Question
Why are MTTD and MTTR important incident-response metrics?
Tap to flip
Answer
They measure how quickly incidents are found and resolved.
Tap to flip back
Question
What is the purpose of indicators of compromise in incident response?
Tap to flip
Answer
They help confirm and identify malicious activity.
Tap to flip back
Question
How does eradication differ from containment?
Tap to flip
Answer
Eradication removes the cause; containment only limits spread.
Tap to flip back
Question
What is an incident response plan, or IRP, meant to do?
Tap to flip
Answer
Detect, respond to, and recover from incidents while minimizing damage and downtime.
Tap to flip back