CompTIA · CySA+ CS0-004
The incident response process
CySA+ CS0-004 · Lesson 18 of 22 · 2:36:40
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: the seven phases from preparation to post-incident activity, the NIST SP 800-61 revision 3 view with the CSF 2.0 functions, incident response and communication plans, playbooks, roles, and tabletop and simulation exercises. Includes three original practice questions.
Preview the topics
- The SOC has cut the teller laptop off the network and blocked the command server’s domain at the firewall, but the loader is still on the laptop. Which phase is the team in right now?
- The SOC wants step-by-step instructions for handling a reported phishing email, including the checks to run, and who approves deleting the message from every mailbox. What should it write?
- Tidewell’s managers want to check, in a two-hour session and without touching any system, whether everyone knows their role during a ransomware attack. Which exercise fits best?