Tools / Cyber Security Interview Questions
Explain the lifecycle of an Incident Response process?
flowchart LR
A[Preparation] --> B[Identification]
B --> C[Containment]
C --> D[Eradication]
D --> E[Recovery]
E --> F[Lessons Learned]
F --> A
Incident response follows a defined lifecycle so that a security event is handled consistently and nothing critical gets missed under pressure.
- Preparation: building playbooks, tooling, and training before an incident ever happens
- Identification: detecting and confirming that an actual security incident is underway
- Containment: isolating affected systems to stop the incident from spreading further, often split into short-term and long-term containment
- Eradication: removing the root cause, such as malware or a compromised account
- Recovery: restoring systems to normal operation and monitoring closely for signs of reinfection
- Lessons Learned: a post-incident review to document what happened and improve future response
Skipping straight to eradication without proper containment is a common mistake, since it can tip off the attacker and destroy forensic evidence needed to understand the full scope of the breach.
Which phase comes immediately before Eradication in incident response?
What risk comes from skipping containment and jumping to eradication?
More Related questions...
