Free practice · multiple-choice · medium
Practice
Preserve useful incident evidence
Which details are useful when reporting a suspicious sign-in?
Beginner incident handoff
Stop harm, preserve facts, and support authorized recovery
- StopEnd the risky action
- ContainUse only authorized instructions
- ReportShare assets, time, facts, and actions
- PreserveKeep evidence and a factual timeline
- CoordinateSupport scope and business decisions
- RecoverVerify clean service and improve controls
A strong beginner response is prompt and factual without becoming an unauthorized investigation, cleanup, payment, or public-communication effort.