4. Incident Response and Management (20%)

Incident response is what happens when everything else fails — when the vulnerability wasn't patched in time, when the phishing email got through, when the attacker is already inside. At 20% of the exam, IR tests your ability to think clearly under pressure, follow structured processes, and take the right actions in the right order.

The three sections in this phase build sequentially: attack frameworks (4.1) give you the vocabulary to understand what the attacker is doing and where they are in their campaign. IR activities (4.2) tell you what to do when you detect an attack. The IR lifecycle (4.3) covers how to prepare before an incident and what to learn afterward. Together, they represent the full loop of mature incident management.