Incident Response and Investigation

The incident is over when the story is true

Every incident ends twice. The first ending is operational: systems restored, alerts quiet, night calls over, recovery declared. The second ending comes later, sometimes much later, when an executive asks what actually happened, a regulator asks what was done about it, a court asks what evidence exists, or an auditor asks what changed so it does not happen again. Organizations that prepare only for the first ending are surprised by the second. This chapter is about the discipline that makes both endings defensible: incident response, the craft of acting correctly under pressure, and investigation, the craft of proving what happened with evidence that survives scrutiny.

The exam tests both through the manager’s lens. It will not ask you to carve a deleted file or tune a containment rule. It will ask which data to collect first, why a log printout can count as an original document, what a chain of custody is for, which phase of the lifecycle a given activity belongs to, and which standard requires a given response control. The answers rest on a few durable ideas. The lifecycle has a shape and its activities have an order. Evidence has properties that make it admissible, and the process must preserve those properties. And the plan is only as good as the preparation that preceded the incident.

So this chapter follows the incident itself. First, who owns the response: the vocabulary, the team structures, the roles. Then the lifecycle in four phases, in the order NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide, August 2012) lays them out, with the decisions a manager makes at each step. Then the record: what makes evidence admissible, from the Federal Rules of Evidence to the factors NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response, August 2006) uses to describe trustworthy evidence. Then the forensics: how data is collected, examined, analyzed, and reported, including the order of volatility from RFC 3227 (Guidelines for Evidence Collection and Archiving, February 2002). Then the investigation as a project: authority, scope, interviews, law, and the decision points that belong to executives rather than technicians. And finally the controls that anchor all of it: ISO/IEC 27001:2022 Annex A 5.24 through 5.28, PCI DSS v4.0 Requirement 12.10, and GDPR Articles 33 and 34.

Who owns the response

Before the lifecycle, the vocabulary. NIST SP 800-61 Rev. 2 defines an event as any observable occurrence in a system or network, and an incident as a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. Chapter 25 used that line to separate the routine from the exceptional. Here the same line does different work: it determines who gets called and which obligations wake up. A single failed login is an event. An attacker holding a working session is an incident. Phishing mail that nobody opened is an event; phishing mail that installed a loader is an incident. The distinction is operational before it is legal, because incidents trigger notification duties, legal hold, insurance claims, and disclosure obligations that events never do.

Two documents govern response, and they are not the same document. The incident response policy is governance: it states that the organization will respond to incidents, names the authority that owns response, and sets expectations for escalation, notification, and reporting. The incident response plan is operational: it tells the team who does what, in what order, with which tools, and with whom to communicate. A common failure is writing a plan with no policy behind it, or writing a policy so vague that the plan cannot hang from it. The exam rewards plans that are tested rather than filed.

Teams come in three structural flavors, all discussed in NIST SP 800-61 Rev. 2. A centralized team handles incidents for the whole organization from one unit, which concentrates expertise but can become a bottleneck. A distributed team embeds responders in each major business unit, which speeds local response but fragments knowledge and consistency. A coordinating team is a small unit that does not own the response but coordinates the people who do, common in large or federated organizations and in outsourced response. The right structure follows the organization’s shape, and the exam is satisfied by knowing the three models and their trade-offs.

Roles matter more than titles. Most plans name an incident commander, who owns decisions and outcomes for the incident whether or not that person is the most senior technician present. Around the commander sit the lead analyst, who directs technical work; communications, who owns internal and external messaging; legal, who owns privilege, notification, and regulatory questions; human resources, who becomes involved when personnel are implicated; and public relations when the incident is visible. The discipline of response is mostly the discipline of staying in role: the technician who announces containment decisions, or the commander who starts digging through logs, is how responses drift.

The lifecycle: four phases that repeat

NIST SP 800-61 Rev. 2 organizes incident handling into four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The sequence is not a one-way street: analysis continues during containment, and containment, eradication, and recovery frequently reveal new indicators that send the team back to detection. What matters for the exam is the shape: preparation is what you do before there is an incident, the middle phases are what you do during it, and post-incident activity is what you do after it, including feeding lessons back into preparation.

