Free Incident Response practice questions
10 free SY0-801 questions on Incident Response, each with a full explanation — no account needed. This section sits in the Security Operations part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
In the incident response order used on the SY0-801 exam, which phase comes immediately after identification?
The order is preparation, identification, investigation, containment, negotiation, eradication and recovery, notification and external reporting, and post-incident. Containment is the tempting answer because the two overlap in practice, but you can't contain what you haven't found, so investigation comes first in the exam's order.
During a tabletop exercise, the team realizes its response plan assumes email and chat will work during an incident, but both depend on the same domain an attacker might control. What should the plan add?
Email and chat may be compromised or down during an incident, so preparation includes an out-of-band communication channel, such as a phone bridge or a separate messaging service. A jump bag, a phishing playbook and longer retention are all useful preparation, but none of them gives the team a way to talk that the attacker can't see.
A company's incident response plan assumes the file server can be fully restored from backup within 24 hours, but nobody has ever restored it. Which preparation activity BEST verifies the assumption?
Testing checks that the procedures and tools the plan depends on actually work, and only a real, timed restore shows how long recovery takes. A tabletop is tempting because it can reveal that nobody knows the restore time, but discussion can't measure it; training builds skills rather than proof, and writing the target down doesn't test it.
A responder keeps a pre-packed kit with a forensic laptop, write blockers, clean USB media, evidence bags and chain-of-custody forms, ready to grab when an incident is declared. What is this kit commonly called?
A jump bag is the responder toolkit prepared in advance so nobody hunts for equipment during an incident. A playbook and a runbook are documented procedures rather than equipment, and a cyber range is an environment for hands-on simulations.
A SOC manager wants to measure how long her analysts actually take to isolate hosts and capture memory when facing realistic attack techniques, using their real tools. Which exercise BEST fits?
A simulation is hands-on: responders use their real tools against a realistic, controlled attack, which shows whether they can perform the steps and how long they take. A tabletop tests decisions and communication through discussion and can't time technical work, and contact-list tests and lessons-learned reviews check other things.
An industry ISAC warns that a ransomware group is targeting companies like yours, and the VPN logs show a burst of password guessing against several accounts. No successful logon or other compromise has been found. How should these signals be classified?
A precursor suggests an incident may happen, such as an advisory about a group targeting your sector or a burst of password guessing, and it gives you a chance to act before damage is done. An indicator suggests an incident has happened or is happening, and nothing here shows a compromise; the activity is real, so it isn't a false positive either.
A firewall blocks a single inbound connection attempt from an unknown address. On its own, what is this in incident response terms?
An event is any observable occurrence, such as a login, a file change or a blocked connection. An incident is an event or series of events that actually threatens or violates security policy or the confidentiality, integrity or availability of systems and data, and one blocked attempt shows neither that nor a compromise.
A threat hunt finds an account, created with no IT ticket, that has signed in to the VPN at 1 a.m. from a hosting provider for two weeks. Besides responding to the intrusion, what should the hunt team do so the next occurrence raises an alert automatically?
A successful hunt should become a new detection rule, so the behavior it found raises an alert automatically the next time. Repeating the hunt next quarter still waits for a person, an exception would hide the activity, and recording the result is good practice but doesn't create an alert.
A regional hospital wants to receive threat information shared among health-care organizations about attacks on its sector. Which source is designed for this?
ISACs share threat information within one industry, and health care has its own. A vendor advisory covers that vendor's products, an internal advisory comes from inside the organization, and a vulnerability scanner finds weaknesses rather than sharing intelligence among peers.
Which activity belongs to the investigation phase rather than the identification phase?
Identification confirms the alert is real, rates its severity and starts the timeline; working out how the attacker got in, with forensic tools and evidence handling, is investigation, which comes next. Ruling out a false positive, assigning severity and starting the record are all triage work in identification.
Study this section
Every lesson that covers Incident Response on the SY0-801 exam.