What are the general steps of an incident response relevant to inquiries?

What are the general steps of an incident response relevant to inquiries?

• A. Identify, contain, escalate, notify, and close the inquiry.
• B. Identify, contain, eradicate, recover, and review; report to the supervisor and document actions.
• C. Identify the source only after the customer complains.
• D. Identify, contain, eradicate, recover, and review; report to the supervisor and document actions.

Answer: (D)

The idea being tested is how a typical incident response unfolds from start to finish, with an emphasis on accountability during inquiries. In practice, you want to move quickly to determine what happened (identify), limit further impact (contain), remove the cause (eradicate), restore normal operations (recover), and then learn from the incident to prevent recurrence (review). When inquiries are involved, documenting every action and reporting to a supervisor ensures there’s a clear trail for accountability and future audits. Identify sets the direction by understanding the scope of the issue. Contain prevents further damage by isolating affected systems or data. Eradicate removes the root cause, such as removing malware or closing the vulnerability that was exploited. Recover brings systems back online and verifies they’re clean and functioning, while monitoring for any sign of relapse. Review analyzes what happened and how it was handled to improve processes, tools, and defenses. Reporting to a supervisor and documenting actions are essential because they provide traceability and accountability for how the incident was managed, which is just as important as resolving the issue itself. The other options fall short because they skip or reorder critical steps, or suggest waiting for a complaint before acting, which isn’t appropriate for proactive incident handling.

The idea being tested is how a typical incident response unfolds from start to finish, with an emphasis on accountability during inquiries. In practice, you want to move quickly to determine what happened (identify), limit further impact (contain), remove the cause (eradicate), restore normal operations (recover), and then learn from the incident to prevent recurrence (review). When inquiries are involved, documenting every action and reporting to a supervisor ensures there’s a clear trail for accountability and future audits.

Identify sets the direction by understanding the scope of the issue. Contain prevents further damage by isolating affected systems or data. Eradicate removes the root cause, such as removing malware or closing the vulnerability that was exploited. Recover brings systems back online and verifies they’re clean and functioning, while monitoring for any sign of relapse. Review analyzes what happened and how it was handled to improve processes, tools, and defenses.

Reporting to a supervisor and documenting actions are essential because they provide traceability and accountability for how the incident was managed, which is just as important as resolving the issue itself. The other options fall short because they skip or reorder critical steps, or suggest waiting for a complaint before acting, which isn’t appropriate for proactive incident handling.