Assignment – Incident Response Planning
INFO-6081 – Monitoring & Incident Response Page: 4
Scenario 1
On a Saturday night, network intrusion detection software records an inbound connection originating 
from a watchlist IP address. The intrusion detection analyst determines that the connection is being 
made to the organization’s VPN server and contacts the incident response team. The team reviews 
the intrusion detection, firewall, and VPN server logs and identifies the user ID that was authenticated 
for the session and the name of the user associated with the user ID

please prepare the following in response to the incidence 
Preparation phase
Detection and analysis
Containment and eradication and recovery
Post incident activity