Cyber Security Quiz: Incident Response Phases

10 questions · exam conditions

0:00

Incident Response PhasesQuestion 1 of 10

Following a business email compromise, the organization has restored the mailbox and confirmed that no malicious forwarding rules remain. A review finds that delayed reporting increased the loss, help-desk staff bypassed escalation procedures, and existing metrics did not measure time from user report to account suspension.

Which activity would best demonstrate an effective lessons-learned phase rather than merely closing the ticket?

Assign corrective-action owners, revise escalation procedures, define response metrics, and track completion dates

Disable the affected account, revoke active sessions, and block the sender's known infrastructure

Search audit logs, validate the forwarding-rule changes, and determine the messages the attacker accessed

Restore mailbox access, confirm normal mail delivery, and monitor the user for repeated authentication failures

← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Incident Response Phases

Practice Incident Response Phases in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Incident Response Phases, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

Which activity would best demonstrate an effective lessons-learned phase rather than merely closing the ticket?

Assign corrective-action owners, revise escalation procedures, define response metrics, and track completion dates (correct answer)
Disable the affected account, revoke active sessions, and block the sender's known infrastructure
Search audit logs, validate the forwarding-rule changes, and determine the messages the attacker accessed
Restore mailbox access, confirm normal mail delivery, and monitor the user for repeated authentication failures

Explanation: When you see a question about incident response phases, anchor yourself to the purpose of each phase. Containment, eradication, and recovery all focus on fixing the immediate problem. The lessons-learned phase is fundamentally different — its purpose is organizational improvement: translating what went wrong into durable changes that prevent or reduce the impact of future incidents. The passage gives you three clear problems that survived ticket closure: delayed reporting, bypassed escalation procedures, and missing metrics for account-suspension response time. Choice A directly attacks all three by assigning owners (accountability), revising escalation procedures (process fix), defining response metrics (measurement gap closed), and tracking completion dates (ensuring follow-through). This is what genuine lessons-learned looks like — structured remediation with accountability, not just documentation. Choice B — disabling the account, revoking sessions, and blocking sender infrastructure — describes containment actions. These should have happened at the very beginning of the incident, not after restoration. Choice C — searching audit logs, validating forwarding-rule changes, and identifying accessed messages — is forensic/investigation work belonging to the analysis phase, not lessons-learned. Choice D — restoring mailbox access and monitoring for authentication failures — is recovery, confirming the system is back to normal operation. All three distractors represent legitimate incident response activities, just from the wrong phase. The trap the exam is setting is offering you technically correct security actions and asking whether you can distinguish phase from task. When a question asks about lessons-learned specifically, look for answers that include process revision, metric definition, ownership assignment, and tracking — not reactive technical steps.

Question 2

A team removes malware from three endpoints and begins returning them to service. Enhanced monitoring then identifies the same command-and-control pattern from a fourth endpoint that was not in the original scope. The new activity is confirmed as malicious.

What is the most appropriate interpretation of the incident response phases in this situation?

Recovery must continue unchanged because phases are sequential and completed phases should not be revisited
The fourth endpoint should be documented only during lessons learned because eradication is already complete
The team should return to containment and analysis for the expanded scope before resuming full recovery (correct answer)
The finding belongs only to preparation because enhanced monitoring was established before service restoration

Explanation: Incident response frameworks like NIST SP 800-61 describe phases — preparation, detection/analysis, containment, eradication, and recovery — but a critical insight is that these phases are iterative, not strictly linear. When new evidence of compromise emerges, the process cycles back. Treat IR phases like a loop, not a checklist you seal shut. Here, the discovery of a fourth endpoint exhibiting confirmed malicious command-and-control activity means the scope of the incident has changed. That endpoint hasn't been contained, analyzed, or remediated — it's essentially a fresh threat within the same incident. The most appropriate action is exactly what C describes: return to containment and analysis for this new scope before resuming full recovery. Pressing forward with recovery while an active, uncontained threat persists would undermine the entire effort and risk reinfection of the endpoints already cleaned. A reflects a common misconception — that IR phases are a one-way conveyor belt. They aren't. Completed phases absolutely get revisited when new evidence demands it. B is wrong because deferring active, confirmed malicious activity to a post-incident lessons-learned document is a dangerous delay; lessons learned is for reflection, not active threat handling. D misclassifies the discovery — enhanced monitoring producing real-time confirmed malicious findings is a detection/analysis event, not a preparation activity. Preparation is the proactive planning phase before incidents occur. Your study tip: whenever an IR question describes new evidence surfacing mid-incident, the answer almost always involves cycling back to an earlier phase — the iterative nature of IR is a favorite exam concept, so recognize "phases are not strictly sequential" as a core principle.

