Incident management

Question 1

Explain the key steps of an effective incident response process

Answer 1

detection, identification, containment, eradication, recovery, and lessons learned

Question 2

Describe how you would approach a post-incident review (PIR)

Answer 2

• understand the incident’s scope, impact, and contributing factors
• use the “Five Whys” technique to delve into deeper causes and identify systemic issues

Question 3

How would you define severity levels and response times

Answer 3

• levels should be defined based on the impact an incident has on users, revenue, reputation, etc.
• common levels: critical, high, medium, low
• response times should correspond to severity

Question 4

What roles are outlined in the “Incident Command System” (ICS)?

Answer 4

Incident Commander, Communication Liaison, and Technical Experts