Incident Response
Explain appropriate incident response activities
What you will learn
- Order the response phases and explain why this particular order.
- Separate containment, eradication and recovery.
- Know the rules of digital evidence: chain of custody, preservation and legal hold.
- Explain root cause analysis and threat hunting, and when each is used.
This objective's questions turn on order: the question describes a situation and asks "what next". The answer does not come from eagerness to fix things but from knowing that each phase spoils the next if taken out of turn.
The seven phases
Preparation
The plan, the team, the tools, the training. It cannot be built during an incident — it either exists or it does not.
Detection
Noticing something happened, from an alert, a report or an observation.
Analysis
Scoping: what is infected, what is affected, what the path was. Containing before scoping shuts down healthy systems and leaves infected ones running.
Containment
Stopping the spread while preserving evidence. Isolate, do not power off — powering off destroys memory, where the best evidence lives.
Eradication
Removing the cause: the malware, the compromised account, the exploited flaw.
Recovery
Restoring service with heightened monitoring — because the attacker may have left a door nobody found.
Lessons learned
The most neglected phase, which is why the same incident recurs.
Do not power the machine off
The first instinct on finding an infection is to pull the power. It is wrong: memory holds running processes, open connections and encryption keys — all of which vanish on shutdown. The correct move is isolating the host from the network while leaving it running, and capturing a memory image first. If a question mentions evidence or an investigation, powering off is always the wrong option.
Digital evidence
| Chain of custody | An unbroken record of who held the evidence, when, and what they did with it. A break invalidates it in court however accurate it is. |
|---|---|
| Legal hold | An instruction freezing deletion of data related to a dispute or investigation. It overrides the normal retention policy. |
| Acquisition / preservation | Taking a bit-for-bit copy and working on it rather than the original, with a hash proving it was not altered. |
| Order of volatility | Collecting evidence from the most volatile to the most durable: memory, then connections, then disk, then backups. |
| Root cause analysis | Why did this happen at all? Not "what was the malware" but "how did it get in and why did we not see it". |
| Threat hunting | Proactively searching for an attacker already present who triggered no alert. It assumes compromise instead of waiting for an alarm. |
Current context: NIST restructured
The order above is what SY0-701 tests. For awareness only: in April 2025 NIST released the third revision of SP 800-61, restructured around Cybersecurity Framework 2.0 rather than the traditional four-phase cycle. This does not change what the exam asks, and it is useful to know the reference has moved on.
Real-world example: an order ruined by haste
An analyst finds ransomware on a file server. The bad response: power it off at once, wipe it, restore from backup, declare the incident over. The result is that memory is gone so nobody knows how the attacker got in, the restored copy may contain the same malware because the infection date is unknown, and the compromised account that was used still works. The correct response: isolate the server from the network while leaving it running, capture a memory image, then scope the analysis — did it reach anything else? — then eradicate, then recover with monitoring. The whole difference is that analysis came before containment and containment before eradication.
What matters on the exam
- Containment always before eradication, and analysis before containment. The order is what is tested.
- "Disconnect it from the network" is right; "shut it down" is wrong whenever evidence is mentioned.
- A break in the chain of custody invalidates the evidence in court. Documentation is not bureaucracy here.
- Threat hunting is proactive with no alert; incident response is reactive after one. The question distinguishes by who initiated.
Quick check
Answer in your head first, then reveal.
Why isolate an infected host instead of powering it off?Reveal the answer
Because memory holds running processes, open connections and encryption keys, all lost on shutdown. Isolation stops the spread and preserves the evidence at the same time.
Why does analysis come before containment?Reveal the answer
Because containing without knowing the scope isolates what is clean and leaves what is infected. Scoping first makes containment precise instead of an expensive guess.
What separates root cause analysis from eradication?Reveal the answer
Eradication removes what you found in this incident. Root cause analysis answers: why was it possible at all, and why did we not see it sooner? The first ends the incident; the second stops it recurring.
When does threat hunting begin?Reveal the answer
With no alert. It is a proactive search assuming an attacker is already inside whom the tools missed, looking for their traces from hypotheses. Incident response starts after a signal; this starts without one.
Sign in to track your progress on this topic.
Your next step
Read the lesson, then mark it complete
Sources
Used to verify the facts. The writing is original to Passuit.