A regional bank's security operations center detects a ransomware outbreak on a file server that hosts non-critical marketing data. The same alerting system also flags a separate, unconfirmed phishing email that was opened by one user in finance. The CISO must decide how to allocate the incident response team's immediate effort. Which approach best aligns with incident classification and prioritization principles?

Focus on the phishing email first because it involves a user in finance, which is a higher-risk department than marketing.

Isolate the file server but defer any investigation of the phishing email until the ransomware is fully eradicated.

Prioritize the ransomware outbreak as high severity and contain it first, while triaging the phishing email as lower priority for follow-up.

Treat both alerts as equal priority because both involve potential compromise and require the same level of response.

A law firm is investigating a data breach that may lead to litigation. The forensic team has collected evidence from several workstations and a server. The CISO wants to ensure the evidence is admissible in court. Which practice is most critical to maintain the chain of custody?

Documenting every person who handled the evidence, the date and time of each transfer, and the purpose of the transfer.

Creating a single forensic image of each device and then working only on copies.

Using only commercial forensic tools that are widely accepted in the industry.

Storing all evidence in a locked cabinet with access limited to the forensic team.

A forensic analyst is investigating a suspected data exfiltration. The analyst has a memory dump from the compromised server and a network packet capture from the same time period. Which combination of analysis techniques would be most effective in identifying the data that was exfiltrated?

Memory analysis alone, because it contains all the information needed.

Memory analysis to identify the process responsible for the exfiltration, and network analysis to trace the data flow to an external destination.

Disk analysis to find deleted files, and log analysis to review user activity.

Network analysis alone, because it shows the data that was sent.

During a ransomware incident, the incident response team has identified the affected systems and the ransomware variant. The CISO must decide between paying the ransom or restoring from backups. Which factor should most influence the decision?

The cost of the ransom compared to the cost of restoring from backups.

The availability and integrity of recent backups that are known to be free of the ransomware.

The time it will take to restore from backups versus the time to pay and receive the decryption key.

The reputation of the ransomware group and their history of providing decryption keys after payment.

What is the primary principle of digital evidence collection?

To use the most advanced tools available

To collect as much data as possible, regardless of relevance

To collect evidence quickly without documentation

To preserve the integrity of the evidence

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 10)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 46–50

46application · medium
A regional bank's security operations center detects a ransomware outbreak on a file server that hosts non-critical marketing data. The same alerting system also flags a separate, unconfirmed phishing email that was opened by one user in finance. The CISO must decide how to allocate the incident response team's immediate effort. Which approach best aligns with incident classification and prioritization principles?
Select an answer first
47expert · hard
A law firm is investigating a data breach that may lead to litigation. The forensic team has collected evidence from several workstations and a server. The CISO wants to ensure the evidence is admissible in court. Which practice is most critical to maintain the chain of custody?
Select an answer first
48application · medium
A forensic analyst is investigating a suspected data exfiltration. The analyst has a memory dump from the compromised server and a network packet capture from the same time period. Which combination of analysis techniques would be most effective in identifying the data that was exfiltrated?
Select an answer first
49expert · hard
During a ransomware incident, the incident response team has identified the affected systems and the ransomware variant. The CISO must decide between paying the ransom or restoring from backups. Which factor should most influence the decision?
Select an answer first
50foundation · easy
What is the primary principle of digital evidence collection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.