Incident response: detect, contain, recover

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A staff member notices unusual logins at 3am and reports it. Which stage of incident response is this?

A Detect: spotting that an incident is happening

B Recover: restoring systems to normal

2. A school finds ransomware on one computer. What is the best containment action?

A Wait to see if the ransomware spreads

B Disconnect the computer from the network

3. Which order shows the correct stages of incident response?

A Detect, contain, remove the cause, recover, review

B Recover, detect, review, contain, remove the cause

4. After removing malware, a business restores its data from a clean backup. Which stage is this?

A Containment

B Recovery

5. Why is a post-incident review held after systems are working again?

A To learn what went wrong and improve future security

B To prove that no incident ever took place

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Contain		AThe post-incident review stage is skipped. Without reviewing what happened, the organisation does not learn lessons or improve its security.
2Post-incident review		BRecover: restore data from clean backup
3Recovery restores affected systems and data to normal operation, for example from a clean backup, once the cause has been removed		CDetect > Contain > Remove > Recover > Review
4The stages of incident response happen in a set order, starting with detecting the incident and finishing with a review		DLimit the spread of an incident, for example by disconnecting an infected device from the network so other systems are not affected
5Restore systems from backup first, then work out how the attacker got in		ERecovery is done before containing the incident and removing the cause. The threat may still be active and could infect the restored systems again.
6The incident is fixed and systems are working, so the response is finished		FExamine what happened, how well the response worked and what should change, so the same incident is less likely to happen again

Definitions

incident response

Fill in the Blanks

Complete each line of code by filling in the missing parts.

1. detect the incident 2. _______ the incident 3. remove the cause

IF alert = TRUE THEN _______(infectedDevice) END IF

removeCause() restoreSystems(______) logRecoveryTime()

removeCause() recoverSystems() __________________()

IF threatDetected = TRUE ____ containIncident() END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A 1. Detect: alert from IDS

B 2. Contain: isolate the server

C 3. Eradicate: reconnect PC

D 4. Recover: restore backups

E 5. Review: update the plan

Question 2

A detect(alert)

B contain(infected_pc)

C remove(malware)

D review(incident)

E review(incident)

Question 3

A Alert: unusual logins at 2am

B Action: wipe all audit logs

C Next: remove the malware

Question 4

A Stage 1: Detect

B Stage 2: Recover

C Stage 3: Remove cause

D Stage 4: Recover

E Stage 5: Review

Question 5

A detect: wipe every computer

B contain: block the attacker IP

C recover: restore clean backup

Answer Key

Incident response: detect, contain, recover

Section A: Quick Questions

A — Detect: spotting that an incident is happening

B — Disconnect the computer from the network

A — Detect, contain, remove the cause, recover, review

B — Recovery

A — To learn what went wrong and improve future security

Section B: Match the Pairs

Contain → Limit the spread of an incident, for example by disconnecting an infected device from the network so other systems are not affected

Post-incident review → Examine what happened, how well the response worked and what should change, so the same incident is less likely to happen again

Recovery restores affected systems and data to normal operation, for example from a clean backup, once the cause has been removed → Recover: restore data from clean backup

The stages of incident response happen in a set order, starting with detecting the incident and finishing with a review → Detect > Contain > Remove > Recover > Review

Restore systems from backup first, then work out how the attacker got in → Recovery is done before containing the incident and removing the cause. The threat may still be active and could infect the restored systems again.

The incident is fixed and systems are working, so the response is finished → The post-incident review stage is skipped. Without reviewing what happened, the organisation does not learn lessons or improve its security.

Section C: Definitions

incident response — Set stages for handling a security incident: detect it, contain it, remove the cause, recover systems, then review what happened to improve future security.

Section D: Fill in the Blanks

1. detect the incident
2. contain the incident
3. remove the cause

IF alert = TRUE THEN
    isolate(infectedDevice)
END IF

removeCause()
restoreSystems(backup)
logRecoveryTime()

removeCause()
recoverSystems()
postIncidentReview()

IF threatDetected = TRUE THEN
    containIncident()
END IF

Section E: Spot the Error

C — The eradicate stage removes the cause of the incident, such as the malware. Reconnecting a PC is not removal and risks spreading or reinfecting. It should read '3. Eradicate: remove malware'.

D — Recovery must happen before the review. Line 4 should be recover(backup) so systems are restored first, and the review comes last.

B — Once an incident is detected, the next step is containment. Isolate the affected PC to stop the spread. Wiping audit logs destroys evidence needed to understand the incident.

B — Stage 2 is Contain. Recover is stage 4 and happens only after the cause has been removed. Recovering too early could restore systems that are still compromised.

A — Detecting means noticing and identifying the incident, here through the IDS flagging odd traffic. Wiping every computer is a drastic recovery action, not detection.