Response
Taking action on a confirmed incident — investigate, contain, eradicate, recover, learn.
Incident response is the disciplined sequence that follows a confirmed incident. The SY0-701 process runs Preparation → Detection → Analysis → Containment → Eradication → Recovery → Lessons learned (rooted in the classic NIST SP 800-61 lifecycle, which NIST restructured around CSF 2.0 in 2025’s Revision 3), and the loop’s value is as much in preparation and lessons learned as in the live firefight. Tabletop exercises rehearse the plan so roles, comms, and decisions are practiced before a real incident tests them.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →