Start Here
Five review stations, each a different way to practice Chapter 14. Work through them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or the exam.
What this chapter asked you to be able to do
- Walk through the NIST SP 800-61 incident response process: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.
- Match an action to the correct response phase and explain why it belongs there.
- Explain digital forensics fundamentals: evidence acquisition, forensic images, hash verification, chain of custody, order of volatility, and live response.
- Apply the order of volatility to decide which evidence to collect first.
- Use resilience metrics such as RPO and RTO, backup strategies, recovery site types, and replication methods.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Matching Actions to the Incident Response Phase
The NIST SP 800-61 process moves through preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Read each action and choose the phase it belongs to, then check your answer.
Matching Descriptions to a Digital Forensics Concept
Forensics work depends on collecting evidence in the right order and proving it was never altered. Read each description and choose the forensics concept it defines, then check your answer.
Reference: order of volatility (most to least volatile)
| Priority | Data source | Why it ranks here |
|---|---|---|
| 1 | CPU registers and caches | Lost immediately when power is disconnected. |
| 2 | RAM (volatile memory) | Holds running processes and network connections, lost on power down. |
| 3 | Swap space and page files | Data pushed to disk when RAM is full, recovered before shutdown. |
| 4 | Disk cache | Data waiting to be written to disk, lost on power down. |
| 5 | Temporary files | On disk but frequently overwritten. |
| 6 | Hard disk and SSD drives | Non-volatile, persists across power cycles unless wiped. |
| 7 | Offline backups and archived media | Lowest volatility, often stored off-site. |
Collecting the most volatile data means leaving the system powered on and running tools, which can alter its state. Investigators balance volatility against evidence integrity.
Matching Descriptions to a Resilience Concept
Business continuity planning uses metrics, backup types, recovery sites, and replication methods, each with its own trade-off. Read each description and choose the concept it defines, then check your answer.
Knowledge Check
Ten multiple-choice questions across the whole chapter. Answer them all, then select Score my answers for feedback and a final total.