Question 3

After rebuilding several compromised database servers from trusted images, responders apply security updates and rotate affected credentials. The business owner wants all user traffic restored immediately, but the incident commander requires integrity checks, a limited traffic pilot, enhanced monitoring, and defined rollback criteria.

What is the strongest reason these additional steps belong to the recovery phase?

They determine whether the original alert represents a genuine incident before response actions begin
They keep the adversary from accessing systems while malicious persistence remains intentionally installed
They remove the exploit and attacker-created artifacts that caused the servers to remain compromised
They validate a controlled return to normal operation and detect recurrence before full restoration (correct answer)

Explanation: When you see incident response questions, map each action to the correct NIST or PICERL phase: preparation, identification, containment, eradication, recovery, and lessons learned. Recovery is specifically about safely restoring services and confirming the threat is gone — not just flipping systems back online. The steps described — integrity checks, a traffic pilot, enhanced monitoring, and defined rollback criteria — are textbook recovery-phase controls. They exist to validate that rebuilt systems are genuinely clean, catch any recurrence early with limited blast radius, and ensure you can reverse course quickly if something goes wrong. That perfectly matches D: a controlled return to normal operation with recurrence detection before full restoration. A is wrong because it describes the identification phase — determining whether an alert is a real incident happens at the very beginning, before any servers are rebuilt or credentials rotated. By the time you're reading this passage, identification is long over. B describes containment, where you isolate systems to stop an active threat from spreading. The passage already tells you persistence has been removed (servers were rebuilt from trusted images), so containment is not the active concern here. C points to eradication — removing the exploit, malware, and attacker artifacts. That work is also already done in the passage; the rebuild and patch application completed eradication. The remaining steps happen after eradication. A useful study tip: in incident response questions, pay close attention to what has already happened in the scenario. Phases don't repeat — if eradication is described as complete, any remaining actions belong to recovery or lessons learned, not containment or eradication.

Question 4

An endpoint alert identifies a credential-stealing process. The response team terminates the process and isolates the laptop. Without checking for lateral movement or collecting volatile evidence, the team immediately reimages the device and declares the incident resolved. Two days later, the same account is used from a server.

Which process failure most directly explains why the response was prematurely closed?

The team performed preparation after detection instead of establishing an incident response capability beforehand
The team began eradication before adequately determining scope and containing related attacker access (correct answer)
The team performed recovery before terminating the malicious process on the originally affected endpoint
The team completed lessons learned before restoring the endpoint to its standard production configuration

Explanation: When you see incident response questions like this, map the scenario to the standard IR lifecycle: Preparation → Detection/Analysis → Containment → Eradication → Recovery → Lessons Learned. The key is identifying which phase was skipped or done out of order and what consequence that caused. Here, the team jumped straight to eradication (reimaging) without completing containment — specifically, they never checked for lateral movement or collected volatile memory evidence. Because the attacker had already moved to a server using the stolen credentials, cleaning one endpoint did nothing to address the broader compromise. Two days later, that overlooked foothold proved the incident was never actually resolved. This makes B correct: eradication was performed before scope was fully determined and before related attacker access (the compromised account on the server) was contained. A is wrong because preparation refers to building IR capabilities before any incident occurs — things like playbooks, tools, and trained staff. There's no evidence the team lacked preparation; they had an endpoint alert and a response team. The failure happened during the response itself, not beforehand. C is wrong because the team did terminate the malicious process — that step was completed. The scenario explicitly says the process was terminated and the laptop isolated before reimaging, so this answer contradicts the facts. D is wrong because lessons learned happens after full recovery, not before it. Nothing in the scenario suggests the team conducted a post-incident review prematurely. A useful pattern to remember: whenever a scenario shows an incident "resurface" shortly after closure, the root cause is almost always incomplete containment or scope assessment — classic B territory.