Preparation

Preparation is the phase that determines every other phase, and it is the one most organizations starve. It means having a policy and plan that senior management approved; a team that is staffed, trained, and on call; playbooks, step-by-step procedures for the incident types the organization most expects, such as malware, phishing, ransomware, denial of service, data theft, and insider activity; contact lists that are current, including internal escalation paths and external parties such as law enforcement, the incident response retainer, ISPs, cloud providers, and vendors; and the tools and materials responders need, including forensic kits, imaging workstations, write blockers, hashing tools, spare media, and the means to acquire logs from every relevant source.

Preparation also means exercising. NIST SP 800-84 (Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities, September 2006) organizes exercises from discussion-based to operations-based. A tabletop exercise walks key players through a scenario in a conference room, testing roles and decisions without touching live systems; it is cheap, fast, and the best tool for finding gaps in the plan. A functional exercise executes specific functions under simulated conditions, such as running the actual escalation and communication procedures. A full-scale exercise tests as much of the plan as possible, often including external parties, under realistic conditions. The exam expects you to know that tabletop is discussion-based and lighter than functional and full-scale exercises, and that testing is how a plan stays honest.

Detection and Analysis

An incident is rarely announced; it is inferred. NIST SP 800-61 Rev. 2 draws the inference in two flavors. A precursor is a sign that an incident may occur in the future, such as a new vulnerability disclosure with exploit code in the wild before a patch exists. An indicator is a sign that an incident may have occurred or may be occurring now, such as an unusual outbound connection, a successful login from an unknown location after failed attempts, an endpoint detection alert, or a file integrity alert on a system file. The exam tests this pair directly, and the tell is time: precursors are about what is coming, indicators about what is here.

Analysis is where events get sorted. The team correlates the indicator with other sources, determines whether it is a false positive, identifies which systems and data are affected, and estimates impact and severity. NIST SP 800-61 Rev. 2 also names the attack vectors that incident handlers should recognize: external and removable media, attrition such as denial of service, web, email, impersonation, improper usage, and loss or theft of equipment. Once analysis supports it, the organization declares the incident formally, activates the plan, and starts the clock on notification. Notification is a two-way discipline: internal, to management, legal, HR, and communications; and external, to regulators, customers, and partners where law or contract requires it, a subject the end of this chapter takes up with GDPR and PCI DSS.

Containment, Eradication, and Recovery

Containment stops the bleeding. The decision is usually about isolation strategy: disconnect the host, block the source at the network edge, disable the account, or segment the subnet. Every choice trades speed against information. Cutting a system off the network immediately protects neighbors but destroys the investigator’s ability to watch the attacker move, collect indicators, and understand the reach of the compromise. NIST SP 800-61 Rev. 2 frames this as short-term versus long-term containment: short-term containment is the emergency action, such as disconnecting a host to stop propagation; long-term containment is the studied state, such as maintaining a monitored connection to an attacker’s command and control channel while evidence is collected. The manager’s question is not “which tool isolates best” but “what does this incident need more: containment now, or evidence and understanding?”

Eradication removes the cause. Malware is deleted or neutralized, credentials that may have been exposed are revoked, the vulnerability that let the attacker in is patched or mitigated, and affected hosts are rebuilt from known-good media where confidence in the running system is gone. Eradication is incomplete if the team cannot show what the attacker touched, which is why it follows evidence collection rather than replacing it.

Recovery returns the organization to operation. Data is restored from clean backups, restored systems are validated for integrity, and services are phased back into production under heightened monitoring. Recovery is not a flip of a switch; it is a monitored return, because reinfection or a second intrusion is common when the original entry point was missed. Throughout the middle phases, documentation is not optional. Every action, every timestamp, every person involved, every decision and its rationale becomes part of the incident record, and that record feeds both the post-incident phase and any legal or regulatory proceeding.

Post-Incident Activity

The fourth phase is where most of the value of an incident is created, and most of it is squandered. The centerpiece is the lessons learned meeting, held soon after the incident while the details are fresh, in a blame-free atmosphere. The questions are structural: what worked, what did not, what would we do differently, which assumptions failed, which controls let this happen. The outputs are the incident report, the timeline, the root cause analysis, and a set of improvement items that feed back into preparation: updated playbooks, new training, revised monitoring, tightened controls, changed vendors, better contracts.

The phase also produces the measures that tell management the cost and shape of the incident: number of incidents, time to detect, time to contain, time to recover, cost per incident, and the proportion of incidents detected internally versus reported by outsiders. NIST SP 800-61 Rev. 2 tells teams to define metrics tied to the goals of the plan, and the exam treats metrics as evidence that the program is managed rather than improvised. Finally, the record is retained: logs, images, notes, and reports are evidence, and evidence retention is governed by the retention and legal hold rules Chapter 10 covered, plus the duty to preserve that arrives when litigation is reasonably anticipated.

