Certified Incident Handler (CIH) Practice Ecam

What is the correct sequence of stages in incident response?

1. Preparation - Containment - Identification - Recovery - Follow-up

2. Preparation - Identification - Containment - Eradication - Recovery - Follow-up

3. Containment - Preparation - Identification - Follow-up - Recovery

4. Eradication - Recovery - Containment - Identification - Preparation

The correct answer is: Preparation - Identification - Containment - Eradication - Recovery - Follow-up

The correct sequence of stages in incident response is crucial for effectively managing and mitigating incidents. The sequence typically follows a structured approach that ensures all aspects of an incident are addressed appropriately. Preparation is the foundational stage where organizations develop and train incident response teams, create policies, and establish communication plans. This proactive measure sets the groundwork necessary for efficiently handling incidents when they occur. Identification is the next step, which involves recognizing and confirming that a security incident has occurred. Effective identification is critical because it enables response teams to understand the nature of the threat they are facing. Following identification, the containment phase is executed. This stage aims to limit the damage of the incident and prevent further impact, ensuring that the situation does not escalate and that regular operations can resume as quickly as possible. Eradication is the subsequent phase that focuses on eliminating the cause of the incident. This could involve removing malware, closing vulnerabilities, or taking affected systems offline for cleanup. Once the threat is eradicated, organizations proceed to the recovery stage, where they restore and validate system functionality for normal operation. This phase may also include monitoring systems for any signs of weaknesses or ongoing issues. Finally, the follow-up stage serves to review the incident response process, analyze the response efforts, and improve strategies