After completing a forensic investigation, an incident responder must write a report for both technical staff and executive management. What is the most important consideration when writing the report?

Focus only on the business impact and financial losses

Avoid mentioning any mistakes made during the incident response

Provide a clear executive summary with key findings and recommendations, while including technical details in appendices

Include a detailed technical analysis of the malware and the attack vector

A network defender is analyzing a packet capture from a suspected intrusion. The capture shows a series of TCP SYN packets to a single host on multiple ports, followed by RST responses. What does this pattern most likely indicate?

Normal network traffic from a misconfigured application.

A port scan reconnaissance activity.

A malware beaconing to a command-and-control server.

A denial-of-service attack flooding the host with traffic.

Who is the primary audience for a forensic report?

Only the incident response team

Stakeholders such as management, legal, and law enforcement

A company has confirmed a ransomware infection on several servers. The incident response team has contained the spread by isolating the affected network segment. What should be the next step in the incident response lifecycle?

Notify law enforcement and wait for their instructions before proceeding.

Eradicate the threat by removing malware and restoring systems from clean backups.

Conduct a lessons-learned review before any further action.

Immediately reconnect the segment to resume business operations.

What is the purpose of running malware in a sandbox during dynamic analysis?

To permanently delete the malware

To observe its behavior without risking the host system

To speed up the analysis process

EC-CouncilCertified Network Defender

Domain 6Objective 1

Incident Response and Forensics Investigation CND Practice Questions (Page 13)

Part of the Incident Response, Forensics and Continuity domain, which makes up ~13% of our current practice bank.

66questions here

14free pages

15concepts

15 Concepts in This Objective

Incident Response Fundamentals
Incident Response Phases
Incident Response Team Roles
Incident Classification and Triage
Evidence Collection and Preservation
Forensic Imaging and Duplication
Forensic Analysis Techniques
Log Analysis and Correlation
Memory and Volatile Data Analysis
Network Forensics
Malware Analysis Basics
Forensic Reporting and Documentation
Legal and Ethical Considerations
Incident Recovery and Remediation
Lessons Learned and Post-Incident Review

Questions 61–65

61application · medium
After completing a forensic investigation, an incident responder must write a report for both technical staff and executive management. What is the most important consideration when writing the report?
Select an answer first
62application · easy
A network defender is analyzing a packet capture from a suspected intrusion. The capture shows a series of TCP SYN packets to a single host on multiple ports, followed by RST responses. What does this pattern most likely indicate?
Select an answer first
63foundation · easy
Who is the primary audience for a forensic report?
Select an answer first
64application · easy
A company has confirmed a ransomware infection on several servers. The incident response team has contained the spread by isolating the affected network segment. What should be the next step in the incident response lifecycle?
Select an answer first
65foundation · easy
What is the purpose of running malware in a sandbox during dynamic analysis?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.