Evidence: what will hold up later

Everything an incident produces, from a firewall log to a forensic image to a responder’s notebook, is potential evidence, and evidence is only as good as its ability to be admitted and believed. NIST SP 800-86 describes the factors that make evidence admissible: authenticity, the evidence relates to the incident in an appropriate way; reliability, the methods used to collect and handle it are generally accepted; completeness, the evidence tells the whole story rather than a convenient slice; and believability, a judge or jury can understand it. The forensic process is designed to preserve these four properties, and the exam tests the vocabulary more than the law.

The best evidence rule, Federal Rules of Evidence Rule 1002, requires an original writing, recording, or photograph to prove its content, and Rule 1001 defines what an original is for computer data: any printout or other output readable by sight, if it accurately reflects the data, is an original. This is a favorite exam trap. A readable printout of an audit log is not a “copy” that the best evidence rule rejects; it is the original for purposes of the rule, so long as it accurately reflects the stored data. What the rule actually attacks is relying on secondary descriptions, summaries, or hearsay recollections of a document’s content when the document itself is available.

Hearsay is an out-of-court statement offered to prove the truth of the matter asserted, and it is excluded unless an exception applies. The digital nuance is the distinction between computer-generated and computer-stored records. A firewall log, an authentication record, or a database transaction entry is generated automatically by the system; it is not a statement of a human declarant, so hearsay analysis generally does not apply to it at all. An email, a chat message, or a spreadsheet cell typed by a person is computer-stored: a human wrote it, so if it is offered for its truth, the hearsay rules apply, and the classic path in is the business records exception. Rule 803(6) admits records kept in the course of a regularly conducted activity, made at or near the time by someone with knowledge, when it was the regular practice of the activity to make them, and the circumstances do not indicate untrustworthiness. The exam wants you to see the boundary: the machine wrote it, or the person did, and the hearsay analysis turns on that.

Expert testimony is governed by Rule 702, which requires that the expert be qualified, that the testimony be based on sufficient facts or data, that it be the product of reliable principles and methods, and that the expert reliably applied them. The Supreme Court’s Daubert decision made the trial judge the gatekeeper for scientific and technical evidence, and courts weigh factors that include whether the method has been tested, whether it was peer reviewed and published, the known or potential error rate, the existence of standards, and general acceptance in the field. A forensic examiner whose methods are unverifiable, or whose tool has no recognized error rate, is a liability. The exam tests Daubert as a standard of reliability for expert evidence, not as a procedure to run.

Chain of custody is the administrative spine of authenticity. It is the unbroken record of who possessed the evidence, when, where, and what was done to it, from the moment of collection to the moment it is produced. Every transfer is logged and signed; every storage location is controlled; every examination is documented so that the evidence can be shown not to have been altered, substituted, or contaminated. A gap in the chain gives opposing counsel an opening to argue the evidence is not what it appears to be, and the exam treats the chain as the mechanism that makes the authenticity factor real.

Two more legal concepts complete the picture. Legal hold is the duty to preserve relevant evidence once litigation or an official investigation is reasonably anticipated; it suspends routine retention and deletion. Destroying evidence subject to a hold is spoliation, and it can produce sanctions, adverse inference instructions, or worse, entirely independent of the underlying case. And privilege deserves respect: attorney-client communications and attorney work product are protected, and forensic reports prepared at counsel’s direction may fall under that protection. The practical rule is that privileged analysis belongs in privileged channels, and a technical team that streams its working theories into unprivileged chat and email can destroy the protection the organization thought it had.

Forensics: from bits to findings

Forensics is the discipline of turning data into defensible findings. NIST SP 800-86 organizes the forensic process into four phases. Collection is the search for, recognition of, preservation of, and acquisition of evidence, which is any information of probative value stored or transmitted in digital form. Examination is the extraction and reduction of the collected data, separating what is relevant to the investigation from everything else. Analysis is the interpretation: drawing conclusions about what happened, who was involved, and what the evidence means, usually from the relationships among the examined artifacts. Reporting is the written record of the process and conclusions, written so that a non-specialist can follow it. The exam tests the order and the vocabulary, and the order is the point: analysis without collection is speculation, and collection without documentation is worthless.

