A forensic investigator is collecting evidence from a compromised server. The investigator needs to preserve the evidence for court, but the server is still running and may contain volatile data. What is the BEST approach?

Copy all files from the server to an external drive.

Create a forensic image of the disk first, then capture volatile data.

Power off the server immediately to preserve the disk.

Capture volatile data first, then create a forensic image of the disk.

What is the primary purpose of incident response in cybersecurity?

To replace the need for security monitoring and detection tools

To prevent all security incidents from occurring

To assign blame to individuals responsible for a security breach

To detect and respond to security incidents in a structured way to minimize damage and recover quickly

After a major incident, the incident response team conducts a lessons-learned review. The team identifies that the response was delayed because the on-call responder did not have the necessary access credentials. What is the MOST effective improvement to implement?

Require all responders to use their personal accounts for faster access.

Increase the number of on-call responders.

Document the incident in the report and move on.

Implement a credential management process that ensures on-call responders have pre-approved access.

Following a phishing campaign that compromised several user accounts, the incident response team completes the recovery phase. Which action is MOST important to include in the lessons-learned phase?

Update the incident response plan based on what was learned

Increase the frequency of password changes for all users

Disable the compromised accounts permanently

Delete all phishing emails from user mailboxes

EC-CouncilCertified Cybersecurity Technician

Domain 7Objective 1

Incident Response CCT Practice Questions (Page 8)

Part of the Incident Response and Computer Forensics domain, which makes up ~10% of our current practice bank.

50questions here

10free pages

8concepts

Questions 36–40

36foundation · easy
Which role in an incident response team is responsible for making final decisions about response strategy and resource allocation?
Select an answer first
37expert · hard
A forensic investigator is collecting evidence from a compromised server. The investigator needs to preserve the evidence for court, but the server is still running and may contain volatile data. What is the BEST approach?
Select an answer first
38foundation · easy
What is the primary purpose of incident response in cybersecurity?
Select an answer first
39expert · hard
After a major incident, the incident response team conducts a lessons-learned review. The team identifies that the response was delayed because the on-call responder did not have the necessary access credentials. What is the MOST effective improvement to implement?
Select an answer first
40expert · hard
Following a phishing campaign that compromised several user accounts, the incident response team completes the recovery phase. Which action is MOST important to include in the lessons-learned phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.