A financial services firm detects a sophisticated attacker who has established persistence on several domain controllers. The attacker is actively exfiltrating data. The CISO must choose a containment strategy that minimizes further data loss while preserving evidence for investigation. Which approach is most appropriate?

Immediately disconnect the domain controllers from the network and then begin forensic imaging.

Allow the attacker to continue operating while passively monitoring to gather more intelligence before containing.

Shut down the entire network to stop all communication, then investigate at a later time.

Use network segmentation to isolate the affected systems from the rest of the network while maintaining visibility and collecting forensic data.

Which action is part of the eradication phase?

Removing malware from affected systems

Conducting a lessons learned review

Disconnecting affected systems from the network

A financial services firm wants to improve its ability to investigate insider threats. The CISO proposes a forensic readiness program. Which initiative is MOST aligned with forensic readiness?

Purchasing a commercial forensic analysis tool for the incident response team

Conducting a tabletop exercise of the incident response plan

Creating a policy that requires employees to report suspicious activity

Implementing centralized logging and ensuring logs are retained for a defined period

Who should be notified first when a potential security incident is detected?

The public relations department

A company is prosecuting a former employee for data theft. The forensic examiner collected evidence from the employee's laptop. During the trial, the defense attorney challenges the authenticity of the evidence. What is the MOST critical factor to establish?

The employee signed a consent form for the laptop search

The evidence was hashed and the chain of custody was documented

The evidence was collected within 24 hours of the incident

The forensic examiner used a widely accepted tool

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 1)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 1–5

1expert · hard
A financial services firm detects a sophisticated attacker who has established persistence on several domain controllers. The attacker is actively exfiltrating data. The CISO must choose a containment strategy that minimizes further data loss while preserving evidence for investigation. Which approach is most appropriate?
Select an answer first
2foundation · easy
Which action is part of the eradication phase?
Select an answer first
3application · medium
A financial services firm wants to improve its ability to investigate insider threats. The CISO proposes a forensic readiness program. Which initiative is MOST aligned with forensic readiness?
Select an answer first
4foundation · easy
Who should be notified first when a potential security incident is detected?
Select an answer first
5application · medium
A company is prosecuting a former employee for data theft. The forensic examiner collected evidence from the employee's laptop. During the trial, the defense attorney challenges the authenticity of the evidence. What is the MOST critical factor to establish?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.