Incident Response: Threat Hunting, Forensics Integration and Frameworks

This test challenges practitioners to apply advanced incident response concepts at the analysis level. Questions span mapping adversary behavior to the MITRE ATT&CK framework, constructing and evaluating hypothesis-driven threat hunting methodologies, and integrating memory and network forensic evidence into live IR workflows. Scenarios drawn from ransomware and APT campaign investigations require selecting appropriate playbook steps and understanding evidence-chain implications. Metric literacy covers MTTD and MTTR as operational and strategic levers. Legal and regulatory dimensions include breach-notification timelines, cross-jurisdictional obligations under GDPR, HIPAA, and comparable frameworks, and the role of legal hold in preserving forensic integrity. Candidates are expected to distinguish closely related techniques, apply principles to realistic fact patterns, and evaluate tradeoffs between investigative thoroughness and operational recovery pressures. Suitable for IR analysts, threat hunters, and digital forensics professionals operating in multi-jurisdictional or enterprise environments.