What is a limitation of using a network protocol analyzer like Wireshark in incident response?

It only analyzes network traffic and does not examine disk or memory

It cannot decrypt encrypted traffic

It is not compatible with Windows systems

It cannot capture network traffic in real time

A manufacturing company discovers that a contractor's laptop, which was used to access the corporate network, may contain evidence of intellectual property theft. The laptop is running and the user is still logged in. The CISO wants to preserve evidence for potential litigation. Which action best balances forensic soundness and legal admissibility?

Copy only the files related to the alleged theft to an external drive to minimize the amount of data collected.

Immediately power off the laptop by holding the power button to prevent any further changes to the disk.

Ask the contractor to log off and then shut down the laptop normally to preserve the file system state.

Perform a live acquisition of volatile memory first, then create a bit-for-bit image of the hard drive using a write-blocker.

What is the purpose of maintaining a chain of custody for digital evidence?

To speed up the forensic analysis process

To prove that the evidence was handled properly and has not been tampered with

To ensure that evidence is stored securely

To identify the perpetrator of the incident

A security analyst is investigating a suspected data breach. The analyst finds unusual outbound network traffic to an IP address in a foreign country. Which forensic technique would BEST help identify the malware responsible?

Memory forensics to analyze running processes and network connections

Log analysis to review firewall logs

Disk forensics to recover deleted files

Network forensics to capture and analyze packet captures

Which activity is part of forensic readiness?

Deleting logs to reduce storage

Conducting forensic analysis on live systems

Developing an incident response plan

Establishing evidence collection procedures

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 5)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 21–25

21foundation · easy
What is a limitation of using a network protocol analyzer like Wireshark in incident response?
Select an answer first
22expert · hard
A manufacturing company discovers that a contractor's laptop, which was used to access the corporate network, may contain evidence of intellectual property theft. The laptop is running and the user is still logged in. The CISO wants to preserve evidence for potential litigation. Which action best balances forensic soundness and legal admissibility?
Select an answer first
23foundation · easy
What is the purpose of maintaining a chain of custody for digital evidence?
Select an answer first
24application · medium
A security analyst is investigating a suspected data breach. The analyst finds unusual outbound network traffic to an IP address in a foreign country. Which forensic technique would BEST help identify the malware responsible?
Select an answer first
25foundation · easy
Which activity is part of forensic readiness?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.