Question 5

A company is designing an incident response program for a new cloud platform. It has centralized logs and malware alerts, but a recent exercise showed that responders lacked cloud access, legal contacts, evidence-retention guidance, and an approved method for isolating production workloads.

Which improvement package most directly addresses the phase that should precede effective detection and containment?

Increase alert severity thresholds, lower detection sensitivity, and configure the platform to automatically classify every anomaly as a confirmed incident requiring full response
Restore services from snapshots, validate user transactions, and maintain heightened monitoring after deployment
Delete suspicious cloud resources, rotate all tenant credentials, and rebuild every affected workload immediately
Provision responder access, define contact paths, establish evidence procedures, and approve isolation playbooks (correct answer)

Explanation: When you see an incident response question, anchor yourself to the standard IR lifecycle: Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned. The passage tells you responders already have detection (centralized logs and malware alerts), but they're missing the tools to act effectively. The question asks what phase precedes detection and containment — that's Preparation. D is correct because provisioning responder access, defining legal/contact paths, establishing evidence-retention procedures, and approving isolation playbooks are all Preparation-phase activities. Without these foundational elements in place before an incident, even perfect detection becomes useless — you can see the fire but have no extinguisher, no emergency contacts, and no permission to act. A describes tuning detection thresholds and auto-classifying every anomaly as a confirmed incident. This addresses the Detection phase and would actually harm response quality by creating alert fatigue and false positives — it doesn't fix the preparation gaps the scenario describes. B describes restoring services, validating transactions, and heightened post-deployment monitoring. This maps squarely to the Recovery phase, which comes after containment and eradication — not before detection. C describes deleting resources, rotating credentials, and rebuilding workloads. This corresponds to Eradication, again occurring well after the preparation phase the question is asking about. As a study tip, when IR questions reference things like "access," "contacts," "legal guidance," or "playbooks," those are almost always Preparation-phase keywords. Map each answer choice to its IR phase first, then identify which phase the question is actually asking about.

Question 6

An attacker stole an active cloud session token and used it to upload a persistence script to a virtual machine. The team revokes the token and blocks the source address. The virtual machine remains isolated, but the script and an attacker-created service are still present.

Which statement most accurately distinguishes the work completed from the work still required?

Revoking the token completed eradication; deleting the script and service would be part of recovery
Blocking the address completed detection; isolating the virtual machine would be part of lessons learned
Revoking access provided containment; removing the script and service is still required for eradication (correct answer)
Isolating the machine provided recovery; rotating credentials would be required only during preparation

Explanation: Whenever you see an incident response question, anchor yourself to the NIST framework's four phases: Containment → Eradication → Recovery → Lessons Learned. The key is understanding that these phases are sequential and distinct — stopping the attacker from doing more damage is not the same as cleaning up what they already did. In this scenario, revoking the token and blocking the source address cuts off the attacker's access and prevents further exploitation — that's containment. Isolating the virtual machine also supports containment by limiting lateral movement. However, the malicious script and attacker-created service are still sitting on the machine. Those artifacts must be actively removed before the environment can be considered clean. That removal process is eradication, which hasn't happened yet. This is exactly what C captures: containment is done, eradication is still pending. A is wrong because revoking the token is containment, not eradication. Eradication requires actually eliminating the threat artifacts — a revoked token leaves the script and service untouched. B misidentifies blocking the address as "detection" (detection is identifying that an incident occurred, which happened earlier), and lessons learned comes after full remediation, not during isolation. D incorrectly labels isolation as "recovery" — recovery means restoring systems to normal operations, which can't happen while malicious artifacts remain. Credential rotation also belongs to eradication or containment, not exclusively to preparation. A reliable study tip: map every action in an incident scenario to a specific phase before evaluating the answer choices. Attackers leave behind two things — access and artifacts. Cutting access = containment; removing artifacts = eradication.

