Incident Response & Forensics Flashcards
(7 cards)
1
Q
What are the steps in the incident response lifecycle?
A
Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
2
Q
What is chain of custody in forensics?
A
A documented history of evidence handling
3
Q
What is the difference between RTO and RPO?
A
RTO: time to restore, RPO: max data loss time
4
Q
What is the first step of the incident response lifecycle?
A
Preparation
5
Q
Why is maintaining chain of custody important in digital forensics?
A
To ensure evidence integrity in court
6
Q
What metric defines how long a business can tolerate a system outage?
A
RTO (Recovery Time Objective)
7
Q
What should be done after eradicating a threat from a system?
A
Validate system integrity and monitor