Collection begins with a question of time, answered by RFC 3227: the order of volatility. Evidence should be collected from the most volatile to the least volatile, because the most volatile data disappears first. The classic ordering runs from CPU registers and processor cache, through routing tables, the ARP cache, the process table, kernel statistics, and memory, then temporary file systems, then disk, then remote logging and monitoring data, and finally physical configuration, network topology, and archival media. The practical consequence is that a responder who powers down a running system to “preserve” it has just destroyed the most valuable evidence it held: the contents of memory, which include running processes, open network connections, loaded modules, and, frequently, decrypted data and malware that live only in RAM.

That is why memory forensics exists and why it comes before everything on disk. Hibernation files can contain a snapshot of RAM, and pagefiles can hold swapped fragments, but neither is a substitute for a live capture. In practice this forces the live-versus-dead choice. Live forensics collects evidence from a running system, starting with volatile data and then acquiring disk while the system remains up; it is the only option for volatile data and for many cloud and remote systems. Dead forensics powers the system down, removes the media, and analyzes it on controlled hardware; it is cleaner and easier to defend, but the volatile data is already gone. The manager’s rule: if the volatile data matters, and it usually does, the collection plan has to include a live step, and the plan has to be made before the incident, because nobody rebuilds a forensic kit during a fire.

Disk acquisition follows its own discipline. A physical image is a bit-for-bit copy of the entire medium, preserving deleted space and unallocated clusters; a logical copy preserves selected files and directories, which is faster but loses everything outside the selection. The source medium is protected by a hardware write blocker, a device that allows read-only access so that the act of acquiring the evidence cannot modify it. And integrity is anchored with hashing: the examiner computes a cryptographic hash, typically SHA-256, of the source and of the image, and matching hashes demonstrate that the image is a faithful copy. The hash is recomputed at every later stage, and any mismatch is a red flag that the evidence changed.

Examination and analysis are where the story is built. Timeline analysis reconstructs what happened when, correlating file MAC times, modify, access, and change, with event logs, authentication records, and registry artifacts, and it demands honesty about time: evidence carries the timestamps its system’s clock recorded, so the investigator accounts for time zones and clock skew before drawing conclusions. Anti-forensics, the deliberate effort to frustrate analysis through encryption, log alteration, timestamp manipulation, data hiding, or wiping, cannot be assumed away; the analyst works with the artifacts that survive and with the gaps that their absence reveals, which is itself a finding. Cloud environments change the mechanics: there is no physical drive to pull, so collection runs through provider snapshots, APIs, and platform logs, and the chain of custody extends to the provider’s documentation and the preservation requests that keep the data from being recycled.

The investigation as a project

An investigation is a project with an owner, a scope, and a budget, and the exam wants the manager to see it that way. Authority comes first: who may collect what is governed by policy, employment agreements, and law, and the collection plan is a legal decision as much as a technical one. Workplace monitoring generally rests on consent, notice, and legitimate purpose; interception of communications is regulated, in the United States by the Electronic Communications Privacy Act and the Stored Communications Act (18 U.S.C. Section 2701 and following), and unauthorized access to systems can itself be a crime under the Computer Fraud and Abuse Act (18 U.S.C. Section 1030). The point for the manager is not to memorize statutes but to know that investigators do not simply collect everything: they collect what the policy and the law authorize, and legal counsel is in the room when the boundaries are drawn.

Interviews are part of almost every insider investigation, and they are different from forensic collection. The interview gathers facts from witnesses and subjects; it is not an interrogation, and it is not an HR action. When personnel are implicated, HR leads the personnel side, legal guides the evidentiary side, and the two stay coordinated so that the process is fair to the employee and defensible for the organization. Privacy law crosses the same ground: under the GDPR, the personal data collected during an investigation is still personal data, subject to purpose limitation, minimization, and data subject rights, even when the investigation is urgent.

The investigation also lives in a legal landscape with different rules for different forums. A civil proceeding and a criminal proceeding apply different burdens of proof, preponderance of the evidence versus beyond a reasonable doubt, and different procedural expectations. Law enforcement involvement changes the record: warrants, disclosure obligations, and the handling of evidence all shift. The exam rarely goes beyond this shape, but it does reward knowing that an investigation produces two kinds of truth, the operational truth that guides response and the evidentiary truth that must survive challenge, and that the same data serves both only if the process protects both.

