During a ransomware incident, a company's file servers are encrypted, and the malware is spreading to other systems. The incident response team needs to contain the outbreak while preserving evidence for law enforcement. Which action should be taken first?

Disconnect the company's internet connection to stop external communication.

Isolate the infected systems from the network at the switch level, but do not power them off.

Power off all infected systems immediately to stop the encryption.

Reboot the infected systems to clear the malware from memory.

EC-CouncilCertified Chief Information Security Officer

Domain 4Objective 3

Network Security CCISO Practice Questions (Page 2)

Part of the Information Security Core Competencies domain, which makes up ~33% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~20–33 in this domain), expect 3–4 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

10concepts

Questions 6–10

6application · medium
A security analyst is investigating a potential data exfiltration incident. The analyst observes that an internal server is sending large amounts of data to an external IP address using a protocol that does not guarantee delivery and has no handshake. Which protocol is the analyst most likely observing?
Select an answer first
7foundation · easy
What is the first step in an incident response procedure?
Select an answer first
8foundation · easy
Which technology creates a secure, encrypted tunnel over an untrusted network such as the internet?
Select an answer first
9expert · hard
During a ransomware incident, a company's file servers are encrypted, and the malware is spreading to other systems. The incident response team needs to contain the outbreak while preserving evidence for law enforcement. Which action should be taken first?
Select an answer first
10foundation · easy
Which layer of the OSI model is responsible for routing packets across different networks and determining the best path for data transmission?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.

Network Security CCISO Practice Questions (Page 2)

Questions 6–10

What is the first step in an incident response procedure?

Which technology creates a secure, encrypted tunnel over an untrusted network such as the internet?

During a ransomware incident, a company's file servers are encrypted, and the malware is spreading to other systems. The incident response team needs to contain the outbreak while preserving evidence for law enforcement. Which action should be taken first?

Which layer of the OSI model is responsible for routing packets across different networks and determining the best path for data transmission?

Keep studying — Information Security Core Competencies