Security Incident and Breach Response Questions
Responding to security incidents and data breaches: containment, breach-response protocols, coordinating with security and legal, and post-breach analysis. Covers security-specific incident handling including cryptographic monitoring and lessons learned from security incidents. The security-operations overlap of incident response, distinct from general reliability incidents.
During a live exercise a penetration tester's activity accidentally triggers the client's incident response process. Describe pre-engagement and runbook steps you would implement to avoid confusing IR teams and to preserve evidence for both the engagement and any real incidents. Include out-of-band communication channels, unique markers to identify test traffic, and escalation processes.
That is every published Security Incident and Breach Response question for Penetration Tester so far. Browse the other topics in this category, or practice this one interactively.