The first actions after a suspected incident — knowledge check

Answer every question, then review your score and the explanation behind each answer.

Practice, not certification. Results stay in this page and reset on reload. Nothing is sent to an account or payment service.

Question 1What is most useful in an initial report?

AObserved facts, times and actions takenBAn unsupported attribution claimCA rewritten logDA promise that nothing happened

Question 2Why avoid random cleanup tools immediately?

ACleanup is never usefulBLogs are never relevantCAll tools are maliciousDThey may destroy evidence or worsen the situation

Question 3Normal email may be compromised. How should responders communicate?

AThrough a public comment threadBBy sharing passwordsCThrough an approved separate channelDOnly through the suspected mailbox

Keep building the skill.

Cybersecurity foundations.
Professional learning tracks.

Free foundations and Simulation A. Five guided Pro labs are available; additional exams and account features are in preparation.