IR Phases and Roles

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

IR Phases and Roles

Key Takeaways Explain This Topic AI

SY0-701 objective 4.8 lists the incident response process as Preparation, Detection, Analysis, Containment, Eradication, Recovery, and Lessons learned.

Preparation builds playbooks, contact trees, logging, tooling, access, training, and chain-of-custody procedures before any incident.

Triage separates an event (any observable) from an alert (a notification) from an incident (a confirmed or strongly suspected violation needing coordinated response).

Roles must be assigned before an incident: incident commander, analysts, forensic lead, system owner, comms, legal, HR, and executive sponsor.

On the exam, the phase implied by the scenario drives the correct answer: active attacker means contain first; clean systems being returned means recover and validate.

Last updated: October 2026

Why Incident Response Is on the Exam

Incident response (IR) is the organized process for handling events that may affect the confidentiality, integrity, or availability of data and systems. On the CompTIA Security+ (SY0-701) exam, IR sits in Domain 4.0 (Security Operations), which is the single largest objective area at 28% of the exam. SY0-701 is up to 90 questions in 90 minutes with a passing score of 750 on a 100-900 scale, and it mixes multiple-choice items with performance-based questions (PBQs) that often ask you to order IR phases or pick the next action. The goal of IR is never just to delete malware.

It is to limit harm, preserve evidence, restore trusted operations, communicate correctly, and improve the environment afterward.

The SY0-701 Incident Response Process

SY0-701 objective 4.8 lists seven process steps: preparation, detection, analysis, containment, eradication, recovery, and lessons learned . Many textbooks group the same work into the four phases of NIST SP 800-61 Rev. 2 ( Computer Security Incident Handling Guide , August 2012). NIST superseded Rev. 2 in April 2025 with SP 800-61r3, which builds its incident response model on the CSF 2.0 Functions, so treat the four-phase grouping below as background and the CompTIA list as the one you sequence on the exam.

• NIST SP 800-61r2 phase (2012, superseded) SY0-701 steps Core work
• Preparation Preparation Build playbooks, train staff, verify contacts, deploy logging, define severity tiers
• Detection and Analysis Detection, Analysis Validate indicators, scope affected assets, open an incident record

Containment, Eradication, and Recovery Containment, Eradication, Recovery Isolate, remove the cause, restore from trusted sources

Post-Incident Activity Lessons learned Review the timeline, assign corrective actions, update controls

If you will sit SY0-801 (Security+ V8) , expected on or around November 17, 2026, learn its objective 4.7 list instead: preparation, identification, investigation, containment, negotiation, eradication/recovery, notification/external reporting, and post-incident.

Note the lifecycle is a loop , not a line: lessons learned feed straight back into preparation. The exam rewards answers that treat IR as continuous improvement rather than a one-time cleanup.

Preparation Is the Most Tested Phase

Preparation is where most real-world IR success or failure is decided, and Security+ leans on it heavily because everything else depends on it. A scenario that asks what the organization should have done before the incident is almost always pointing at a preparation gap.

Concrete preparation deliverables include a written incident response plan (IRP) approved by management; playbooks (or runbooks) that give step-by-step procedures for common scenarios such as phishing, ransomware, and account compromise; a verified contact and escalation tree with after-hours numbers; defined severity tiers so responders know when to escalate; centralized logging in a SIEM with sufficient retention; pre-staged tooling such as EDR, forensic imaging kits, and write blockers; and prearranged chain-of-custody forms and evidence storage.

Preparation also means training: tabletop exercises and simulations build the muscle memory that lets a team move fast under pressure. A common exam distractor is buying a tool after the incident starts; the right preparation answer is that the capability should already exist and be tested.

Event vs. Alert vs. Incident

These three terms are tested precisely. An event is any observable occurrence in a system or network: a login, a file write, a firewall connection. An alert is a notification that an event may need attention, raised by tools such as EDR or SIEM. An incident is a confirmed or strongly suspected violation of security policy that requires a coordinated response.

Millions of events occur daily; most are benign.

A subset trigger alerts; many are false positives.

Only validated, harmful activity becomes a declared incident.

The declaration is the pivot. Once activity is treated as an incident, the team opens an incident record, assigns roles, preserves evidence, and tracks every decision with a timestamp.

• Worked Triage Example 08:12 alert EDR reports base64-encoded PowerShell on LAP-118
• 08:18 analysis Word (winword.exe) spawned PowerShell after invoice.docm opened
• 08:26 evidence DNS query to a domain registered 2 days ago
• 08:33 declare Incident opened: suspected phishing payload with C2 traffic

Notice the team did not declare an incident at 08:12 on a single alert. It correlated parent-child process behavior and a suspicious newly registered domain first. That validation step is what separates an alert from a confirmed incident.

Common IR Roles

• Role Responsibility
• Incident commander (IC) Owns priorities, coordinates teams, tracks decisions; the single point of authority
• Security analyst Reviews alerts, gathers evidence, builds the timeline
• Forensic analyst Preserves and analyzes evidence with chain of custody when investigation depth is needed
• System/data owner Explains business function and approves operational changes
• Network/endpoint engineer Implements containment and recovery actions
• Communications lead Coordinates internal and external messaging with approval
• Legal/privacy counsel Advises on privilege, evidence handling, notification, and regulatory duties
• Executive sponsor Makes high-impact business risk decisions
• Scenario Timeline

A school district receives reports that staff cannot open shared lesson files; the help desk sees an unfamiliar file extension. Security opens an incident record.

• Time Action Owner
• 09:05 Help desk reports widespread file-access failures Help desk lead
• 09:11 EDR alert on FS-04: a process is renaming files Security analyst
• 09:16 Incident declared, severity High (shared file server) Incident commander
• 09:22 SMB access limited to the affected share Network engineer
• 09:34 Suspect service account disabled IAM engineer
• 10:20 Snapshot and volatile data captured Forensic analyst
• Common Traps

Beginning eradication before preserving the evidence needed to scope the incident.

Having no incident commander, so multiple teams take conflicting actions.

Treating every alert as an incident with no triage.

Waiting for perfect certainty while active damage continues.

Letting business owners make technical evidence decisions, or letting security isolate critical systems without consulting operational owners.

Exam Focus

Watch for keywords: playbook, runbook, escalation, containment, eradication, recovery, lessons learned, incident commander . The best answer almost always matches the phase the scenario implies. If the attacker is still active, containment is the priority. If systems are verified clean and service is being returned, recovery and validation lead.