Skip to content
AI Security

Interview question · Detection Engineering & Incident Response

What does NIST SP 800-61 Revision 3 change about how incident response is framed, and how would you apply it?

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

mediumNewPreparation tags: Amazon, Microsoft, GoogleUpdated Nov 2026

Candidates still recite 'preparation, detection, containment, eradication, recovery, lessons learned'. Revision 3 moved incident response into the Cybersecurity Framework's functions, and interviewers notice who has kept up.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A team asks what changed in NIST SP 800-61 Revision 3 and whether its incident response playbooks need rewriting.

  1. What is the main change?
  2. How do the CSF functions map to incident response?
  3. What does that mean in practice?
  4. Do existing playbooks need rewriting?
  5. How would you show the programme improves?
  6. How would you apply Rev 3 to the team?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackYour SOC is drowning in alerts. How do you reduce alert fatigue, and which metrics tell you it is working?Next in this trackYou have 40,000 open vulnerabilities. How do you decide what to fix first, using CVSS, EPSS, KEV and your own context?Next in this trackWhat is threat hunting, how do you run a hunt, and how do you know it was worth the time?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.