During a post-incident review, the SOC team identifies that the incident response plan lacked a clear procedure for preserving evidence. The team wants to document this lesson. What is the most appropriate way to document this finding?

Adding a note to the incident ticket that says 'evidence was not preserved properly'

Discussing the issue informally with the team and agreeing to 'do better next time'

Writing a lessons-learned entry that describes the gap, the impact on the investigation, and a recommendation to add an evidence-preservation procedure to the plan

Ignoring the issue because the incident is already closed

A SOC team is using a fishbone diagram to analyze a security incident where an insider threat exfiltrated data. The team has identified several potential causes. Which cause category is most likely to reveal a systemic issue that can be addressed through policy changes?

A lack of a data-loss-prevention (DLP) policy that defines what data is sensitive and how it should be handled

The specific software vulnerability that allowed the insider to access the data

The insider's personal financial problems, which motivated the exfiltration

The fact that the insider was a contractor, not a full-time employee

A lessons-learned review of a phishing incident found that users frequently failed to report suspicious emails. The SOC team wants to integrate this lesson into the organization's security program. Which action best achieves this?

Send a one-time email reminder to all employees about phishing.

Add the lesson to the incident report and close the case.

Disable email links for all users to prevent phishing.

Update the security awareness training to include a module on recognizing and reporting phishing attempts.

After a phishing incident, the SOC team identifies that users were not recognizing suspicious email URLs. The team wants to integrate this lesson into the organization's security awareness program. Which action is most effective?

Sending a one-time email to all employees warning them to be careful with links

Blocking all URLs in incoming emails at the gateway

Adding the phishing email to the SOC's internal knowledge base without updating training materials

Updating the security awareness training curriculum to include a module on URL inspection and conducting a simulated phishing campaign to reinforce the lesson

A SOC analyst must write an incident report for a cross-border data breach involving customers in multiple jurisdictions. The report will be reviewed by legal counsel, the CISO, and the IT team. The analyst must balance completeness with the need to avoid legal exposure. Which approach is most appropriate?

Include speculative statements about the attacker's identity and motives.

Write the report only for legal counsel and exclude other stakeholders.

Write a factual report with a clear timeline, evidence, and recommendations, and include a separate legal appendix for counsel.

Omit all technical details to minimize legal exposure.

EC-CouncilSOC Essentials

Domain 8Objective 4

Post-Incident Analysis and Reporting SCE Practice Questions (Page 9)

Part of the Incident Response and Handling domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 2–2 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

6concepts

Questions 41–45

41application · medium
During a post-incident review, the SOC team identifies that the incident response plan lacked a clear procedure for preserving evidence. The team wants to document this lesson. What is the most appropriate way to document this finding?
Select an answer first
42expert · hard
A SOC team is using a fishbone diagram to analyze a security incident where an insider threat exfiltrated data. The team has identified several potential causes. Which cause category is most likely to reveal a systemic issue that can be addressed through policy changes?
Select an answer first
43application · medium
A lessons-learned review of a phishing incident found that users frequently failed to report suspicious emails. The SOC team wants to integrate this lesson into the organization's security program. Which action best achieves this?
Select an answer first
44application · medium
After a phishing incident, the SOC team identifies that users were not recognizing suspicious email URLs. The team wants to integrate this lesson into the organization's security awareness program. Which action is most effective?
Select an answer first
45expert · hard
A SOC analyst must write an incident report for a cross-border data breach involving customers in multiple jurisdictions. The report will be reviewed by legal counsel, the CISO, and the IT team. The analyst must balance completeness with the need to avoid legal exposure. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.