DJN2 — DJN2 TASK 1: INCIDENT RESPONSE

DJN2 — DJN2 TASK 1: INCIDENT RESPONSE
SECURITY OPERATIONS — D483
PRFA — DJN2
COMPETENCIES
4112.1.6 : Recommends Incident Response Solutions
The learner recommends solutions to respond to a detected cybersecurity incident.
INTRODUCTION
Throughout your career in security operations, you will be asked to investigate incidents and
recommend responses to those incidents. You will need to analyze logs when investigating affected
hardware, diagnose an attack and its impact, and recommend next steps in an incident response
report.
In this task, you are given the attached “Background Information” reference document containing a
security operations scenario and associated helpdesk ticket artifacts. You will access a virtual lab
environment to investigate and interact with the affected hardware discussed in the “Background
Information” document. Additional details for interacting with the virtual lab environment, including
the use of its available tools and the screenshot evidence document, can be found in the attached
“Virtual Lab Supplementary Instructions” document. Next, you will create an incident response report
using the attached “Incident Reporting Template” document to identify the steps taken in detecting,
investigating, and remediating the issues within the virtual lab and to recommend next steps.
Your submission will include both your completed incident response report and a screenshot evidence
document generated by the virtual lab environment.
SCENARIO
Refer to the scenario and artifacts in the attached “Background Information” document. Additionally,
details for interacting with the virtual lab environment can be found in the attached “Virtual Lab
Supplementary Instructions” document.
REQUIREMENTS
Your submission must represent your original work and understanding of the course material. Most
performance assessment submissions are automatically scanned through the WGU similarity checker.
Students are strongly encouraged to wait for the similarity report to generate after uploading their
Preparation Task Overview Submissions Evaluation Report
WGU Performance Assessment https://tasks.wgu.edu/student/012511603/course/32680020/…
1 of 6 9/21/25, 15:40
work and then review it to ensure Academic Authenticity guidelines are met before submitting the file
for evaluation. See Understanding Similarity Reports for more information.
Grammarly Note:
Professional Communication will be automatically assessed through Grammarly for Education in most
performance assessments before a student submits work for evaluation. Students are strongly
encouraged to review the Grammarly for Education feedback prior to submitting work for evaluation,
as the overall submission will not pass without this aspect passing. See Use Grammarly for Education
Effectively for more information.
Microsoft Files Note:
Write your paper in Microsoft Word (.doc or .docx) unless another Microsoft product, or pdf, is
specified in the task directions. Tasks may not be submitted as cloud links, such as links to Google
Docs, Google Slides, OneDrive, etc. All supporting documentation, such as screenshots and proof of
experience, should be collected in a pdf file and submitted separately from the main file. For more
information, please see Computer System and Technology Requirements.
You must use the rubric to direct the creation of your submission because it provides detailed criteria
that will be used to evaluate your work. Each requirement below may be evaluated by more than one
rubric aspect. The rubric aspect titles may contain hyperlinks to relevant portions of the course.
Note: Additional information can be found in the attached “Virtual Lab Supplementary Instructions”
supporting document.
A. Using the attached “Incident Reporting Template” supporting document, provide the details of the
incident from the attached “Background Information” document by identifying the following:
• incident numbers
• incident dates
• report author (i.e., WGU student ID)
• report date
• summary of the incident
• impacted system
• primary function of the impacted system
• impacted users
• incident timeline
• functional impact classification
• incident priority classification
• incident type classification
B. Using the “Incident Reporting Template” supporting document, provide the details of the impacted
system by identifying the following:
• hostname
• IP address
• operating system
C. Using the “Incident Reporting Template” supporting document, determine the details of the
malicious traffic by identifying the following:
• destination port
• additional notes and observations gained from the malicious traffic search metadata
WGU Performance Assessment https://tasks.wgu.edu/student/012511603/course/32680020/…
2 of 6 9/21/25, 15:40
Note: The additional notes and observations should include details relevant to the stakeholders at
the fictional organization.
D. Using the “Incident Reporting Template” supporting document, summarize the incident
remediation process by identifying the following points:
• actions taken to restore impacted system functionality
• actions taken to restore network security
• additional notes and observations relevant to the summary
Note: The additional notes and observations should include details relevant to the stakeholders at
the fictional organization.
E. Using the “Incident Reporting Template” supporting document, recommend 2–4 planned relevant
actions to prevent similar incidents from occurring in the future. For each planned action, identify
the following:
• which negative impact from the incident is addressed
• how that action will prevent reoccurrence of the negative impact
F. Provide the screenshot evidence document, in .docx format, generated by the virtual lab. For each
of the five challenge questions, both the information requested by that challenge question and the
unaltered watermark displaying the student ID must be clearly visible in the screenshot.
G. Acknowledge sources, using in-text citations and references, for content that is quoted,
paraphrased, or summarized.
H. Demonstrate professional communication in the content and presentation of your submission.
File Restrictions
File name may contain only letters, numbers, spaces, and these symbols: ! – _ . * ‘ ( )
File size limit: 200 MB
File types allowed: doc, docx, rtf, xls, xlsx, ppt, pptx, odt, pdf, csv, txt, qt, mov, mpg, avi, mp3, wav, mp4, wma,
flv, asf, mpeg, wmv, m4v, svg, tif, tiff, jpeg, jpg, gif, png, zip, rar, tar, 7z
RUBRIC
A:INCIDENT DETAILS
NOT EVIDENT
The submission does not identify the details of the incident
by addressing the 12 given
points related to the
“Background Information”
document.
