What is the primary purpose of classifying incidents by severity, impact, and urgency?

To assign blame to responsible parties

To allocate appropriate resources and prioritize response efforts

To determine which incidents to ignore

To satisfy regulatory requirements only

After a major incident, the incident response team conducts a lessons-learned review. The team identifies that the response was delayed because the on-call analyst did not have access to the necessary tools. What is the MOST effective improvement to implement?

Conduct more frequent tabletop exercises

Create a new incident response procedure

Increase the number of on-call analysts

Provide the on-call analyst with pre-configured forensic workstations

During an incident investigation, a forensic analyst finds that a compromised server has a suspicious process running that is not present in the baseline. The analyst needs to determine if this process is malicious and what it might be doing. Which forensic analysis technique is most appropriate for this immediate question?

Disk forensics to search for deleted files related to the process.

Log analysis to review system event logs for process creation events.

Memory analysis to examine the process's memory space, loaded modules, and network connections.

Network forensics to analyze historical packet captures for any traffic from the server.

A user reports receiving a suspicious email with an attachment that they did not open. The security team needs to determine if this is a security incident and how to respond. What is the most appropriate first step?

Ignore the report because the user did not open the attachment, so there is no risk.

Escalate the report directly to law enforcement without any internal analysis.

Treat it as a confirmed incident and immediately isolate the user's workstation.

Triage the report by collecting the email details and analyzing the attachment in a sandbox to determine if it is malicious.

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 7)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 31–35

31foundation · easy
What is the primary purpose of classifying incidents by severity, impact, and urgency?
Select an answer first
32foundation · easy
In which phase of the incident response lifecycle does the team focus on removing the root cause of the incident from affected systems?
Select an answer first
33expert · hard
After a major incident, the incident response team conducts a lessons-learned review. The team identifies that the response was delayed because the on-call analyst did not have access to the necessary tools. What is the MOST effective improvement to implement?
Select an answer first
34application · medium
During an incident investigation, a forensic analyst finds that a compromised server has a suspicious process running that is not present in the baseline. The analyst needs to determine if this process is malicious and what it might be doing. Which forensic analysis technique is most appropriate for this immediate question?
Select an answer first
35application · medium
A user reports receiving a suspicious email with an attachment that they did not open. The security team needs to determine if this is a security incident and how to respond. What is the most appropriate first step?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Computer Forensics and Incident Response CCISO Practice Questions (Page 7)

Questions 31–35

What is the primary purpose of classifying incidents by severity, impact, and urgency?

In which phase of the incident response lifecycle does the team focus on removing the root cause of the incident from affected systems?

After a major incident, the incident response team conducts a lessons-learned review. The team identifies that the response was delayed because the on-call analyst did not have access to the necessary tools. What is the MOST effective improvement to implement?

A user reports receiving a suspicious email with an attachment that they did not open. The security team needs to determine if this is a security incident and how to respond. What is the most appropriate first step?

Keep studying — Information Security Core Competencies