After a phishing attack that led to a data breach, the incident response team completes the recovery and eradication phases. The team is now conducting a post-incident review. Which outcome is the PRIMARY goal of this review?

Identify weaknesses in the incident response process and implement improvements

Assign blame to the individuals who caused the incident

Determine the financial cost of the incident for insurance claims

Delete all logs and evidence related to the incident to free up storage

What should a forensic report include to be considered comprehensive?

Findings, methodologies, and conclusions

The suspect's personal information

A malware analyst has a suspicious executable file. To understand its behavior without executing it, which technique should be used first?

Static analysis, such as examining file metadata, strings, and imports.

Dynamic analysis in a sandbox to observe runtime behavior.

Memory analysis of the running process.

Network traffic analysis to see what domains the malware contacts.

Why is log correlation important in incident investigation?

It automatically blocks malicious IP addresses

It reduces the storage space required for logs

It helps identify patterns and relationships across multiple log sources

It encrypts log files to protect them from tampering

A hospital's IT team detects a ransomware outbreak on the administrative network. The clinical network, which supports patient monitoring, is separate but shares a firewall. The ransomware appears to be spreading slowly. The hospital must maintain patient safety while responding. What is the best immediate action?

Wait for law enforcement to arrive before taking any action.

Isolate the administrative network from the clinical network at the firewall, then begin containment on affected systems.

Shut down the entire network to stop the ransomware, including clinical systems.

Immediately power off all administrative servers to contain the outbreak.

EC-CouncilCertified Network Defender

Domain 6Objective 1

Incident Response and Forensics Investigation CND Practice Questions (Page 7)

Part of the Incident Response, Forensics and Continuity domain, which makes up ~13% of our current practice bank.

66questions here

14free pages

15concepts

15 Concepts in This Objective

Incident Response Fundamentals
Incident Response Phases
Incident Response Team Roles
Incident Classification and Triage
Evidence Collection and Preservation
Forensic Imaging and Duplication
Forensic Analysis Techniques
Log Analysis and Correlation
Memory and Volatile Data Analysis
Network Forensics
Malware Analysis Basics
Forensic Reporting and Documentation
Legal and Ethical Considerations
Incident Recovery and Remediation
Lessons Learned and Post-Incident Review

Questions 31–35

31application · medium
After a phishing attack that led to a data breach, the incident response team completes the recovery and eradication phases. The team is now conducting a post-incident review. Which outcome is the PRIMARY goal of this review?
Select an answer first
32foundation · easy
What should a forensic report include to be considered comprehensive?
Select an answer first
33application · easy
A malware analyst has a suspicious executable file. To understand its behavior without executing it, which technique should be used first?
Select an answer first
34foundation · easy
Why is log correlation important in incident investigation?
Select an answer first
35expert · hard
A hospital's IT team detects a ransomware outbreak on the administrative network. The clinical network, which supports patient monitoring, is separate but shares a firewall. The ransomware appears to be spreading slowly. The hospital must maintain patient safety while responding. What is the best immediate action?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.