Qwissit Cybersecurity

Security+ SY0-801

Incident Response and Forensics

12 of 60 questions in the app

Incident response

  1. What is a playbook in incident response? Easy
  2. What is a tabletop exercise? Easy
  3. Why are roles for incident handling defined in advance? Easy
  4. In common models, which phase follows the detection of an incident? Easy
  5. What is the goal of containment? Easy
  6. What does quarantining or isolating a computer mean? Easy
  7. What happens in the eradication phase? Easy
  8. What is the goal of a lessons learned session after an incident? Easy

Incident response

  1. Which order of phases corresponds to the usual incident handling process? Medium
  2. What distinguishes a simulation from a tabletop exercise? Medium

Incident response

  1. The SOC notices that an attacker has been on the network for days via a compromised admin account and has placed several backdoors. Why can it make sense not to clean individual systems immediately? Hard
  2. Ransomware is currently spreading over SMB on the network. Which containment measures are most urgent? Hard

Certifications & exams

Which exam comes next?

You can already practise for 19 exams, and 21 are up for a vote. See all certifications with their official information, cast your vote or suggest your exam.

See all certifications