EC-Council CSA · Domain 6 of 8

EC-Council CSA Domain 6: Incident Response

Incident Response shares top weight in CSA v2 at 25%. It covers the incident response process and phases, handling network, application, email, insider and malware incidents, the role of SOC playbooks, and enhanced response using EDR and XDR.

Exam weight
25%
Official objectives
9
Estimated questions estimate
~25
Suggested study time estimate
16–22 hrs

About 14 min read Reviewed October 2026

Overview

Domain 6 covers what the SOC does once an incident is confirmed. It begins with incident response concepts: what counts as an incident, the incident response team and its relationship with the SOC, and the policies and plans that authorize action. The process follows EC-Council's incident handling phases, from preparation, recording and assignment, triage and notification, through containment, evidence gathering and forensic analysis, eradication and recovery, to post-incident activities. These map closely to the NIST SP 800-61 lifecycle.

The domain then applies the process to specific incident types: network incidents such as DoS and unauthorized access, application incidents such as web attacks, email incidents such as phishing and business email compromise, insider incidents, and malware outbreaks including ransomware. Finally it covers SOC playbooks, which standardize response steps and support SOAR automation, and EDR and XDR platforms that let responders isolate hosts, kill processes and correlate activity across endpoints, email, network and cloud.

How it's tested

Questions are mostly scenario-based and sequence-sensitive. A stem describes an incident at a given point and asks for the next or best action, the phase you are in, or which tool capability to use. Some test playbook design or the difference between EDR and XDR.

  • What comes next

    An incident is described partway through handling, and you choose the correct next phase or action.

  • Respond to this type

    A specific incident such as phishing, ransomware or an insider data theft is described, and you pick the response step suited to that type.

  • Use the right capability

    A response need is described, and you choose the playbook, SOAR action or EDR/XDR function that meets it.

Reasoning it through

EDR flags ransomware encrypting files on a finance workstation, and the same hash appears on two other hosts. Reimaging the first workstation is tempting because it restores service, but that is recovery and would destroy evidence. Containment comes first: isolate all three hosts through EDR network isolation, preserve memory and disk where feasible, then eradicate and restore from clean backups.

Objectives 9

Official objectives from the EC-Council outline, in outline order.