One decision belongs unmistakably to executives: whether to pay a ransom. Paying does not guarantee that data will be returned or that the attacker will not strike again, payment may violate sanctions regimes and fund criminal operations, and law enforcement and guidance from agencies such as CISA consistently advise reporting the incident rather than quietly paying. The manager’s job is to make sure the decision is made by the people who own the risk, with legal and law enforcement input, and that it is a decision, not a default.

The controls that anchor response

Three standards close the loop, and the exam checks them by name. ISO/IEC 27001:2022 Annex A groups incident management into five controls that form a complete loop: A 5.24, information security incident management planning and preparation; A 5.25, assessment and decision on information security events; A 5.26, response to information security incidents; A 5.27, learning from information security incidents; and A 5.28, collection of evidence, which requires the organization to establish procedures for the identification, collection, acquisition, and preservation of evidence in accordance with applicable legal and regulatory requirements. The five controls mirror the lifecycle: prepare, assess, respond, learn, and preserve, and the exam tests them as a family, with A 5.28 as the forensic anchor.

PCI DSS v4.0 Requirement 12.10 requires merchants and service providers to have an incident response plan and to actually respond: documented roles and responsibilities, response and escalation procedures, business continuity provisions, on-call coverage, monitoring of and response to alerts from implemented technologies, and incident response training, with the plan reviewed and tested at least annually. Where cardholder data is in scope, the response is a compliance obligation, and the 12.10 sub-requirements read like a checklist version of the preparation phase.

The GDPR contributes the notification duty, and it is the versioned fact the exam most likes to test. Article 33 requires that a personal data breach, defined in Article 4(12) as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data, be notified to the supervisory authority without undue delay and, where feasible, not later than 72 hours after the controller becomes aware of it, unless the breach is unlikely to result in a risk to individuals. Article 34 requires communication to the data subjects without undue delay when the breach is likely to result in a high risk to their rights and freedoms. Article 33(5) also requires the controller to document every breach, including the facts, effects, and remedial action taken, and that documentation obligation makes the incident record a legal artifact from the moment of detection.

The manager’s reading of the whole apparatus: the process standard is NIST SP 800-61 Rev. 2, the forensic integration is NIST SP 800-86, the exercise guidance is NIST SP 800-84, the international control set is ISO/IEC 27001:2022 Annex A 5.24 through 5.28, the card industry layer is PCI DSS v4.0 Requirement 12.10, and the privacy layer is GDPR Articles 33 and 34. They are not competing lists. They are the same lifecycle viewed from different heights, and a response that follows the lifecycle satisfies most of them at once. What the lifecycle cannot supply is the one thing every standard assumes and no standard can create: the decision, made in advance, that the organization will respond as if the story matters, because the incident is not over until the story is true.

Practice questions

1. A responder arrives at a running system believed to be compromised and must collect evidence. Per RFC 3227, which of the following should be captured first?

   A. The contents of CPU registers and processor cache B. A bit-for-bit image of the hard disk C. The contents of temporary file systems D. Remote logging and monitoring data

2. An organization’s logging shows an automated scan of its web servers by an unfamiliar source, with no successful intrusion and no impact on any system. Per NIST SP 800-61 Rev. 2, which of the following best describes the situation?

   A. An incident, because an unauthorized source contacted the network B. An incident, because scans are always treated as intrusions C. An event, because no policy violation or threat to confidentiality, integrity, or availability occurred D. An event, because only successful intrusions are reportable

3. A prosecutor wants to introduce a printout of a database audit log to prove what the log contained. The defense objects that the best evidence rule requires the original and that a printout is only a copy. Which statement is correct under the Federal Rules of Evidence?

   A. The printout is inadmissible because the best evidence rule requires the electronic original B. A printout of computer data that accurately reflects the stored data is itself an original under Rule 1001 C. The log can be admitted only if a forensic examiner testifies to the hash of the database D. The printout is hearsay and cannot be admitted for any purpose

4. A court is evaluating two records from a system: an authentication log written automatically by the operating system, and an email written by an employee. Which statement correctly describes how hearsay rules apply?

   A. Both records are hearsay and require the business records exception B. Neither record is hearsay because both are computer records C. The authentication log is computer-generated and generally not hearsay, while the email is computer-stored and may be hearsay D. The email is admissible without exception, while the authentication log requires the best evidence rule

5. An organization seeks to admit its customer support records under the business records exception to the hearsay rule, Rule 803(6). Which element must the organization demonstrate?

