← VCE Data Analytics U4O2

Incident response: detect, contain, recover

Set stages for handling a security incident: detect it, contain it, remove the cause, recover systems, then review what happened to improve future security.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 131, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 92, WA Computer Science ATAR Year 11 — Cyber Security — Module 134

Understanding Incident response: detect, contain, recover in VCE Data Analytics U4O2

What it does: Recovery happens after the cause is removed. Restoring from a clean backup returns systems to working order without bringing the threat back. This sequence lists the five stages of incident response in the correct order, so each stage builds on the one before it. Containment limits the damage by isolating affected systems so the incident cannot spread to other devices or data. You must first find the incident, stop it spreading and remove its cause. Only then can systems be restored, followed by a review. A post-incident review looks at what happened, how well the response worked and what controls should change to prevent a repeat.

Common mistakes: The eradicate stage removes the cause of the incident, such as the malware. Reconnecting a PC is not removal and risks spreading or reinfecting. It should read '3. Eradicate: remove malware'. Recovery must happen before the review. Line 4 should be recover(backup) so systems are restored first, and the review comes last.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Incident response: detect, contain, recover to a class →

This module's key terms are also in a printable crossword (Modules 115–134) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A staff member notices unusual logins at 3am and reports it. Which stage of incident response is this?
Detect: spotting that an incident is happeningRecover: restoring systems to normal
Matches
Restore systems from backup first, then work out how the attacker got in
↓
Recovery is done before containing the incident and removing the cause. The threat may still be active and could infect the restored systems again.
Applying
Meanings
Term
incident response
Meaning
Set stages for handling a security incident: detect it, contain it, remove the cause, recover systems, then review what happened to improve future security.
Practice
IF incident detected THEN
Testing
Gaps
2. the incident
Check Answer
Spots
22. Contain: isolate the server
33. Eradicate: reconnect PC

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Scorpion' badge — Venom Debugger, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A staff member notices unusual logins at 3am and reports it. Which stage of incident response is this?
A. Detect: spotting that an incident is happening ✓
B. Recover: restoring systems to normal
Detection is the first stage. The incident must be noticed and identified before anything else can be done.
2. A school finds ransomware on one computer. What is the best containment action?
A. Wait to see if the ransomware spreads
B. Disconnect the computer from the network ✓
Containment limits the damage by isolating affected systems so the incident cannot spread to other devices or data.
3. Which order shows the correct stages of incident response?
A. Detect, contain, remove the cause, recover, review ✓
B. Recover, detect, review, contain, remove the cause
You must first find the incident, stop it spreading and remove its cause. Only then can systems be restored, followed by a review.
4. After removing malware, a business restores its data from a clean backup. Which stage is this?
A. Containment
B. Recovery ✓
Recovery returns systems and data to normal operation, often using clean backups, once the cause has been removed.
5. Why is a post-incident review held after systems are working again?
A. To learn what went wrong and improve future security ✓
B. To prove that no incident ever took place
A post-incident review looks at what happened, how well the response worked and what controls should change to prevent a repeat.

Match the Pairs

Contain → Limit the spread of an incident, for example by disconnecting an infected device from the network so other systems are not affected
Post-incident review → Examine what happened, how well the response worked and what should change, so the same incident is less likely to happen again
Recovery restores affected systems and data to normal operation, for example from a clean backup, once the cause has been removed → Recover: restore data from clean backup
The stages of incident response happen in a set order, starting with detecting the incident and finishing with a review → Detect > Contain > Remove > Recover > Review
Restore systems from backup first, then work out how the attacker got in → Recovery is done before containing the incident and removing the cause. The threat may still be active and could infect the restored systems again.
The incident is fixed and systems are working, so the response is finished → The post-incident review stage is skipped. Without reviewing what happened, the organisation does not learn lessons or improve its security.

Key Term

incident response
Set stages for handling a security incident: detect it, contain it, remove the cause, recover systems, then review what happened to improve future security.

Fill in the Blanks

1. 1. detect the incident 2. contain the incident 3. remove the cause
Hint: Type the stage that stops the incident from spreading.
2. IF alert = TRUE THEN isolate(infectedDevice) END IF
Hint: Type the containment action that cuts a device off from the network.
3. removeCause() restoreSystems(backup) logRecoveryTime()
Hint: Type the stored copy of data used to recover systems.
4. removeCause() recoverSystems() postIncidentReview()
Hint: Type the function name for the final stage that looks back at what happened to improve future security.
5. IF threatDetected = TRUE THEN containIncident() END IF
Hint: Type the keyword that starts the block of steps to run when the condition is true.

Spot the Error

Question 1
A 1. Detect: alert from IDS
B 2. Contain: isolate the server
C 3. Eradicate: reconnect PC
D 4. Recover: restore backups
E 5. Review: update the plan
Line C — The eradicate stage removes the cause of the incident, such as the malware. Reconnecting a PC is not removal and risks spreading or reinfecting. It should read '3. Eradicate: remove malware'.
Question 2
A detect(alert)
B contain(infected_pc)
C remove(malware)
D review(incident)
E review(incident)
Line D — Recovery must happen before the review. Line 4 should be recover(backup) so systems are restored first, and the review comes last.
Question 3
A Alert: unusual logins at 2am
B Action: wipe all audit logs
C Next: remove the malware
Line B — Once an incident is detected, the next step is containment. Isolate the affected PC to stop the spread. Wiping audit logs destroys evidence needed to understand the incident.
Question 4
A Stage 1: Detect
B Stage 2: Recover
C Stage 3: Remove cause
D Stage 4: Recover
E Stage 5: Review
Line B — Stage 2 is Contain. Recover is stage 4 and happens only after the cause has been removed. Recovering too early could restore systems that are still compromised.
Question 5
A detect: wipe every computer
B contain: block the attacker IP
C recover: restore clean backup
Line A — Detecting means noticing and identifying the incident, here through the IDS flagging odd traffic. Wiping every computer is a drastic recovery action, not detection.

Student with a class code? Join your class →