6.1 Understand about Incident ResponseCore incident response concepts and roles.
What it means
Incident response is the organized approach to handling security incidents to limit damage, reduce recovery time and cost, and learn from what happened. An incident is an event that violates or threatens security policy, as opposed to an ordinary event.
What to understand
A response program needs an approved policy, an incident response plan, defined roles in a computer security incident response team, communication and escalation paths, and agreed severity levels. The SOC usually detects and triages, while the IR team leads containment and recovery, though in smaller organizations they overlap. Legal, HR, communications and management may join depending on the incident.
How it shows up
Questions ask what separates an event from an incident or which role owns a response task.
Common confusion
Calling every alert an incident; an incident requires confirmed or likely policy violation or harm.
6.2 Learn Various Phases in Incident Response ProcessThe sequence of incident handling phases.
What it means
EC-Council's incident handling and response process runs preparation, incident recording and assignment, incident triage, notification, containment, evidence gathering and forensic analysis, eradication, recovery, and post-incident activities. NIST SP 800-61 groups similar work into preparation, detection and analysis, containment, eradication and recovery, and post-incident activity.
What to understand
Order matters: contain before eradicating, and preserve evidence before wiping systems. Short-term containment stops spread quickly, while long-term containment keeps business running while the fix is prepared. Post-incident activities include documentation, lessons learned, updating playbooks and detection, and reporting obligations. NIST revised SP 800-61 in 2025 to align with CSF 2.0, but the sequencing logic is unchanged.
How it shows up
An action is described, and you identify its phase or the correct next phase.
Common confusion
Starting eradication or recovery before containment is complete and evidence is preserved.
6.3 Learn to Respond to Network Security IncidentsHandling attacks against network infrastructure and traffic.
What it means
Network security incidents include denial of service, unauthorized access, scanning and reconnaissance, man-in-the-middle activity and suspicious outbound communication such as command and control traffic.
What to understand
DoS response combines filtering and rate limiting at the edge with help from the ISP or a scrubbing service, since the target's own bandwidth may already be saturated. Unauthorized access calls for blocking the source, disabling affected accounts, segmenting the compromised zone and reviewing firewall and VPN logs. C2 traffic should be blocked at the perimeter and traced back to infected hosts.
How it shows up
A network incident is described, and you choose the most effective containment action.
Common confusion
Trying to stop a large volumetric DDoS only at the organization's own firewall.
6.4 Learn to Respond to Application Security IncidentsHandling attacks against web and business applications.
What it means
Application security incidents involve exploitation of application flaws, such as SQL injection, cross-site scripting, broken authentication, file upload abuse and web shells.
What to understand
Response steps include identifying the vulnerable component from web and WAF logs, applying virtual patching with a WAF rule while developers fix the code, checking whether data was accessed or changed, searching for web shells, rotating exposed credentials and keys, and reviewing database audit logs. Taking the application offline is a business decision weighed against the risk of continued exploitation.
How it shows up
Expect questions on the fastest safe containment for a live web exploit.
Common confusion
Assuming patching alone finishes the response without checking for web shells or stolen data.
6.5 Learn to Respond to Email Security IncidentsHandling phishing, malicious attachments and business email compromise.
What it means
Email security incidents include phishing campaigns, malicious attachments, credential harvesting links, spoofed senders and business email compromise involving fraudulent payment requests.
What to understand
Response usually means analyzing headers and content, extracting indicators, searching for and purging the message from all mailboxes, blocking sender domains, URLs and attachment hashes, and identifying users who clicked or entered credentials. Those accounts need password resets, session revocation and MFA checks, plus a review of mailbox rules attackers create to hide replies. BEC cases may require contacting the bank quickly.
How it shows up
A phishing or BEC scenario is given, and you choose the most important response step.
Common confusion
Deleting the message from the one reporting user's mailbox while copies remain elsewhere.
6.6 Learn to Respond to Insider IncidentHandling incidents caused by trusted users.
What it means
Insider incidents involve employees, contractors or partners misusing access, whether maliciously, negligently or because their account was compromised.
What to understand
Response must preserve evidence carefully and quietly, because tipping off a malicious insider can lead to evidence destruction. HR and legal should be involved early, and actions must follow policy and privacy law. Steps include reviewing access and DLP logs, restricting or monitoring access, securing devices, and revoking access at the right time, often coordinated with the person's departure. Compromised insiders need account recovery rather than disciplinary action.
How it shows up
An insider scenario is described, and you choose the correct first step or the right people to involve.
Common confusion
Confronting the suspected insider before evidence is secured and HR and legal are involved.
6.7 Learn to Respond to Malware IncidentsHandling infections, including ransomware.
What it means
Malware incidents involve malicious code such as trojans, worms, ransomware, spyware and fileless malware running in the environment.
What to understand
Response includes isolating infected hosts, identifying the strain and its spread mechanism, collecting samples and memory when possible, blocking indicators across controls, eradicating by removal or reimaging, and restoring from clean, tested backups. For ransomware, verify backups are not affected, check for data theft before encryption, and follow policy and legal advice on reporting. Find the initial infection vector so it can be closed.
How it shows up
A malware outbreak is described, and you choose the correct containment or recovery action.
Common confusion
Restoring from backup before confirming the backups and the infection vector are clean.
6.8 Understanding the Role of SOC Playbooks in Incident ResponseStandardized, documented response procedures.
What it means
A SOC playbook is a documented, repeatable set of steps for handling a specific incident type, stating triggers, roles, decisions, actions, communication and closure criteria.
What to understand
Playbooks make response consistent and faster, help newer analysts, and form the basis for SOAR automation, where tasks such as enrichment, blocking or ticket creation run automatically. A runbook is usually more granular, describing the exact technical steps for one task. Playbooks need regular testing, for example in tabletop exercises, and updates after each lessons-learned review.
How it shows up
Questions ask what a playbook should contain, how it differs from a runbook, or how it supports automation.
Common confusion
Treating a playbook as a static document that never needs testing or revision.
6.9 Understand Enhanced Incident Response using Endpoint Detection and Response (EDR) / Extended Detection and Response (XDR)Response capabilities in endpoint and extended detection platforms.
What it means
EDR continuously records endpoint telemetry such as processes, file changes, registry edits and network connections, and lets responders investigate and act on hosts remotely. XDR extends this by correlating telemetry across endpoints, email, identity, network and cloud in one platform.
What to understand
EDR response actions include isolating a host from the network while keeping management connectivity, killing processes, quarantining files, collecting forensic artifacts and running scripts. XDR shortens investigation by linking an email delivery, an endpoint execution and an identity sign-in into one incident. Both depend on agents being deployed and healthy.
How it shows up
A response need is given, and you choose the EDR or XDR capability that fits.
Common confusion
Thinking EDR host isolation cuts the host off from the EDR console too; management traffic stays open.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Event vs. incident

    An event is any observable occurrence; an incident violates or threatens policy.

