During a malware investigation, an incident responder needs to collect evidence from a running Windows server without losing volatile data. Which action is MOST appropriate?

Run a network capture to collect all traffic before touching the disk

Perform a memory dump first, then capture disk images

Power off the server immediately to prevent further changes

Copy the entire hard drive using a standard file copy command

A company has just completed a post-incident review of a data breach. The review identified that the incident response team lacked clear communication channels with the legal department. What is the most appropriate action to address this finding?

Update the incident response plan to include defined communication protocols with legal and other stakeholders.

Document the finding in the final report and take no further action.

Conduct another review to gather more data before making any changes.

Replace the incident response team lead with someone who has legal experience.

Which factor is most important when determining the urgency of an incident response?

The potential for rapid spread or further damage

The cost of the incident response

The time of day the incident occurred

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 4)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 16–20

16application · medium
During a malware investigation, an incident responder needs to collect evidence from a running Windows server without losing volatile data. Which action is MOST appropriate?
Select an answer first
17application · medium
A company has just completed a post-incident review of a data breach. The review identified that the incident response team lacked clear communication channels with the legal department. What is the most appropriate action to address this finding?
Select an answer first
18foundation · easy
Which tool is commonly used for disk imaging and forensic analysis?
Select an answer first
19foundation · easy
Which factor is most important when determining the urgency of an incident response?
Select an answer first
20application · medium
A forensic investigator needs to analyze a memory dump from a compromised server to identify a rootkit. Which tool is BEST suited for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Computer Forensics and Incident Response CCISO Practice Questions (Page 4)

Questions 16–20

During a malware investigation, an incident responder needs to collect evidence from a running Windows server without losing volatile data. Which action is MOST appropriate?

A company has just completed a post-incident review of a data breach. The review identified that the incident response team lacked clear communication channels with the legal department. What is the most appropriate action to address this finding?

Which tool is commonly used for disk imaging and forensic analysis?

Which factor is most important when determining the urgency of an incident response?

A forensic investigator needs to analyze a memory dump from a compromised server to identify a rootkit. Which tool is BEST suited for this task?

Keep studying — Information Security Core Competencies