Chapter 3 of 4 · CompTIA CySA+ CS0-004

Incident Response and Management

Attack frameworks, response phases, triage and escalation, evidence handling and root cause analysis.

  • 6topics
  • 30 minfast track
  • 4diagrams and exhibits
  • 24%of the exam
Start with MITRE ATT&CK Framework

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1MITRE ATT&CK FrameworkUnderstand MITRE ATT&CK tactics, techniques and sub-techniques, how analysts map evidence to technique IDs, and how the matrix…5 min
  2. 2Kill Chain and Diamond ModelCompare the Cyber Kill Chain stages and the Diamond Model of Intrusion Analysis with MITRE ATT&CK, and learn when an analyst uses…Diagram5 min
  3. 3The Incident Response ProcessThe incident response phases for CySA+: preparation, detection, analysis, containment, eradication, recovery and lessons learned…Diagram5 min
  4. 4Triage and EscalationHow CySA+ analysts triage alerts, judge severity from impact and urgency, scope an incident and escalate to the right people with…5 min
  5. 5Evidence Handling and ForensicsPreserve digital evidence for CySA+: order of volatility, chain of custody, forensic imaging with hashes, write blockers and…Diagram5 min
  6. 6Remediation and Root Cause AnalysisAfter an incident, remove the attacker, close the gap and find the root cause with timelines, five whys and fishbone diagrams…5 min

About this chapter

What this chapter covers

Incident response is how an organisation reacts when an attack succeeds, or may have succeeded. The aim is to limit harm, restore service, and learn enough to make the next attack harder.

The chapter begins with the models analysts use to describe attacks, then covers the response process from preparation to recovery. It then looks at the practical techniques inside that process: triage, escalation, evidence handling, remediation and finding the root cause.

The Cybersecurity Analyst (CySA+) CS0-004 exam expects you to choose the right action at the right phase, and to explain why.

How the topics fit together

The frameworks give a language for describing the attack, and the process gives the steps for handling it.

Frameworksdescribe the attackProcessphases from preparation to recoveryTriage and escalationdecide and notifyEvidencepreserve and documentRemediationfix and learn
  • MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) catalogues attacker behaviours in detail.
  • The Cyber Kill Chain and Diamond Model give a stage view and a relationship view of an intrusion.
  • The response process orders the work into phases so nothing is skipped.
  • Triage and escalation decide how serious an incident is and who must act.
  • Evidence handling keeps data trustworthy while the team contains the problem.
  • Remediation and root cause analysis remove the attacker and close the gap that allowed the attack.
Exam tip

Scenario questions often ask for the next step. Locate the incident phase first, then pick the action that belongs to that phase.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with diagrams, tables and examples.
  • What to remember for the exam: the facts to memorise.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Learn the order of the phases and the order of the kill chain stages, since ordering questions are common.

Ready for more practice?

The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.