Overview
Domain 4 covers three linked areas. The first is the incident response life cycle, referencing NIST and ISO: preparation, detection, analysis and escalation, containment, eradication, recovery, and post-incident activity such as lessons learned. The second is forensic investigations: the legal and ethical principles behind civil, criminal and administrative cases, evidence handling from first response and triage through chain of custody and scene preservation, reporting the analysis, and compliance with organizational security policy. The third is business continuity and disaster recovery: emergency response plans, interim or alternate processing, restoration planning with recovery time objective (RTO), recovery point objective (RPO) and maximum tolerable downtime (MTD), backup and redundancy, and testing and drills.
The domain picks up where Domain 3's monitoring leaves off. It relies on the logs and baselines built there, and its lessons learned feed back into the controls in Domains 1, 2, 6 and 7.
How it's tested
Questions put you in the middle of an incident, an investigation or an outage, and ask what to do FIRST or NEXT, how to handle evidence, or which recovery figure or strategy fits. The correct answer usually respects the order of the life cycle and preserves evidence.
-
Next step in the life cycle
An incident is at a particular stage, and you must choose the correct next phase or action without skipping ahead.
-
Protect the evidence
A first-responder action is proposed, and you must recognize whether it preserves or damages evidence and chain of custody.
-
Recovery numbers
MTD, RTO, RPO and backup options are given, and you must check that they are consistent or choose the strategy that meets them.
An analyst finds ransomware spreading from one file server. Asked what to do FIRST, skip restoring from backup, because the infection is still active and restored data would be re-encrypted. The first move is containment: isolate the affected systems to stop the spread, while preserving evidence. Eradication and recovery follow once the spread is stopped and the cause is understood.
Subdomains 3
Official subdomains from the ISC2 outline, in outline order.
4.1 Understand and support incident response lifecyclePreparation, detection and analysis, containment, eradication, recovery and post-incident activity.
- What it means
- The incident response life cycle, as described by NIST and ISO, starts with preparation (roles, training, tools and plans). It moves through detection, analysis and escalation (including incident communication and public relations), containment to limit damage, eradication to remove the cause, recovery to restore normal operation with documentation, and post-incident activities such as lessons learned, new countermeasures and continuous improvement.
- What to understand
- Phases have a logical order. Containment comes before eradication, and eradication before recovery, or the attacker may return. Communication with stakeholders and the public must be controlled and approved. Lessons learned are what make the next response better.
- How it shows up
- An incident is described at a stage, and you must pick the correct next action or identify the skipped phase.
- Common confusion
- Treating restoration from backup as the first response. Restoring an environment that still contains the threat repeats the incident.
4.2 Understand and support forensic investigationsLegal and ethical principles, evidence handling, reporting and policy compliance.
- What it means
- Forensic support covers the legal context, since civil, criminal and administrative cases have different standards and procedures, and ethical principles. It covers evidence handling, from first response and triage to chain of custody and preservation of the scene. It also covers reporting the analysis and ensuring compliance with organizational security policy.
- What to understand
- Evidence must be collected so it remains admissible: document everything, preserve originals, work on copies, hash images to prove integrity, and record every transfer in the chain of custody. Collect volatile evidence, such as memory and network connections, before less volatile evidence. Criminal cases need the highest standard of proof.
- How it shows up
- A first responder proposes an action, such as rebooting, browsing files on the original or unplugging the network cable, and you must judge whether it preserves evidence.
- Common confusion
- Investigating on the original evidence. Analysis should be done on verified copies so the original remains intact.
4.3 Understand and support business continuity plan (BCP) and disaster recovery plan (DRP)Emergency response, alternate processing, restoration planning, backups and testing.
- What it means
- This covers emergency response plans for information system contingencies, pandemics, natural disasters and crises, interim or alternate processing strategies, and restoration planning using RTO, RPO and MTD. It also covers backup and redundancy, and testing and drills through playbooks, tabletops and disaster recovery exercises.
- What to understand
- Life safety always comes first in emergencies. RTO must be shorter than MTD, and RPO determines how often backups or replication must happen. Backups are only proven by restore tests, and plans by exercises.
- How it shows up
- Questions give recovery figures and ask whether they are consistent, which backup approach meets an RPO, or which test type to run first.
