CompTIA · Security+ SY0-801
Incident response
Security+ SY0-801 · Lesson 25 of 32 · 3:50:37
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the Security+ SY0-801 exam (CompTIA Security+ V8). In this lesson: preparation (training, tabletop exercises, and playbooks), identification and investigation (digital forensics, chain of custody, and e-discovery), containment, eradication, and recovery, ransomware negotiation, mandatory notification, and post-incident work like lessons learned and root cause analysis. Includes three original practice questions.
Preview the topics
- A drive from a compromised server may be used in court, and the team must show every person who handled it, when, and why. What must the team keep?
- After an incident, the team wants to know why the attacker could get in at all, not only what the attacker did, and it finds an exposed administrator interface with an unpatched flaw. Which activity is this?
- Ransomware is spreading from one server to others at the warehouse, right now. What should the responders do first?