Question
Why is recovery tied to RTO and RPO?
Tap to flip
Answer
Recovery must restore operations within required time and data-loss limits.
Tap to flip back
Question
What is the goal of containment in incident response?
Tap to flip
Answer
Limit spread by isolating or quarantining affected systems.
Tap to flip back
Question
Why must evidence be preserved before wiping infected systems?
Tap to flip
Answer
Forensics, legal defense, and investigation depend on it.
Tap to flip back
Question
What is the purpose of indicators of compromise in incident response?
Tap to flip
Answer
They help confirm and identify malicious activity.
Tap to flip back