Incident response and evidence recovery are the focus of this Grade 11 Computer Science worksheet for Cybersecurity. Students learn the correct sequence for handling a security incident, from identifying affected systems through containment, eradication, recovery, monitoring, documentation, and evidence preservation. :contentReference[oaicite:0]{index=0}

Follow the incident response process in the right order

The resource helps students understand why cybersecurity incidents require an organized response rather than a collection of unrelated actions. They begin with identification, determining what happened and which systems are affected. Next comes containment, where responders limit further damage by isolating devices or restricting network traffic.

Students then examine eradication, which removes the cause of the incident, such as deleting malware or patching an exploited vulnerability. Recovery follows by restoring services carefully, checking for abnormal behavior, and confirming that the weakness has been addressed before normal operations continue.

Preserve evidence while restoring systems

A major emphasis is placed on documentation and evidence handling. Students consider why logs, timestamps, and captured artifacts should be protected during containment and recovery. They also explore how clear records of decisions, actions, and communication support reporting, continuity between responders, and future improvements to incident handling. :contentReference[oaicite:1]{index=1}

Student practice includes

• A dialogue-based question introducing incident response decisions in context
• Matching practice connecting response stages with their purposes
• A cloze passage reinforcing identification, containment, evidence preservation, eradication, recovery, and monitoring
• A diagram-labeling activity supporting visual understanding of incident response order
• An informational reading passage explaining containment, evidence handling, eradication, recovery, and documentation
• Multiple-choice questions asking students to reason about sequence, recovery choices, evidence, and repeat compromise
• True-or-false statements checking understanding of containment, documentation, eradication, and monitoring
• Short-answer questions requiring explanations of documentation, evidence preservation, and safe recovery
• An extended response applying the full process to a suspected company breach

The extended scenario asks students to justify the order of response actions while explaining why documentation and evidence preservation still matter when time is limited. This worksheet can support guided Cybersecurity practice, independent work, homework, review, or conceptual assessment. A separate Teacher Guide PDF includes learning objectives, teaching tips, discussion questions, and common mistakes.