   A. The records were created specifically in anticipation of litigation B. The records were kept in the course of a regularly conducted activity, made at or near the time by someone with knowledge, as a regular practice C. The records were reviewed and approved by an attorney before being stored D. The records contain only facts that corroborate other evidence

6. During disk acquisition, an examiner attaches the suspect drive to a forensic workstation through a write blocker. What is the primary purpose of the write blocker?

   A. To speed up the imaging process by caching reads B. To allow read-only access so the acquisition cannot modify the source medium C. To decrypt the drive if it is protected by encryption D. To prevent the examiner’s tools from detecting the source drive

7. An examiner computes a SHA-256 hash of the source disk and of the forensic image at acquisition, and recomputes the hash of the image before analysis. What is the purpose of this step?

   A. To prove the identity of the person who created the image B. To verify that the image is an unmodified copy of the source and that nothing changed in transit or storage C. To encrypt the image so it cannot be read without a key D. To determine which filesystem the source disk uses

8. An incident responder wants to collect evidence of malware behavior from a workstation that is currently running. Why is capturing the contents of memory a priority before powering down the system?

   A. Memory holds the only copy of the operating system files B. Volatile data such as running processes, open network connections, and decrypted content is destroyed when the system loses power C. Powering down deletes the hard disk contents D. Memory captures are required by the order of volatility after disk imaging

9. A forensic examiner’s workflow follows NIST SP 800-86. Which of the following lists the phases of the forensic process in the correct order?

   A. Collection, examination, analysis, reporting B. Analysis, collection, examination, reporting C. Examination, collection, analysis, reporting D. Collection, analysis, examination, reporting

10. During a ransomware response, the team debates whether to disconnect a compromised server immediately or keep it online under monitoring to observe the attacker. Which of the following best describes the primary tension in this decision?

    A. Short-term containment versus the value of evidence and understanding gained by long-term monitoring B. The cost of monitoring tools versus the cost of containment C. The best evidence rule versus the order of volatility D. Centralized versus distributed team authority

11. After containing a malware outbreak, the team deletes the malicious files, revokes exposed credentials, patches the exploited vulnerability, and rebuilds affected hosts from known-good images. Which phase of the incident response lifecycle does this work most directly serve?

    A. Preparation B. Detection and analysis C. Eradication D. Post-incident activity

12. An organization holds its lessons learned meeting one week after a significant incident. What is the primary purpose of this meeting?

    A. To assign blame so that responsible staff can be disciplined B. To identify what worked and what did not, in a blame-free setting, and produce improvements to the plan, controls, and training C. To satisfy the regulatory requirement that incidents be publicized D. To determine whether the incident should have been declared at all

13. An organization implements procedures for the identification, collection, acquisition, and preservation of evidence in accordance with legal and regulatory requirements. Which ISO/IEC 27001:2022 Annex A control does this satisfy?

    A. A 5.24, information security incident management planning and preparation B. A 5.25, assessment and decision on information security events C. A 5.26, response to information security incidents D. A 5.28, collection of evidence

14. A controller becomes aware of a personal data breach that is likely to result in a risk to individuals. Under GDPR Article 33, what is the notification requirement to the supervisory authority?

    A. Notification within 72 hours of the breach being fully contained B. Notification without undue delay and, where feasible, not later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to individuals C. Notification only if the breach affects more than 500 data subjects D. Notification within 7 days, or 72 hours if the breach involves credit card data

15. A company anticipates a lawsuit over a data breach and instructs staff to preserve relevant records, but before a legal hold is implemented, an administrator purges mailboxes according to the routine retention schedule. Which concept best describes the organization’s exposure?

    A. The best evidence rule B. Spoliation of evidence subject to a duty to preserve C. A violation of the order of volatility D. Chain of custody failure

16. Under Federal Rules of Evidence Rule 702 and the Daubert standard, courts assess whether expert testimony is reliable. Which of the following is least relevant to that assessment?

    A. Whether the expert’s method has been tested B. The known or potential error rate of the method C. Whether the method has been peer reviewed and published D. The hourly rate the expert charges for testimony

17. A security team learns from a vendor that a newly disclosed vulnerability has public exploit code, before any systems in the organization have been affected. Per NIST SP 800-61 Rev. 2, which of the following best describes this information?

