A SOC analyst must communicate the findings of a post-incident analysis to the legal department, which is concerned about regulatory compliance. Which information is most important to include?

The types of data involved, the number of affected individuals, and the timeline of notification to authorities

The cost of the incident response effort

The exact malware hash values and the command-and-control IP addresses

The names of the SOC analysts who handled the incident

A SOC analyst is writing an incident report for a multi-stage attack. The report must be useful for both the executive team and the incident responders who will review the response. The analyst has limited time. Which section is most critical to include to ensure the report is actionable for both audiences?

A summary of the attacker's motivation and skill level

A list of all the tools used during the incident response

A detailed list of every command run by the responders during the investigation

A prioritized list of recommendations with assigned owners and target dates

When communicating post-incident findings to senior management, what is the most important consideration?

Include every technical detail and raw log entry to ensure transparency

Focus exclusively on the technical root cause and exploit chain

Avoid mentioning any failures to prevent negative reactions

Provide a high-level summary of impact, actions taken, and recommended investments

After a data breach, the SOC team identified that the incident was prolonged because analysts lacked a clear escalation path. The team lead wants to ensure this does not recur. Which action best integrates this lesson into the organization?

Hold a one-time meeting to discuss the incident and then move on.

Add the escalation path to the post-incident report and archive the report.

Replace the SOC team lead to avoid similar mistakes in the future.

Update the incident response plan to include a documented escalation matrix and train analysts on it.

A SOC analyst is writing the final incident report for a ransomware event. The report must be useful to both the CISO and the IT operations team. Which structure best serves both audiences?

Executive summary, detailed timeline, technical evidence, actions taken, and prioritized recommendations.

A single chronological narrative of every event, with no separate summary or recommendations.

A list of all compromised hosts and the malware hashes, with no narrative or recommendations.

Technical log excerpts only, with a short note that the full report is available on request.

EC-CouncilSOC Essentials

Domain 8Objective 4

Post-Incident Analysis and Reporting SCE Practice Questions (Page 5)

Part of the Incident Response and Handling domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 2–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

6concepts

Questions 21–25

21application · medium
A SOC analyst must communicate the findings of a post-incident analysis to the legal department, which is concerned about regulatory compliance. Which information is most important to include?
Select an answer first
22expert · hard
A SOC analyst is writing an incident report for a multi-stage attack. The report must be useful for both the executive team and the incident responders who will review the response. The analyst has limited time. Which section is most critical to include to ensure the report is actionable for both audiences?
Select an answer first
23foundation · easy
When communicating post-incident findings to senior management, what is the most important consideration?
Select an answer first
24application · medium
After a data breach, the SOC team identified that the incident was prolonged because analysts lacked a clear escalation path. The team lead wants to ensure this does not recur. Which action best integrates this lesson into the organization?
Select an answer first
25application · medium
A SOC analyst is writing the final incident report for a ransomware event. The report must be useful to both the CISO and the IT operations team. Which structure best serves both audiences?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.