CompTIA SY0-701: Incident Response, Forensics & Assessment — Study Guide
Part of the CompTIA Security+ SY0-701 — Complete Study Guide. Practice with verified answers in the CompTIA exam hub, or take timed practice tests on ExamRoll.io.
Security incidents are inevitable. The discipline of incident response converts a chaotic, damaging event into a structured, documented process that limits harm, preserves evidence, restores operations, and produces durable improvements. Forensics provides the investigative methodology that makes root-cause analysis possible and legal proceedings defensible. Vulnerability management closes the loop by systematically finding and remediating the weaknesses that incidents exploit.
Vulnerability Scanning and CVSS Prioritization
Vulnerability scanners such as Nessus, Qualys, and Rapid7 InsightVM enumerate hosts, probe services, and match findings against CVE databases to produce a prioritized list of weaknesses. Authenticated scans — where the scanner logs into the target with valid credentials — produce far more complete results than unauthenticated scans, which can only assess externally visible services. A common failure is running only unauthenticated scans and concluding that a system is “clean” when the scanner simply could not see inside.
Prioritization is anchored by the Common Vulnerability Scoring System (CVSS), currently at version 3.1/4.0. CVSS produces a 0.0–10.0 score derived from Base metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, and the CIA impact triad), optionally refined with Temporal and Environmental metrics. A CVSS 9.8 vulnerability with network attack vector and no authentication (for example, CVE-2021-44228 Log4Shell) warrants emergency patching, while a locally exploitable 5.4 issue on an isolated management host may wait. Sophisticated programs supplement CVSS with EPSS (Exploit Prediction Scoring System) and CISA’s Known Exploited Vulnerabilities (KEV) catalog to weight real-world exploitation likelihood alongside theoretical severity.
Penetration Testing and Rules of Engagement
Penetration testing goes beyond scanning by actively exploiting weaknesses to demonstrate impact. Engagements are categorized as black-box (no prior knowledge), white-box (full documentation and source access), or gray-box (partial knowledge, often simulating an insider or compromised user). Static application security testing (SAST) analyzes source code without executing it, catching flaws like SQL injection sinks and unsafe deserialization patterns, while dynamic application security testing (DAST) exercises the running application to identify runtime issues such as authentication bypasses and session handling flaws. Neither approach alone is sufficient — SAST misses runtime and environmental issues, DAST misses code paths it does not traverse.
The Rules of Engagement (RoE) document is a binding artifact defining scope (IP ranges, domains, applications), permitted techniques, testing windows, emergency contacts, handling of discovered sensitive data, and legal authorization. Without a signed RoE and statement of work, testing activity is legally indistinguishable from criminal intrusion. RoE typically prohibit destructive actions, DoS testing on production, and social engineering unless explicitly authorized.
Incident Response Lifecycle
The NIST SP 800-61 lifecycle provides the canonical structure:
Preparation establishes the capability before any incident: building the CSIRT, defining roles and responsibilities, deploying detection tooling (SIEM, EDR, NDR), maintaining runbooks, stocking jump kits with write blockers and imaging drives, and conducting tabletop exercises. Reviewing roles and responsibilities is a preparation activity, not something invented mid-crisis.
Identification (detection and analysis) confirms that an event is actually an incident. Analysts triage alerts, correlate indicators, determine scope, and classify severity. Precision here prevents both alert fatigue and premature escalation.
Containment limits damage. Short-term containment might isolate a host by disabling its switch port or applying an EDR network quarantine; long-term containment could involve rebuilding affected segments while the investigation proceeds. Containment decisions balance evidence preservation against ongoing harm — pulling the power cable destroys volatile memory but stops active exfiltration.
Eradication removes the adversary and root cause: deleting malware, disabling compromised accounts, patching exploited vulnerabilities, and rotating credentials and keys that may have been exposed.
Recovery restores systems to production, validating integrity, monitoring for recurrence, and phasing services back online. Recovery is not complete until confidence is established that the threat cannot immediately return via the same vector.
Lessons Learned produces the post-incident report, updated runbooks, and control improvements. This phase is where organizations convert incidents into durable capability — skipping it guarantees the same incident recurs.
Digital Forensics: Preservation, Acquisition, and Analysis
Forensic soundness rests on the principle that evidence must be collected in a manner that preserves its integrity and admissibility. Preservation begins the moment an incident is suspected: freezing logs, suspending automated cleanup, and issuing legal holds to custodians. Acquisition is the stage where forensic images are actually obtained, typically as bit-for-bit copies of storage media using tools like dd, FTK Imager, or EnCase, along with memory captures using tools like WinPmem or LiME. Every acquisition must be accompanied by a cryptographic hash (SHA-256) computed immediately after imaging:
# Create forensic image and compute hash simultaneously
dd if=/dev/sda bs=4M | tee disk.img | sha256sum > disk.img.sha256
# Verify integrity after transfer
sha256sum -c disk.img.sha256
Chain of custody documentation records every person who handled evidence, when, and why. Gaps in chain of custody can render evidence inadmissible in legal proceedings and undermine civil litigation. The order of volatility governs acquisition sequence: CPU registers and cache first, then RAM, then swap, then disk — because more volatile data is lost first when power is removed.
Analysis examines artifacts: browser history, prefetch files, registry hives (particularly NTUSER.DAT, SYSTEM, and SOFTWARE), event logs, $MFT entries, and network captures. Timeline analysis correlates events across sources to reconstruct attacker activity. Tools like Autopsy, Volatility (for memory), and Wireshark (for network captures) are standard in the forensic toolkit.
Practical Scenario: Forensic Investigation of an Insider Threat
A pharmaceutical company’s DLP system flagged an unusual volume of file transfers to a personal cloud storage account from a senior researcher’s workstation on the day before her resignation. The security team preserved the workstation image before it was reimaged, capturing both disk and memory. Forensic analysis of the $MFT revealed that 14,200 files had been accessed in a 90-minute window — a pattern inconsistent with normal work. Browser history showed authentication to a personal Dropbox account. Registry analysis of the USBSTOR key revealed that a USB drive had been connected three days earlier, with a serial number not registered in the corporate asset inventory. The memory image contained fragments of a file listing consistent with the exfiltrated directory. This evidence package — disk image with verified hash, chain of custody documentation, and corroborating memory artifacts — was sufficient to support civil litigation and a referral to law enforcement.
← Security Operations · All domains · Application →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →