Exercises — Lesson 10: Incident Response and Digital Forensics
1 hands-on tasks. Do them in order; each one feeds the Canvas item it names.
30 min · written
1. IR Plan Exercise
- A user reports their computer is running hot, has strange processes, and files are encrypted with .locked extension.
- Write the incident response actions for: Detection, Containment, Eradication, Recovery.
- Identify which IR phase is most often skipped — and what goes wrong when it is.
Turn in / bring: IR plan for the scenario.