- Common confusion
- Setting an RTO longer than the MTD, which plans for a recovery that arrives after the business has already suffered unacceptable harm.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
NIST incident life cycle
Preparation; detection and analysis; containment, eradication and recovery; post-incident activity.
- Remember
- The outline lists containment, eradication and recovery as separate steps in that order.
- Tested as
- Sequencing questions.
- Trap
- Eradicating or restoring before containing.
-
Containment
Limiting the spread and impact of an incident.
- Remember
- It comes before eradication and should preserve evidence where possible.
- Tested as
- First-action questions.
- Trap
- Powering off systems in a way that destroys volatile evidence.
-
Lessons learned
A post-incident review of what happened and what to improve.
- Remember
- It feeds new countermeasures and better preparation.
- Tested as
- Post-incident questions.
- Trap
- Skipping it once service is restored.
-
Chain of custody
A documented record of who handled evidence, when and why.
- Remember
- A gap can make evidence inadmissible.
- Tested as
- Evidence handling questions.
- Trap
- Passing evidence informally between staff.
-
Order of volatility
Collect the most short-lived evidence first: CPU and memory, network state, then disk and backups.
- Remember
- Rebooting or powering off loses memory evidence.
- Tested as
- First-responder questions.
- Trap
- Imaging the disk while memory evidence disappears.
-
Forensic hashing
Hashing an evidence image when it is taken and again later to prove it has not changed.
- Remember
- Analysis is done on verified copies.
- Tested as
- Integrity of evidence.
- Trap
- Working directly on the original.
-
Criminal vs. civil vs. administrative
Criminal cases require proof beyond a reasonable doubt, civil cases use a lower standard such as preponderance of evidence, and administrative matters follow internal or regulatory procedures.
- Remember
- Handle evidence to the highest standard in case a matter becomes criminal.
- Tested as
- Legal principle questions.
- Trap
- Handling evidence casually because the case looks internal.
-
MTD, RTO and RPO
MTD is the longest a process can be down. RTO is the target restore time. RPO is the acceptable data loss in time.
- Remember
- RTO must be shorter than MTD, and RPO drives backup frequency.
- Tested as
- Recovery calculation questions.
- Trap
- Thinking RPO governs how fast systems return.
-
Full vs. incremental vs. differential backup
Full copies everything. Incremental copies changes since the last backup of any kind. Differential copies changes since the last full backup.
- Remember
- Incremental restores need the full plus every incremental, and differential restores need the full plus the latest differential.
- Tested as
- Backup and restore questions.
- Trap
- Mixing up which is faster to back up and which is faster to restore.
-
Hot, warm and cold sites
Hot sites are ready almost immediately, warm sites need some setup, and cold sites provide space and utilities only.
- Remember
- Choose by RTO and cost.
- Tested as
- Alternate processing questions.
- Trap
- Choosing a cold site for a short RTO.
-
Tabletop vs. full exercise
A tabletop talks through a scenario. A full exercise or failover actually performs recovery steps.
- Remember
- Start with low-disruption tests and build up.
- Tested as
- Testing questions.
- Trap
- Running a full interruption test first.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Full vs. incremental vs. differential backups
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Full | Copies all selected data | Slowest to back up, simplest to restore | Running it too rarely for a tight RPO |
| Incremental | Copies changes since the last backup of any type | Fastest backup, slowest restore | Forgetting every incremental is needed for restore |
| Differential | Copies changes since the last full backup | Backup grows daily, restore needs only full plus latest differential | Confusing it with incremental |
MTD vs. RTO vs. RPO
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| MTD | Longest tolerable outage before unacceptable harm | Business limit | Setting RTO longer than it |
| RTO | Target time to restore a process or system | Must fit inside MTD | Confusing it with RPO |
| RPO | Acceptable data loss measured back in time | Drives backup and replication frequency | Thinking it controls recovery speed |
Containment vs. eradication vs. recovery
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Containment | Stop the incident from spreading | Limits damage first | Skipping it to restore quickly |
| Eradication | Remove the cause, such as malware or compromised accounts | Removes the threat | Doing it before scope is understood |
| Recovery | Restore systems to normal operation and monitor them | Returns service safely | Restoring into an environment that is still compromised |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Restore first
- What candidates pick
- Restore affected systems from backup as the first response to ransomware.
- Why it looks right
- It brings the business back quickly.
- Why it's wrong
- If the threat is still active, restored data can be re-encrypted. Containment must come first.
