Which legal consideration is most important when handling digital evidence?

Deleting evidence after analysis to protect the organization

Ensuring evidence is collected in accordance with applicable laws and regulations

Collecting evidence as quickly as possible, even if it violates privacy

Sharing evidence with the public to ensure transparency

A large e-commerce company experiences a distributed denial-of-service (DDoS) attack that is affecting customer transactions. The incident response team is activated. Which team role is PRIMARILY responsible for communicating with external stakeholders such as customers and regulatory bodies?

Public relations / communications lead

What is the primary purpose of a post-incident review?

To identify lessons learned and improve the incident response process

To delete all evidence related to the incident

To close the incident without further action

To assign blame to individuals involved

A manufacturing company discovers that a disgruntled employee exfiltrated sensitive design documents to a personal cloud storage account before resigning. The employee's laptop has been collected, and the company wants to prevent further data loss while preserving evidence. The CISO must decide on a containment strategy. Which action BEST balances containment and evidence preservation?

Contact the cloud provider to delete the exfiltrated files immediately

Immediately revoke the employee's cloud access and disable their corporate account

Clone the laptop's hard drive and then revoke the employee's access to corporate resources

Wipe the laptop to ensure no further data can be accessed from it

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 3)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 11–15

11foundation · easy
Which legal consideration is most important when handling digital evidence?
Select an answer first
12foundation · easy
Which phase of the incident response lifecycle involves restoring affected systems to normal operation?
Select an answer first
13application · medium
A large e-commerce company experiences a distributed denial-of-service (DDoS) attack that is affecting customer transactions. The incident response team is activated. Which team role is PRIMARILY responsible for communicating with external stakeholders such as customers and regulatory bodies?
Select an answer first
14foundation · easy
What is the primary purpose of a post-incident review?
Select an answer first
15application · medium
A manufacturing company discovers that a disgruntled employee exfiltrated sensitive design documents to a personal cloud storage account before resigning. The employee's laptop has been collected, and the company wants to prevent further data loss while preserving evidence. The CISO must decide on a containment strategy. Which action BEST balances containment and evidence preservation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Computer Forensics and Incident Response CCISO Practice Questions (Page 3)

Questions 11–15

Which legal consideration is most important when handling digital evidence?

Which phase of the incident response lifecycle involves restoring affected systems to normal operation?

A large e-commerce company experiences a distributed denial-of-service (DDoS) attack that is affecting customer transactions. The incident response team is activated. Which team role is PRIMARILY responsible for communicating with external stakeholders such as customers and regulatory bodies?

What is the primary purpose of a post-incident review?

Keep studying — Information Security Core Competencies