A mid-sized company has a security operations center (SOC) that monitors alerts. The SOC receives an alert about a potential malware infection on a user's workstation. The alert is low severity, but the SOC analyst is unsure if it is a false positive. What should the analyst do NEXT?

Investigate the alert by checking the workstation's logs and processes

Escalate the alert to the incident response team immediately

Report the alert to the CISO and wait for instructions

Ignore the alert because it is low severity

After a security incident, the incident response team is writing a report for the CISO. The report should include the timeline of the incident, the actions taken, and the recommendations. What is the primary purpose of this report?

To provide a detailed technical analysis of the malware used in the attack.

To document the incident for legal purposes and potential litigation.

To communicate the incident's impact, response efforts, and recommendations to stakeholders.

To assign blame to individuals who may have caused the incident.

A company's SOC detects a potential data breach involving customer data. The incident response plan requires reporting to stakeholders. Which of the following are appropriate reporting actions? Select all that apply.

Notify the data protection officer (DPO) immediately

Inform law enforcement if criminal activity is suspected

Communicate with affected customers only after the investigation is complete

Wait until the investigation is complete before reporting to any stakeholders

Report to the board of directors only if the breach is material

A company is developing its information security program and wants to ensure that incident response is integrated. The CISO needs to define the role of incident response within the overall program. Which statement BEST describes this role?

Incident response is primarily a legal function to ensure compliance

Incident response is the process of detecting, responding to, and recovering from security incidents, and it supports the overall security program by minimizing damage

Incident response is only activated after a breach is confirmed

Incident response is a standalone process that operates independently of other security functions

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 8

Computer Forensics and Incident Response CCISO Practice Questions (Page 8)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 60 practice questions to prepare you well beyond it. (estimate)

60questions here

12free pages

13concepts

13 Concepts in This Objective

Incident Response Fundamentals
Incident Response Lifecycle
Incident Response Team Structure
Incident Classification and Prioritization
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Forensic Readiness
Digital Evidence Collection and Preservation
Forensic Analysis Techniques
Chain of Custody and Legal Considerations
Forensic Tools and Technologies
Reporting and Documentation
Post-Incident Activities and Lessons Learned

Questions 36–40

36foundation · easy
Which role is typically responsible for coordinating the overall response effort and making final decisions during an incident?
Select an answer first
37application · medium
A mid-sized company has a security operations center (SOC) that monitors alerts. The SOC receives an alert about a potential malware infection on a user's workstation. The alert is low severity, but the SOC analyst is unsure if it is a false positive. What should the analyst do NEXT?
Select an answer first
38application · medium
After a security incident, the incident response team is writing a report for the CISO. The report should include the timeline of the incident, the actions taken, and the recommendations. What is the primary purpose of this report?
Select an answer first
39expert · hard · select all that apply
A company's SOC detects a potential data breach involving customer data. The incident response plan requires reporting to stakeholders. Which of the following are appropriate reporting actions? Select all that apply.
Select an answer first
40application · medium
A company is developing its information security program and wants to ensure that incident response is integrated. The CISO needs to define the role of incident response within the overall program. Which statement BEST describes this role?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.