Chapter 7 of 8 · EC-Council 312-38
Incident Response
First response, handling process, SOAR, EDR, XDR, forensics, BC/DR and crisis management, worth 10%.
- 4topics
- 18 minfast track
- 10%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Incident Response, First Response and the Handling ProcessLearn the incident response concept, the first responder role, first response do's and don'ts and the incident handling process…5 min
- 2Automating Response with SOAR, EDR, MDR and XDRLearn what SOAR, EDR, MDR and XDR do, how they differ, and how a defender chooses and uses them to speed up detection and…4 min
- 3Forensics Investigation and Business Continuity BasicsLearn the forensics investigation process, evidence handling and business continuity and disaster recovery basics, with BIA, RTO…5 min
- 4BCP, DRP, BC/DR Standards and Crisis ManagementLearn how a business continuity plan differs from a disaster recovery plan, key BC/DR standards such as ISO 22301 and NIST SP…4 min
About this chapter
What this chapter covers
Incident Response is 10% of the EC-Council CND 312-38 exam. It covers the incident response concept, the first responder, the handling process, automation and detection tools (SOAR, EDR, MDR, XDR), forensics, and business continuity, disaster recovery and crisis management.
Questions are single-answer multiple choice, often "Which of the following" and short named scenarios. You are asked to choose the right action or tool at each stage of a response.
It has 14 outline topics, and four pages cover them.
How the topics fit together
The chapter follows an incident from the first alert to full recovery.
- First response and handling set the order of actions and what to avoid.
- Tool pages show what automates and extends the team.
- Forensics and BC/DR pages cover evidence, recovery objectives, plans, standards and crisis management.
When two answers both seem right, pick the one that preserves evidence and follows the plan first. Containment, then eradication, then recovery is the safe order.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Try to name the next step for each short scenario before reading the answer. The exam often asks what to do first, or which tool fits.
Ready for more practice?
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.