Clue to watch for The infection is described as still spreading.
-
Reboot to stop it
- What candidates pick
- Reboot the compromised server to kill the malicious process.
- Why it looks right
- It stops the activity immediately.
- Why it's wrong
- It destroys memory evidence and may trigger destructive malware behavior. Isolate and capture volatile data first.
Clue to watch for The question mentions investigation, evidence or legal action.
-
Look on the original
- What candidates pick
- Browse the suspect's hard drive directly to find evidence quickly.
- Why it looks right
- It is the fastest way to answer questions.
- Why it's wrong
- Accessing the original changes metadata and weakens admissibility. Work on a hashed forensic copy.
Clue to watch for The evidence may be used in a legal or disciplinary case.
-
RTO beyond MTD
- What candidates pick
- Accept a recovery plan with a 48-hour RTO for a process with a 24-hour MTD.
- Why it looks right
- The plan is approved and documented.
- Why it's wrong
- Recovery would arrive after the business has already suffered unacceptable harm.
Clue to watch for Compare the figures given in the question.
-
Skip lessons learned
- What candidates pick
- Close the incident as soon as systems are restored.
- Why it looks right
- Service is back and the team is tired.
- Why it's wrong
- Without post-incident review, the same weakness remains and the response does not improve.
Clue to watch for The incident has recurred, or the question asks what is missing.
-
Act alone
- What candidates pick
- The practitioner contacts the press or law enforcement directly after confirming a breach.
- Why it looks right
- It seems transparent and responsible.
- Why it's wrong
- Communication and external reporting follow the incident plan and are approved by designated roles.
Clue to watch for External parties, regulators or media are involved.
Answer framework
For any Domain 4 scenario, use these steps to find the answer the SSCP expects.
- Identify which phase the incident is in, and refuse to skip ahead, so containment comes before eradication and eradication before recovery.
- Before touching an affected system, consider what evidence it holds, and capture the most volatile data first while documenting every action.
- Protect the chain of custody by working on hashed copies, recording transfers, and handling evidence as if the case could become criminal.
- For outages, check that RTO fits inside MTD, that backups meet the RPO, and that the alternate site matches the recovery time.
- Escalate and communicate through the plan's designated roles, and finish with lessons learned that update controls and plans.
Practice question
Want more like this? The SSCP practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the incident response life cycle in 4.1 and learn it as an ordered sequence. Practice reading a short scenario, naming the current phase and choosing the next action. Most marks in this domain depend on getting the order right.
Next, study forensics in 4.2 with a first responder's mindset: what to collect first, what not to touch, and how to document. Order of volatility, working on hashed copies and chain of custody cover most questions.
Then work through 4.3. Memorize the relationship between MTD, RTO and RPO and practice checking figures for consistency. Learn the three backup types well enough to say which is fastest to create and which is fastest to restore. Candidates commonly underestimate testing and drills, so know the progression from tabletop to full exercise.
Afterwards, return to Domain 3 for mixed practice. Detection and escalation there lead directly into the response steps here, and sequencing questions often span both domains.
FAQ
How much of the SSCP exam is Domain 4?
Incident Response and Recovery carries 14% under the outline effective 1 October 2025.
Which incident response model does the exam use?
The outline references NIST and ISO and lists preparation; detection, analysis and escalation; containment; eradication; recovery; and post-incident activities.
What should a first responder do with a running computer?
Avoid shutting it down or browsing files. Capture volatile evidence such as memory and network connections first, and document every step.
What is the difference between RTO and RPO?
RTO is how quickly a system or process must be restored. RPO is how much data loss, measured in time, is acceptable, which sets backup frequency.
Which backup type is fastest to restore?
A full backup restores fastest because only one set is needed. Differential restores need the full plus the latest differential, and incremental restores need the full plus every incremental.
Do SSCP candidates lead investigations?
The outline uses the words understand and support. You are expected to assist correctly, by preserving evidence, following the plan and escalating, rather than to direct legal proceedings.
How does Domain 4 relate to Domain 3?
Domain 3's monitoring detects and escalates events, and Domain 4 handles them once they are confirmed as incidents.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Same subject: Domain 3: Incident Response and Management (24%)
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 4 knowledge
You have covered the incident life cycle, forensic evidence handling, and continuity and recovery planning. Test whether you can choose the right first action under exam conditions.