    Remember
    Not every alert is an incident.
    Tested as
    Definition questions.
    Trap
    Declaring incidents for every alert.

  • EC-Council IH&R phases

    Preparation, recording, triage, notification, containment, evidence gathering, eradication, recovery, post-incident.

    Remember
    Containment precedes eradication.
    Tested as
    Sequencing questions.
    Trap
    Recovering before containing.

  • NIST SP 800-61 lifecycle

    NIST's four-phase incident lifecycle, from preparation to post-incident activity.

    Remember
    Revision 3 (2025) aligns it with CSF 2.0.
    Tested as
    Framework questions.
    Trap
    Treating it as a different sequence.

  • Short-term vs. long-term containment

    Immediate actions to stop spread versus temporary fixes to keep operating.

    Remember
    Both come before eradication.
    Tested as
    Containment questions.
    Trap
    Skipping straight to rebuilding.

  • Evidence preservation

    Capture volatile and disk data before changes.

    Remember
    Reimaging destroys evidence.
    Tested as
    Order of action questions.
    Trap
    Wiping first to restore service.

  • Message purge

    Removing a malicious email from every mailbox that received it.

    Remember
    Scope by sender, subject or hash.
    Tested as
    Phishing response questions.
    Trap
    Deleting only the reported copy.

  • Malicious inbox rules

    Rules attackers create to hide or forward mail.

    Remember
    Check them after account compromise.
    Tested as
    BEC response questions.
    Trap
    Resetting the password but leaving the rules.

  • Virtual patching

    A WAF rule that blocks exploitation until code is fixed.

    Remember
    Fast containment for web flaws.
    Tested as
    Application response questions.
    Trap
    Treating it as the permanent fix.

  • Insider case handling

    Discreet evidence collection with HR and legal involvement.

    Remember
    Avoid tipping off the subject.
    Tested as
    Insider response questions.
    Trap
    Confronting the user first.

  • Playbook vs. runbook

    Playbook covers an incident type end to end; runbook details one technical task.

    Remember
    Playbooks drive SOAR workflows.
    Tested as
    Playbook questions.
    Trap
    Using the terms interchangeably.

  • SOAR

    Security orchestration, automation and response platform.

    Remember
    Automates playbook steps.
    Tested as
    Automation questions.
    Trap
    Expecting it to replace analyst judgment.

  • EDR host isolation

    Cuts a host from the network but keeps console connectivity.

    Remember
    Contains without powering off.
    Tested as
    EDR response questions.
    Trap
    Pulling the power and losing memory.

  • XDR

    Correlation across endpoint, email, identity, network and cloud.

    Remember
    Builds one incident from many signals.
    Tested as
    EDR vs. XDR questions.
    Trap
    Thinking it covers endpoints only.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Response steps by incident type

ConceptMeaningKey differenceCommon trap
Phishing Purge, block indicators, reset clicked users Scope across all mailboxes Handling only the reporter
Ransomware Isolate, preserve, restore clean backups Check backups and exfiltration Restoring before finding the vector
Web exploit Virtual patch, hunt web shells, fix code Check data access Stopping at the patch
Insider Quiet evidence, HR and legal, timed revocation Avoid tipping off Confronting first
DDoS Rate limit, ISP or scrubbing service Upstream help needed Relying on local firewall

EDR vs. XDR

ConceptMeaningKey differenceCommon trap
EDR Endpoint telemetry and response Host-focused actions Expecting email visibility
XDR Cross-domain telemetry and correlation Links email, identity, network, cloud Thinking it is just rebranded EDR

Playbook vs. runbook vs. IR plan

ConceptMeaningKey differenceCommon trap
IR plan Organization-wide response framework Authority, roles, communication Using it as step-by-step guide
Playbook End-to-end steps for an incident type Decision points and roles Never testing it
Runbook Technical procedure for one task Most granular Confusing with playbook

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Reimage first

    What candidates pick
    Wipe and rebuild an infected machine immediately.
    Why it looks right
    It quickly restores a clean system.
    Why it's wrong
    Reimaging destroys volatile and disk evidence and skips containment of other infected hosts.

    Clue to watch for Evidence or scope is still unknown.

  2. Power off the host

    What candidates pick
    Shut down a compromised workstation to stop the attack.
    Why it looks right
    It stops activity instantly.
    Why it's wrong
    Powering off loses memory evidence; EDR network isolation contains while preserving state.

