A company experiences a phishing attack that leads to a data breach. After the incident, the company updates its email security filters and provides additional training to employees. What phase of the incident response lifecycle does this represent?

Containment, because the company is limiting the impact.

Recovery, because the company is restoring normal operations.

Eradication, because the company is removing the threat.

Lessons learned, because the company is implementing improvements based on the incident.

How are lessons learned from an incident typically used to improve future incident response?

By increasing the budget for marketing

By ignoring the lessons if the incident was resolved successfully

By updating the incident response plan, procedures, and training based on identified gaps

By keeping the lessons confidential to avoid legal liability

Which factor is most commonly used to determine the severity classification of a security incident?

The time of day the incident occurred

The potential impact on confidentiality, integrity, and availability of systems and data

The number of security tools that detected the incident

The name of the malware family involved

After a phishing incident, the incident response team prepares a report for the board of directors. Which type of information is most appropriate to include in this executive summary?

A high-level overview of the incident's impact and the actions taken

Detailed technical indicators of compromise (IOCs)

The names and contact information of all incident responders

The full chain of custody for all evidence collected

After a security incident, the incident response team must create a report for both technical staff and executive management. What is the BEST approach to meet the needs of both audiences?

Provide the same report to both audiences but omit all technical details

Create a single detailed report with all technical information for both audiences

Create two separate reports: one technical and one executive summary

Only provide a verbal update to executives and a written report to technical staff

EC-CouncilCertified Cybersecurity Technician

Domain 7Objective 1

Incident Response CCT Practice Questions (Page 6)

Part of the Incident Response and Computer Forensics domain, which makes up ~10% of our current practice bank.

50questions here

10free pages

8concepts

Questions 26–30

26expert · hard
A company experiences a phishing attack that leads to a data breach. After the incident, the company updates its email security filters and provides additional training to employees. What phase of the incident response lifecycle does this represent?
Select an answer first
27foundation · easy
How are lessons learned from an incident typically used to improve future incident response?
Select an answer first
28foundation · easy
Which factor is most commonly used to determine the severity classification of a security incident?
Select an answer first
29application · medium
After a phishing incident, the incident response team prepares a report for the board of directors. Which type of information is most appropriate to include in this executive summary?
Select an answer first
30expert · hard
After a security incident, the incident response team must create a report for both technical staff and executive management. What is the BEST approach to meet the needs of both audiences?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.