Incident Response & Management
71 practice questions with explanations — 15 free to try
3 of these 71 questions are in the free 15-question taster · the full topic is part of Premium
PassNova has 71 CompTIA CySA+ practice questions on Incident Response & Management, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Incident Response & Management: example questions & answers
3 worked examples with answers and explanations below. Try 15 CompTIA CySA+ questions free in the browser; the full 71-question Incident Response & Management bank is part of PassNova Premium.
Which sequence matches the incident response process in the CySA+ V4 objectives?
- APreparation, detection, analysis, containment, eradication, recovery, post-incident✓
- BDetection, preparation, containment, analysis, recovery, eradication, post-incident
- CPreparation, containment, detection, analysis, eradication, recovery, post-incident
- DPreparation, detection, analysis, eradication, containment, recovery, post-incident
Answer: CySA+ V4 lists preparation, detection, analysis, containment, eradication, recovery and post-incident activity. The older NIST SP 800-61 Rev. 2 grouped these into four phases, but that publication was superseded by Rev. 3 in April 2025, which aligns incident response with the NIST CSF 2.0 functions instead.
During an active intrusion, the immediate priority after confirming a compromise is to limit the spread and prevent further damage. Which incident response phase is this?
- ALessons learned
- BPreparation
- CRecovery
- DContainment✓
Answer: Containment focuses on isolating affected systems to stop the attacker from spreading or causing further harm before eradication and recovery.
When collecting digital evidence, an analyst documents every person who handled it and when, to ensure it is admissible. This documentation is called the:
- AService level agreement
- BAcceptable use policy
- CBusiness impact analysis
- DChain of custody✓
Answer: Chain of custody records the seizure, transfer, and handling of evidence over time to preserve its integrity and legal admissibility.