4.8 Explain appropriate incident response activities

What is a tabletop exercise?

This is a training exercise where people will sit around a table and discuss the logistics, their role and what they would do during a exercise. From there, those people will be able to discuss on whether what needs improved, what was correct or what could of been done differently.

What is a simulation exercise?

This is a way to test with a simulated event such as a phishing email, password helpdesk request or to see how your network monitors malicious traffic. This is a good way to test internal security and what could be improved.

What is a legal hold in terms of digital forensics?

This is a term used to describe when a lawyer requests the data holder to preserve that data and to store that data in a separate location for a impending litigation.

What is threat hunting?

This is a term used to describe when you are proactively looking for a weakness in your network instead of waiting for an attacker to find it before you do.