Question 7

Responders have isolated a compromised application server and blocked its malicious outbound destinations. Investigation shows that the attacker exploited an unpatched service, installed a web shell, created a scheduled task, and added a privileged local account.

Which next action set is primarily part of eradication rather than containment or recovery?

Keep the server isolated, block related indicators, and restrict communication with adjacent network segments
Remove the web shell, delete persistence mechanisms, eliminate the rogue account, and patch the service (correct answer)
Restore application access gradually, monitor service health, and confirm that users can complete transactions
Document response delays, revise escalation criteria, and assign owners to improve the incident playbook

Explanation: When you see incident response questions, anchor yourself to the PICERL lifecycle: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Each phase has a distinct purpose, and examiners love to blur the lines between them. Eradication means eliminating every foothold the attacker established — not just limiting the damage, but surgically removing malicious artifacts so the environment is clean before anything is restored. That's exactly what B describes: pulling out the web shell, deleting the scheduled task (persistence mechanism), removing the rogue privileged account, and patching the vulnerable service. Each action directly targets something the attacker planted or exploited, leaving no backdoor behind. This is the textbook definition of eradication. A describes containment — isolating the server, blocking indicators of compromise, and segmenting adjacent network areas. These actions limit the blast radius and prevent lateral movement, but they don't remove anything the attacker left behind. C describes recovery — restoring access, verifying service health, and confirming users can transact again. Recovery only begins after eradication is complete; you never restore a system that still contains malware or rogue accounts. D describes the lessons-learned phase — documenting gaps, refining playbooks, and assigning ownership for process improvements. Valuable work, but it happens after the incident is closed, not during active response. A useful memory hook: Containment = stop the bleeding; Eradication = remove the shrapnel; Recovery = heal the wound. On exam questions, scan the answer choices for action verbs — "remove," "delete," "patch," and "eliminate" are eradication signals, while "restore" and "monitor" point toward recovery.

Question 8

A monitoring platform reports impossible travel for an administrator account. An analyst correlates identity logs, confirms that the administrator is not traveling, identifies successful access from an unfamiliar device, and determines which cloud applications were opened. The account has not yet been disabled.

Which incident response phase best characterizes the analyst's work at this point?

Preparation, because the analyst is gathering information that may support a later response decision
Detection, because the analyst is validating the event and determining the incident's initial scope (correct answer)
Containment, because reviewing the accessed applications has already limited the attacker's activity
Eradication, because confirming unauthorized access removes uncertainty about the underlying compromise

Explanation: When you see incident response questions, anchor yourself to the standard IR lifecycle phases: Preparation → Detection & Analysis → Containment → Eradication → Recovery → Lessons Learned. The key is matching what actions are being taken to the right phase, not just what sounds most urgent. Here, the analyst is correlating identity logs, validating the impossible travel alert, confirming the admin isn't actually traveling, identifying the unfamiliar device, and scoping which cloud apps were accessed. Crucially, nothing has been done to stop the attacker yet — the account is still active. This is classic Detection and Analysis work: confirming a true positive and establishing initial scope before any remedial action is taken. That makes B the correct answer. A misidentifies the phase as Preparation. Preparation involves building capabilities before incidents occur — writing playbooks, deploying monitoring tools, training staff. The analyst here is responding to a live event, not preparing for a hypothetical one. C claims Containment has occurred because the analyst reviewed accessed applications. Reviewing is not the same as restricting. Containment requires an action that limits the attacker's reach — disabling the account, revoking sessions, or blocking network access. None of that has happened yet. D conflates confirming a compromise with Eradication. Eradication means removing the threat — deleting malware, closing backdoors, eliminating the root cause. Determining that unauthorized access occurred is still analytical work, not remediation. A useful rule of thumb: if the account is still live and the analyst is still asking "what happened?", you're in Detection and Analysis — not Containment or beyond.

