IR Phases and Roles

Why Incident Response Is on the Exam

Incident response (IR) is the organized process for handling events that may affect the confidentiality, integrity, or availability of data and systems. On the CompTIA Security+ (SY0-701) exam, IR sits in Domain 4.0 (Security Operations), which is the single largest objective area at 28% of the exam. SY0-701 is up to 90 questions in 90 minutes with a passing score of 750 on a 100-900 scale, and it mixes multiple-choice items with performance-based questions (PBQs) that often ask you to order IR phases or pick the next action. The goal of IR is never just to delete malware.

It is to limit harm, preserve evidence, restore trusted operations, communicate correctly, and improve the environment afterward.

The NIST SP 800-61 Lifecycle

Security+ aligns its IR coverage to NIST Special Publication 800-61 (Computer Security Incident Handling Guide). NIST defines four phases; CompTIA frequently expands the middle phase into separate steps you can be asked to sequence.

Note the lifecycle is a loop, not a line: lessons learned feed straight back into preparation. The exam rewards answers that treat IR as continuous improvement rather than a one-time cleanup.

Preparation Is the Most Tested Phase

Preparation is where most real-world IR success or failure is decided, and Security+ leans on it heavily because everything else depends on it. A scenario that asks what the organization should have done before the incident is almost always pointing at a preparation gap.

Concrete preparation deliverables include a written incident response plan (IRP) approved by management; playbooks (or runbooks) that give step-by-step procedures for common scenarios such as phishing, ransomware, and account compromise; a verified contact and escalation tree with after-hours numbers; defined severity tiers so responders know when to escalate; centralized logging in a SIEM with sufficient retention; pre-staged tooling such as EDR, forensic imaging kits, and write blockers; and prearranged chain-of-custody forms and evidence storage.

Preparation also means training: tabletop exercises and simulations build the muscle memory that lets a team move fast under pressure. A common exam distractor is buying a tool after the incident starts; the right preparation answer is that the capability should already exist and be tested.

Event vs. Alert vs. Incident

These three terms are tested precisely. An event is any observable occurrence in a system or network: a login, a file write, a firewall connection. An alert is a notification that an event may need attention, raised by tools such as EDR or SIEM. An incident is a confirmed or strongly suspected violation of security policy that requires a coordinated response.

• Millions of events occur daily; most are benign.
• A subset trigger alerts; many are false positives.
• Only validated, harmful activity becomes a declared incident.

The declaration is the pivot. Once activity is treated as an incident, the team opens an incident record, assigns roles, preserves evidence, and tracks every decision with a timestamp.

Worked Triage Example

08:12 alert    EDR reports base64-encoded PowerShell on LAP-118
08:18 analysis Word (winword.exe) spawned PowerShell after invoice.docm opened
08:26 evidence DNS query to a domain registered 2 days ago
08:33 declare  Incident opened: suspected phishing payload with C2 traffic

Notice the team did not declare an incident at 08:12 on a single alert. It correlated parent-child process behavior and a suspicious newly registered domain first. That validation step is what separates an alert from a confirmed incident.

Common IR Roles

Scenario Timeline

A school district receives reports that staff cannot open shared lesson files; the help desk sees an unfamiliar file extension. Security opens an incident record.

Common Traps

• Beginning eradication before preserving the evidence needed to scope the incident.
• Having no incident commander, so multiple teams take conflicting actions.
• Treating every alert as an incident with no triage.
• Waiting for perfect certainty while active damage continues.
• Letting business owners make technical evidence decisions, or letting security isolate critical systems without consulting operational owners.

Exam Focus

Watch for keywords: playbook, runbook, escalation, containment, eradication, recovery, lessons learned, incident commander. The best answer almost always matches the phase the scenario implies. If the attacker is still active, containment is the priority. If systems are verified clean and service is being returned, recovery and validation lead.