    A. An indicator, because it confirms a compromise is occurring B. A precursor, because it signals that an incident may occur in the future C. An attack vector, because it describes how attackers enter systems D. A containment strategy, because it identifies affected systems

18. An organization is drafting its incident response plan. Which of the following is the least appropriate element to include?

    A. Metrics for measuring the incident response team’s effectiveness B. The services the team provides and the resources available to it C. A statement of senior management approval of the plan’s mission and goals D. The organization’s current quarterly sales forecast

19. An organization creates a single unit that handles incident response for all business units, concentrating specialized expertise in one place. Which incident response team structure does this describe?

    A. Centralized B. Distributed C. Coordinating D. Federated

20. A cardholder data environment implements an incident response plan covering documented roles and responsibilities, response and escalation procedures, business continuity provisions, on-call coverage, monitoring of and response to alerts, and annual training and testing. Which PCI DSS v4.0 requirement does this satisfy?

    A. Requirement 10, audit logging B. Requirement 12.10, incident response planning and response C. Requirement 3, stored cardholder data protection D. Requirement 8, identity and authentication

Answers and rationales

1. A. RFC 3227 directs collection from the most volatile data to the least, and CPU registers and processor cache are the most volatile of all, followed by routing tables, the ARP cache, the process table, kernel statistics, and memory, then temporary file systems, then disk, then remote logging data. Disk (option B), temporary file systems (option C), and remote logs (option D) all come later in the ordering.

2. C. NIST SP 800-61 Rev. 2 defines an incident as a violation or imminent threat of violation of security policies, acceptable use policies, or standard security practices; a scan with no impact violates nothing and threatens nothing, so it remains an event. Contact alone does not make an incident (option A), scans are not automatically intrusions (option B), and events, not only successful intrusions, are observable occurrences worth recording (option D).

3. B. Federal Rules of Evidence Rule 1001 treats any printout or other output readable by sight as an original if it accurately reflects the stored computer data, and Rule 1002 requires the original, which the accurate printout satisfies. The printout is therefore not a barred copy (option A), no hash testimony is required for the best evidence rule (option C), and authenticity and hearsay are separate questions from best evidence (option D).

4. C. Records generated automatically by a system are not statements of a human declarant, so hearsay rules generally do not apply to them. Records stored on a computer but composed by a person, such as email, are statements of that person and are hearsay when offered for their truth, subject to exceptions such as the business records rule. The other options collapse the distinction the rule depends on.

5. B. Rule 803(6) requires that the record be kept in the course of a regularly conducted business activity, made at or near the time by someone with knowledge, as a regular practice of the activity, with nothing indicating untrustworthiness. Creation in anticipation of litigation (option A), attorney review (option C), and corroboration (option D) are not elements of the exception.

6. B. A hardware write blocker permits read-only access to the source medium so that the imaging process cannot alter it, preserving the evidence and supporting the authenticity of the image. It does not cache reads (option A), decrypt drives (option C), or hide the drive from tools (option D).

7. B. Cryptographic hashing verifies integrity: matching hashes between the source and the image, and again before analysis, show the image is a faithful, unmodified copy. Hashing does not establish identity of the creator (option A), does not encrypt (option C), and is not used to identify filesystems (option D).

8. B. RAM is volatile: running processes, open network connections, loaded modules, and frequently decrypted content and malware exist only in memory and are lost when the system loses power. The operating system files survive on disk (option A), powering down does not delete the disk (option C), and the order of volatility places memory before disk, not after (option D).

9. A. NIST SP 800-86 defines the forensic process as collection, examination, analysis, and reporting, in that order. The other sequences either analyze before collecting or reorder the pipeline in ways that make no procedural sense.

10. A. NIST SP 800-61 Rev. 2 frames this as short-term versus long-term containment: disconnecting stops the spread but forfeits the observation and evidence that a monitored long-term state provides. Tool cost (option B) is not the central question, the best evidence rule and order of volatility concern evidence collection (option C), and team structure (option D) is a governance matter, not the tension described.

11. C. Eradication removes the cause of the incident: deleting malware, revoking exposed credentials, patching the vulnerability, and rebuilding hosts from known-good media. Preparation happens before the incident (option A), detection and analysis identifies the incident (option B), and post-incident activity follows recovery (option D).

12. B. The lessons learned meeting captures what worked and what did not so the plan, controls, training, and monitoring improve, and NIST SP 800-61 Rev. 2 treats it as a blame-free process. Blame and discipline (option A) defeat the purpose, no regulation requires publicity at this stage (option C), and the meeting presumes the incident occurred (option D).