APPROACHING
COMPETENCE
The submission does not accurately address each of the
12 given points related to the
“Background Information”
document, or the details are
not recorded in Section A of
the “Incident Reporting
COMPETENT
The submission accurately
identifies the details of the incident by addressing each of
the 12 given points related to
the “Background Information”
document, and the response is
recorded in Section A of the
“Incident Reporting Template.”
WGU Performance Assessment https://tasks.wgu.edu/student/012511603/course/32680020/…
3 of 6 9/21/25, 15:40
B:DETECT
C:INVESTIGATE
D:REMEDIATE
E:LESSONS LEARNED
Template.”
NOT EVIDENT
The submission does not identify the details of the impacted system by addressing
the 3 given points related to
the Detect phase.
APPROACHING
COMPETENCE
The submission does not accurately address each of the 3
given points related to the
Detect phase, or the details
are not recorded in Section B
of the “Incident Reporting
Template.”
COMPETENT
The submission accurately
identifies the details of the impacted system by addressing
each of the 3 given points related to the Detect phase, and
the response is recorded in
Section B of the “Incident
Reporting Template.”
NOT EVIDENT
The submission does not determine the details of the malicious traffic by identifying
the 2 given points related to
the Investigate phase.
APPROACHING
COMPETENCE
The submission does not accurately address each of the 2
given points related to the
Investigate phase, or the details are not recorded in
Section C of the “Incident
Reporting Template.”
COMPETENT
The submission accurately determines the details of the malicious traffic by identifying
each of the 2 given points related to the Investigate phase,
and the response is recorded in
Section C of the “Incident
Reporting Template.”
NOT EVIDENT
The submission does not summarize the incident remediation process by identifying the
3 given points related to the
Remediate phase.
APPROACHING
COMPETENCE
The submission does not accurately identify each of the 3
given points related to the
Remediate phase, or the details are not recorded in
Section D of the “Incident
Reporting Template.”
COMPETENT
The submission accurately
summarizes the incident remediation process by identifying
each of the 3 given points related to the Remediate phase,
and the response is recorded in
Section D of the “Incident
Reporting Template.”
NOT EVIDENT
The submission does not recommend 2–4 planned actions
to prevent similar incidents
from occurring in the future.
APPROACHING
COMPETENCE
The submission recommends
2–4 planned actions to prevent similar incidents from ocCOMPETENT
The submission recommends
2–4 planned relevant actions
to prevent similar incidents
from occurring in the future,
WGU Performance Assessment https://tasks.wgu.edu/student/012511603/course/32680020/…
4 of 6 9/21/25, 15:40
F:SCREENSHOT EVIDENCE DOCUMENT
G:SOURCES
H:PROFESSIONAL COMMUNICATION
curring in the future, but the
recommended planned actions are not relevant, the 2
points are not addressed for
each planned action, or the
details are not recorded in
Section E of the “Incident
Reporting Template.”
the 2 points are accurately addressed for each planned action, and the response is
recorded in Section E of the
“Incident Reporting Template.”
NOT EVIDENT
The submission does not provide the screenshot evidence
document, in .docx format,
generated by the virtual lab.
APPROACHING
COMPETENCE
The submission provides the
screenshot evidence document, in .docx format, generated by the virtual lab, but the
requested information or unaltered watermark of the student ID is not clearly visible in
the associated screenshot for
each of the 5 challenge questions, the watermark has been
altered, or the student ID is
not accurate.
COMPETENT
The submission accurately provides the screenshot evidence
document, in .docx format,
generated by the virtual lab.
For each of the 5 challenge
questions, both the requested
information and unaltered watermark are clearly visible in
the associated screenshot, and
the student ID is accurate.
NOT EVIDENT
The submission does not include both in-text citations
and a reference list for
sources that are quoted, paraphrased, or summarized.
APPROACHING
COMPETENCE
The submission includes intext citations for sources that
are quoted, paraphrased, or
summarized and a reference
list; however, the citations or
reference list is incomplete or
inaccurate.
COMPETENT
The submission includes intext citations for sources that
are properly quoted, paraphrased, or summarized and a
reference list that accurately
identifies the author, date, title,
and source location as available.
NOT EVIDENT
This submission includes pervasive errors in professional
communication related to
grammar, sentence fluency,
APPROACHING
COMPETENCE
This submission includes substantial errors in professional
communication related to
COMPETENT
This submission includes satisfactory use of grammar, sentence fluency, contextual spelling, and punctuation, which
WGU Performance Assessment https://tasks.wgu.edu/student/012511603/course/32680020/…
5 of 6 9/21/25, 15:40
WEB LINKS
Virtual Lab
SUPPORTING DOCUMENTS
Background Information.pdf
Virtual Lab Supplementary Instructions.pdf
Incident Reporting Template.docx
contextual spelling, or punctuation, negatively impacting
the professional quality and
clarity of the writing. Specific
errors have been identified by
Grammarly for Education under the Correctness category.
grammar, sentence fluency,
contextual spelling, or punctuation. Specific errors have
been identified by Grammarly
for Education under the
Correctness category.
promote accurate interpretation and understanding.