Incident Response Theory: Ep.6 – Quiz

In the lessons learned meeting, you must conclude how well _________ performed when dealing with the incident.

A metric for incident data could be the incident response _________ .

In the lessons learned meeting, you must conclude what _________ or indicators should be watched for in the future to detect similar incidents.

The General Records Schedule (GRS) 24 specifies that incident handling records should be kept for _____ years.

A metric for incident data could be the number of  ________ .

In the lessons learned meeting, you must conclude whether any steps or actions taken might have __________ the recovery.

Storing evidential hardware for an extended period can be quite _________ .

A metric for incident data could be the _______ per incident.

A metric for incident data could be the _________ assessment of each incident.

 Should an attacker be ___________ , relevant evidence must be retained until all legal actions are completed.