13. D. A 5.28, collection of evidence, requires procedures for identifying, collecting, acquiring, and preserving evidence in accordance with legal and regulatory requirements. A 5.24 covers planning and preparation (option A), A 5.25 covers assessment of events (option B), and A 5.26 covers response (option C).

14. B. GDPR Article 33 requires notification without undue delay and, where feasible, no later than 72 hours after the controller becomes aware, unless the breach is unlikely to result in a risk to individuals. The clock runs from awareness, not containment (option A), there is no minimum-volume trigger (option C), and the 72-hour window is not limited to card data (option D).

15. B. Once litigation is reasonably anticipated, the duty to preserve attaches, and destruction of relevant evidence despite that duty is spoliation, which risks sanctions and adverse inference instructions. The best evidence rule concerns originals (option A), the order of volatility concerns collection sequencing (option C), and a chain of custody failure concerns handling of collected evidence (option D).

16. D. Daubert reliability factors include whether the method has been tested, its known or potential error rate, peer review and publication, the existence of standards, and general acceptance. The expert’s billing rate is not a reliability factor.

17. B. NIST SP 800-61 Rev. 2 defines a precursor as a sign that an incident may occur in the future; a vulnerability disclosure with public exploit code before any impact is a warning of what may come. An indicator signals that an incident may have occurred or is occurring (option A), attack vectors describe entry methods (option C), and containment strategies are response actions (option D).

18. D. NIST SP 800-61 Rev. 2 lists plan elements such as the mission, strategies and goals, senior management approval, metrics, team structure and staffing, services, and resources. A quarterly sales forecast is business planning, not incident response planning.

19. A. A centralized team handles incidents for the whole organization from one unit, concentrating expertise in a single place. A distributed team embeds responders in business units (option B), a coordinating team facilitates the work of other teams rather than performing it (option C), and federated is not one of the three structures NIST SP 800-61 Rev. 2 describes (option D).

20. B. PCI DSS v4.0 Requirement 12.10 requires incident response planning and response: documented roles and responsibilities, response and escalation procedures, business continuity, on-call coverage, monitoring of and response to alerts from implemented technologies, and training, with the plan reviewed and tested at least annually. Requirement 10 is audit logging (option A), Requirement 3 is stored data protection (option C), and Requirement 8 is identity and authentication (option D).

Incident response and investigation on one page

Hold two truths at once and the domain answers itself. The incident ends operationally when systems are restored, and it ends evidentially when the record survives scrutiny, so every action in the response is also an act of evidence collection. The lifecycle of NIST SP 800-61 Rev. 2 gives the order: preparation makes everything else possible; detection and analysis separates indicators from precursors and events from incidents; containment trades speed against evidence through the short-term versus long-term choice; eradication removes the cause; recovery returns under monitoring; and post-incident activity, the lessons learned meeting and the metrics, feeds the whole loop forward.

Evidence is governed by a small set of rules the exam loves. NIST SP 800-86 wants evidence that is authentic, reliable, complete, and believable. The best evidence rule, Rules 1001 and 1002, makes an accurate printout of computer data an original. Hearsay turns on who wrote the record: computer-generated logs are not human statements, while computer-stored human content needs the business records exception of Rule 803(6). Rule 702 and Daubert gate the experts, the chain of custody keeps possession honest, and legal hold plus the spoliation rule make deletion during litigation a self-inflicted wound.

Forensics runs on the order of volatility from RFC 3227: registers and cache, then routing tables and memory, then temporary file systems, then disk, then remote logs, then configuration and archival media. Capture memory before you power down. Image disk through a write blocker, hash with SHA-256, and let the hash stand for the integrity of the copy. Collect, examine, analyze, report, and document everything, because the timeline, the clocks, the time zones, and the gaps left by anti-forensics are all part of the story.

The controls are the skeleton: ISO/IEC 27001:2022 Annex A 5.24 through 5.28 for the complete incident loop, with 5.28 as the evidence anchor; PCI DSS v4.0 Requirement 12.10 for the card industry checklist; and GDPR Articles 33 and 34 for the 72-hour notification duty and the data subject notice that wake up the moment an incident involves personal data. The one habit to carry forward: treat every incident as if its story will be examined by someone who was not there, and respond the way that story deserves.