What should be included in the recommendations section of an incident response report?

A summary of the incident response team's performance

Suggestions for improving security controls and processes

A list of employees to discipline

A company wants to ensure that if a security incident occurs, they can quickly collect and preserve evidence without disrupting business operations. Which measure is most effective for achieving forensic readiness?

Pre-deploying forensic tools on all endpoints and training IT staff on their use.

Waiting until an incident occurs to purchase forensic tools and hire an external expert.

Relying on the IT help desk to manually copy files from affected systems during an incident.

Creating a policy that allows employees to continue working on systems that may be involved in an incident.

Which activity is typically part of a lessons learned session?

Ignoring feedback from team members

Reviewing what went well and what could be improved

Repeating the same processes without changes

A retail company wants to improve its ability to investigate security incidents without disrupting operations. The CISO decides to implement forensic readiness. Which initiative best exemplifies forensic readiness?

Conducting a tabletop exercise that simulates a ransomware attack but does not involve the legal department.

Purchasing a commercial forensic tool and training one analyst on its use.

Creating a response plan that focuses only on containment and eradication, with no mention of evidence preservation.

Establishing a policy that requires all systems to have centralized logging enabled and logs retained for a defined period.

A regional hospital's IT security team detects a ransomware outbreak that has encrypted files on the finance department's file server. The malware appears to be spreading to other departments. The hospital's incident response plan designates the CISO as the incident commander. What should the CISO do FIRST?

Notify law enforcement and begin collecting evidence from the affected server

Declare an incident, activate the incident response team, and classify the incident based on impact and urgency

Immediately power off the finance file server to preserve evidence for forensic analysis

Isolate the finance file server from the network and begin eradication of the malware

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 11)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 51–55

51foundation · easy
What should be included in the recommendations section of an incident response report?
Select an answer first
52application · medium
A company wants to ensure that if a security incident occurs, they can quickly collect and preserve evidence without disrupting business operations. Which measure is most effective for achieving forensic readiness?
Select an answer first
53foundation · easy
Which activity is typically part of a lessons learned session?
Select an answer first
54application · medium
A retail company wants to improve its ability to investigate security incidents without disrupting operations. The CISO decides to implement forensic readiness. Which initiative best exemplifies forensic readiness?
Select an answer first
55application · medium
A regional hospital's IT security team detects a ransomware outbreak that has encrypted files on the finance department's file server. The malware appears to be spreading to other departments. The hospital's incident response plan designates the CISO as the incident commander. What should the CISO do FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.