What is the primary goal of containment strategies during an incident?

To permanently delete all affected data

To identify the root cause immediately

To restore systems to normal operation

To limit the scope and impact of the incident

A company's incident response team is in the containment phase of a ransomware attack. They have isolated the affected systems, but the ransomware is still spreading to other parts of the network. The CISO must decide whether to continue containment or move to eradication. What is the best course of action?

Move to eradication immediately to remove the ransomware from the affected systems.

Declare the incident over because the affected systems are isolated.

Continue containment until the spread is stopped, then begin eradication on all affected systems.

Skip containment and go directly to recovery by restoring from backups.

What is a key component of a comprehensive incident response report?

The personal opinions of the incident responders

The source code of affected applications

Which procedure is essential for preserving digital evidence?

Making a bit-for-bit copy of the original media

Booting the system to examine files

Deleting temporary files to free space

Installing forensic tools on the original system

A global company's SOC detects two incidents simultaneously: (1) a ransomware infection on a single file server in a branch office, and (2) a phishing campaign targeting the CEO's email account. The CISO must prioritize the response. Which incident should be handled FIRST?

The ransomware infection because it involves data encryption

The phishing campaign because it targets the CEO and could lead to a larger breach

Both incidents simultaneously with equal resources

The ransomware infection because it is more visible and disruptive

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 6)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 26–30

26foundation · easy
What is the primary goal of containment strategies during an incident?
Select an answer first
27expert · hard
A company's incident response team is in the containment phase of a ransomware attack. They have isolated the affected systems, but the ransomware is still spreading to other parts of the network. The CISO must decide whether to continue containment or move to eradication. What is the best course of action?
Select an answer first
28foundation · easy
What is a key component of a comprehensive incident response report?
Select an answer first
29foundation · easy
Which procedure is essential for preserving digital evidence?
Select an answer first
30expert · hard
A global company's SOC detects two incidents simultaneously: (1) a ransomware infection on a single file server in a branch office, and (2) a phishing campaign targeting the CEO's email account. The CISO must prioritize the response. Which incident should be handled FIRST?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.