    Clue to watch for EDR is deployed in the scenario.

  3. One mailbox cleanup

    What candidates pick
    Delete the phishing email from the user who reported it.
    Why it looks right
    That user raised the alert.
    Why it's wrong
    Other recipients may still click; the message must be purged organization-wide.

    Clue to watch for The campaign hit multiple recipients.

  4. Password reset is enough

    What candidates pick
    Reset the password of a compromised mailbox and close the case.
    Why it looks right
    It removes the attacker's credential.
    Why it's wrong
    Attackers may hold active sessions, tokens or inbox rules that survive a reset.

    Clue to watch for Forwarding or hiding rules are mentioned.

  5. Confront the insider

    What candidates pick
    Interview the suspected employee immediately.
    Why it looks right
    It seems direct and fast.
    Why it's wrong
    Tipping off the subject risks evidence destruction; HR and legal must guide timing.

    Clue to watch for The case involves a current employee.

  6. Local DDoS defense

    What candidates pick
    Block a large volumetric DDoS at the company firewall.
    Why it looks right
    The firewall is the usual control point.
    Why it's wrong
    When the link is saturated, filtering must happen upstream at the ISP or scrubbing provider.

    Clue to watch for Bandwidth is fully consumed.

  7. Playbooks are static

    What candidates pick
    Write a playbook once and keep it unchanged.
    Why it looks right
    Documentation feels complete once written.
    Why it's wrong
    Playbooks must be tested and updated after exercises and lessons learned.

    Clue to watch for A recent incident exposed gaps.

Answer framework

Use these steps for any Domain 6 scenario about handling a confirmed or suspected incident.

  1. Confirm that the situation is an incident rather than an event, and identify its type: network, application, email, insider or malware.
  2. Locate the current phase in the response process so you can choose the next correct phase rather than skipping ahead, for example triage before containment.
  3. Contain spread first, using the least destructive effective method such as EDR isolation, account disablement or blocking indicators at the firewall.
  4. Preserve evidence before eradication, then remove the threat, close the entry point and recover from verified clean backups or gold images.
  5. Apply type-specific steps and stakeholders, follow the relevant playbook, and finish with lessons learned that update playbooks and detections.

Practice question

Five employees report the same credential-phishing email. Proxy logs show three users visited the link and one submitted credentials. Mail logs show the message reached 240 mailboxes. What should the SOC do first?

Want more like this? The EC-Council CSA practice test has questions for every domain.

Checklist

0 of 14

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Plan to spend as much time here as on Domain 4. Begin by memorizing EC-Council's incident handling phases and writing them beside the NIST lifecycle so you can answer in either vocabulary. For each phase, write one action that belongs there and one that does not.

Next, work through the five incident types one by one. Write a mini playbook for each with the trigger, first three actions, people to involve and recovery criteria. Pay particular attention to phishing and ransomware, which are common scenario topics, and to insider cases, where the order of actions and the role of HR and legal are tested.

Then study playbooks, runbooks and SOAR: build a simple phishing playbook flowchart and mark which steps could be automated. Finish with EDR and XDR by listing their response actions and practicing which one fits a given need. Throughout, drill sequencing questions, because many wrong answers on this domain are right actions done at the wrong time.

FAQ

What percentage of the CSA v2 exam is Incident Response?

Incident Response is 25% of the blueprint, roughly 25 of the 100 questions, tied with Incident Detection and Triage for the largest share.

Which incident response model does CSA use?

EC-Council's incident handling and response phases, which align with NIST SP 800-61. Knowing both sets of terms helps with differently worded questions.

What is the first priority in most incidents?

After confirming the incident, containment to stop spread, while preserving evidence. Eradication and recovery come afterward.

How is a phishing incident contained?

Purge the message from every mailbox, block the sender, URLs and attachments, and then remediate any accounts that clicked or entered credentials.

Why involve HR and legal in insider incidents?

Insider cases touch employment law, privacy and possible prosecution. HR and legal guide evidence handling and the timing of any action against the person.

What is the difference between EDR and XDR?

EDR focuses on endpoint telemetry and response. XDR correlates signals across endpoints, email, identity, network and cloud into unified incidents.

What is a SOC playbook?

A documented set of steps for a specific incident type, covering triggers, roles, decisions and actions. Playbooks also serve as the logic for SOAR automation.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

You have covered incident response phases, handling network, application, email, insider and malware incidents, playbooks and EDR/XDR. Test your sequencing under exam timing.

Take the EC-Council CSA practice test Check your EC-Council CSA readiness

Keep going