Lesson 3: Investigation, Containment, and Response Actions

Review a realistic scenario involving incident timelines, entity relationships, and evidence review.
Create or validate a configuration plan covering endpoint isolation and network containment and file blocking, deletion, and remediation actions.
Use logs, reports, or test results to confirm response verification and business-impact control.

Explain the purpose and operational impact of incident timelines, entity relationships, and evidence review.
Apply practical controls for endpoint isolation and network containment and file blocking, deletion, and remediation actions.
Validate and troubleshoot response verification and business-impact control using an evidence-based workflow.

Lesson Overview