Question 9

During a ransomware incident, the security team lost several hours because no one knew who could authorize disconnecting a revenue-critical system. After recovery, management approves isolation thresholds, names decision makers, establishes alternate communication channels, and schedules quarterly exercises.

Although these actions occur after an incident, which incident response phase do they most directly strengthen?

Preparation, because they establish authority, procedures, communications, and exercises for future incidents (correct answer)
Detection, because they improve the team's ability to confirm whether future alerts are malicious
Containment, because they immediately prevent the recovered ransomware from reaching additional systems
Lessons learned, because any action selected during a post-incident meeting belongs only to that phase

Explanation: When you see a question about incident response phases, resist the urge to focus on when an action happens and instead ask: what purpose does the action serve? The NIST and SANS incident response frameworks define Preparation as everything done to ensure a team is ready to handle future incidents — authority structures, runbooks, communication plans, and practice exercises all live here, regardless of whether they were created before or after a specific event. That's exactly why A is correct. Approving isolation thresholds, naming decision makers, establishing alternate communication channels, and scheduling quarterly exercises are all classic Preparation activities. They directly address the chaos from the ransomware incident by building the infrastructure needed to handle the next incident more effectively. The fact that they were triggered by a post-incident review doesn't change their functional category. B is wrong because Detection focuses on identifying and confirming that a security event is occurring — think monitoring tools, alert tuning, and log analysis. None of the listed actions improve how the team spots or validates future threats. C is wrong because Containment is an active, in-the-moment response action aimed at limiting the spread of a current attack. The ransomware incident is already over; there's nothing left to contain here. D represents a common trap: assuming that anything discussed in a post-incident meeting belongs to the Lessons Learned phase. Lessons Learned is about reviewing and documenting what happened. The outputs of that review — new policies, trained personnel, updated playbooks — feed directly back into Preparation. Remember: in incident response, always classify actions by their function, not by their timing.

Question 10

Malware is beaconing from a workstation used to control warehouse equipment. Immediately powering it off could halt shipping and destroy volatile evidence. Network engineers can place the workstation in a restricted segment that permits only the required controller connection and traffic to a forensic collector.

Which action best satisfies the primary objective of containment while accounting for operational and investigative needs?

Continue monitoring the unrestricted workstation until analysts identify the malware's complete infection chain
Delete the detected executable immediately while leaving all network paths and sessions unchanged
Move the workstation to the restricted segment and preserve volatile data before further remediation (correct answer)
Restore the workstation from its latest backup and return it directly to the production segment

Explanation: When a question tests containment during an active incident, you need to balance three competing priorities simultaneously: stopping the threat from spreading, preserving evidence for investigation, and maintaining business operations. That three-way tension is exactly what this scenario is designed to test. The strongest response is C because it addresses all three priorities at once. Moving the workstation into a restricted network segment cuts off the malware's beaconing and lateral movement paths without powering the machine down — which means volatile memory (running processes, active connections, encryption keys) stays intact for forensic collection. The controller connection is preserved through the restricted segment, so warehouse operations continue. This is textbook containment: isolate, don't eradicate, and capture evidence before it disappears. A fails because continuing to monitor an unrestricted workstation means the malware retains full network access. Waiting for a complete infection chain analysis while the threat runs freely violates the core purpose of containment — you're prioritizing intelligence over protection. B is dangerously incomplete. Deleting the executable removes one artifact but leaves all network sessions open, so any command-and-control communication or lateral movement continues unimpeded. Containment without network isolation is not real containment. D destroys the investigation entirely. Restoring from backup overwrites the infected state, eliminating forensic evidence. Returning directly to production without any isolation also risks reinfection if the root cause is unresolved. A helpful study pattern: on incident-response questions, the correct containment answer almost always preserves options — it doesn't permanently destroy evidence, halt operations, or skip network controls. If an answer does any of those, treat it with suspicion.