible without validation

B. Ignore monitoring after service returns

C. Assume the root cause is gone

D. Restore trusted operations with validation, monitoring, and business coordination

7. Why are documentation and decision records important?

A. They support accountability, communication, review, and future improvement

B. They replace evidence

C. They should only be created after memory fades

D. They are useful only for executives

8. Which is the best incident response operating routine?

A. Detect something, panic, and change systems without records

B. Prepare, detect, analyze, contain, eradicate, recover, communicate, document, review, and improve

C. Skip analysis and go straight to public statements

D. Contain nothing and wait for the issue to disappear