CompTIA Security+ Education & Occupational Skills Learning Path • Module 6

Incident Evidence and Response

Apply recording, containing, escalating, and learning from security incidents through approved procedures, objective verification, documentation, and escalation.

22 minutes80% mastery targetPractice—unlimited attempts

Enter your participant information to start activity tracking.

Learning outcomes

Explain the purpose of recording, containing, escalating, and learning from security incidents.
Apply approved procedures to a realistic CompTIA Security+ situation.
Verify results, document objective evidence, and escalate conditions outside authorized scope.

Apply the approved workflow

Follow the response plan and maintain accurate incident chronology. Preserve evidence integrity and chain of custody when required. Reliable performance begins with correct identification, current instructions, safe conditions, and a clear understanding of authority.

Key points

Follow the response plan and maintain accurate incident chronology.
Preserve evidence integrity and chain of custody when required.
Confirm scope and prerequisites before acting.

Verify, document, and communicate

Use post-incident review to improve controls, procedures, and training. A task is not complete until the result is checked against the expected outcome and the record allows another authorized person to understand what occurred.

Key points

Use post-incident review to improve controls, procedures, and training.
Record objective facts, actions, results, and unresolved risks.
Escalate exceptions promptly through the authorized channel.

Applied scenario

Incident Evidence and Response: verify before proceeding

During a security operations task involving a protected organizational asset, a CompTIA Security+ practitioner is completing the Incident Evidence and Response module scenario. An identifier, instruction, measurement, or expected result does not agree with the available record. The task has a deadline, but proceeding without resolving the conflict could create safety, privacy, quality, compliance, or service risk. Decide how the task should continue and what evidence must be recorded.

Practice check

Apply what you learned

Answer all five questions. Feedback will identify what to review before you try again.

1Which action best supports recording, containing, escalating, and learning from security incidents? Open a suspicious link to determine whether the message is malicious Delete logs and files before the incident record and evidence are preserved Follow the response plan and maintain accurate incident chronology. Share an encryption key through the same channel as the protected data

2Within Incident Evidence and Response, what should happen before the participant proceeds? Accept a vulnerability without recording the owner, rationale, or residual risk Restore service before confirming containment and required security validation Use one preventive control as a substitute for layered protection and monitoring Preserve evidence integrity and chain of custody when required.

3For recording, containing, escalating, and learning from security incidents, which closeout action provides the strongest evidence of reliable performance? Use post-incident review to improve controls, procedures, and training. Forward harmful content widely so coworkers can recognize it Keep privileged access after the role or business need has ended Change incident timestamps to make the response sequence appear complete

4During Incident Evidence and Response, what is the best response when the result conflicts with expectations? Collect and retain sensitive data that is not needed for an authorized purpose Pause the task involving Incident Evidence and Response, reconcile the evidence and requirements, and obtain authorized guidance before proceeding Treat a control as effective without testing or monitoring its operation Grant broad permanent access because the immediate request appears legitimate

5After work involving recording, containing, escalating, and learning from security incidents, what should the complete task record communicate? Open a suspicious link to determine whether the message is malicious Delete logs and files before the incident record and evidence are preserved Record the facts for Incident Evidence and Response, authorized actions, verification results, unresolved risks, and next responsible owner Share an encryption key through the same channel as the protected data

Reflection and workplace transferDescribe how you would apply verification and documentation during a CompTIA Security+ task involving recording, containing, escalating, and learning from security incidents.

← Return to CompTIA Security+ Education & Occupational Skills Learning Path