A security analyst is investigating a potential advanced persistent threat (APT) that has been dormant in the network for months. The analyst has network logs but no endpoint data. Which forensic technique would be MOST effective to identify the APT's activities?

Memory forensics on a sample of endpoints

Disk forensics on a sample of endpoints

Log analysis of firewall and proxy logs

Network forensics to analyze historical traffic patterns

A healthcare organization is updating its incident response plan. The CISO wants to ensure that during a major security incident, the response team can quickly make decisions about system isolation, communicate with regulators, and coordinate with legal counsel. Which team structure best supports these needs?

A single incident commander with authority to make all decisions, supported by specialized teams for technical response, legal, and communications.

A team composed only of IT security staff, with legal and communications consulted only after the technical response is complete.

A flat team where all members have equal authority and vote on major decisions to ensure consensus.

An external incident response firm that takes over all decision-making, with internal staff only providing access to systems.

An incident response team needs to acquire a forensic image of a laptop's hard drive without altering the original evidence. Which tool or technology should they use?

A network-based acquisition tool that copies files over the network.

A hardware write-blocker connected between the suspect drive and the forensic workstation.

A standard USB adapter to connect the drive directly to the forensic workstation.

A software tool that mounts the drive in read-only mode.

A company is forming an incident response team. The CISO must decide on the team structure. The company has a small IT staff and limited budget. Which structure is MOST appropriate?

A distributed team with each department handling its own incidents

A centralized team with dedicated incident response staff

A virtual team with members from IT, legal, and communications who are trained for incident response

Outsourcing all incident response to a third-party provider

An incident responder is writing the final report for a data breach investigation. The report will be reviewed by the legal department and senior management. Which element is MOST important to include?

A timeline of events and actions taken

A clear summary of findings, actions taken, and recommendations

The names of all employees involved in the incident

A detailed list of all forensic tools used

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 12)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 56–60

56expert · hard
A security analyst is investigating a potential advanced persistent threat (APT) that has been dormant in the network for months. The analyst has network logs but no endpoint data. Which forensic technique would be MOST effective to identify the APT's activities?
Select an answer first
57application · medium
A healthcare organization is updating its incident response plan. The CISO wants to ensure that during a major security incident, the response team can quickly make decisions about system isolation, communicate with regulators, and coordinate with legal counsel. Which team structure best supports these needs?
Select an answer first
58application · medium
An incident response team needs to acquire a forensic image of a laptop's hard drive without altering the original evidence. Which tool or technology should they use?
Select an answer first
59expert · hard
A company is forming an incident response team. The CISO must decide on the team structure. The company has a small IT staff and limited budget. Which structure is MOST appropriate?
Select an answer first
60application · medium
An incident responder is writing the final report for a data breach investigation. The report will be reviewed by the legal department and senior management. Which element is MOST important to include?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.