A company has just completed the eradication and recovery phases of a phishing incident that led to unauthorized access to email accounts. The CISO wants to ensure the organization learns from the incident. Which activity is most aligned with the lessons learned phase?

Deleting all incident-related documentation to avoid legal exposure.

Immediately implementing a new security tool without discussing the incident with the team.

Conducting a post-incident review meeting with all stakeholders to discuss what went well and what could be improved.

Praising the team for their quick response and closing the incident without further action.

A forensic examiner is collecting evidence from a company-owned server that is located in a jurisdiction with strict data privacy laws. The evidence may be used in a civil lawsuit. What is the MOST important legal consideration?

Ensuring the evidence is collected in accordance with local privacy laws

Using a forensic tool that is certified by the vendor

Getting the employee's consent to search the server

Obtaining a warrant before collecting evidence

Which method is commonly used to detect security incidents?

Intrusion Detection Systems (IDS)

Why is cross-functional collaboration important in an incident response team?

It ensures that only IT staff are involved in incident handling

It brings diverse expertise to address technical, legal, and communication aspects of an incident

It slows down the response process by adding too many opinions

It eliminates the need for a formal incident response plan

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 2)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 6–10

6application · medium
A company has just completed the eradication and recovery phases of a phishing incident that led to unauthorized access to email accounts. The CISO wants to ensure the organization learns from the incident. Which activity is most aligned with the lessons learned phase?
Select an answer first
7expert · hard
A forensic examiner is collecting evidence from a company-owned server that is located in a jurisdiction with strict data privacy laws. The evidence may be used in a civil lawsuit. What is the MOST important legal consideration?
Select an answer first
8foundation · easy
Which forensic analysis technique is used to examine the contents of a computer's RAM?
Select an answer first
9foundation · easy
Which method is commonly used to detect security incidents?
Select an answer first
10foundation · easy
Why is cross-functional collaboration important in an incident response team?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.