During an incident investigation, an analyst collects a hard drive from a compromised server. The analyst must ensure the evidence is admissible in court. Which action is most important for maintaining the chain of custody?

Document who handled the evidence and when, and store it in a secure location.

Make a forensic image of the hard drive and analyze the image.

Place the hard drive in a static-free bag and label it with the case number.

Immediately connect the hard drive to a forensic workstation to analyze it.

A company is responding to a ransomware incident that has encrypted critical file servers. The incident response team is working with external cybersecurity consultants and law enforcement. The CEO wants to pay the ransom to restore operations quickly. The incident response team believes that paying the ransom is not advisable. What should the team do?

Refuse to pay the ransom and continue with the response plan.

Follow the CEO's instruction and pay the ransom immediately.

Present the risks of paying the ransom and recommend alternative recovery options.

Ignore the CEO and contact law enforcement to make the decision.

A company's security team discovers that an attacker has been accessing a server that contains proprietary research data. The server is also used for a critical internal application that is currently in use. The team must contain the incident, but the CEO wants to keep the application running to avoid business disruption. The team also needs to preserve evidence for a potential legal case. Which containment action best meets all these requirements?

Isolate the server on a separate network segment and allow only the critical application's traffic.

Block the attacker's IP address at the firewall and continue monitoring.

Take a memory dump of the server, then disconnect it.

Disconnect the server from the network and take it offline.

A company has just experienced a data breach. The incident response team has completed the containment and eradication phases. They are now moving to the recovery phase. What is the primary goal of the recovery phase?

Restore affected systems to normal operation and verify they are secure.

Collect and preserve evidence for legal proceedings.

Identify the root cause of the incident.

Communicate the incident to external stakeholders.

What is the primary goal of incident containment strategies?

To collect forensic evidence for legal proceedings

To restore systems to normal operation

To limit the impact and prevent further damage

To identify the root cause of the incident

Certified Cybersecurity Operations Analyst

Domain 4Objective 2

Incident Response and Handling CCOA Practice Questions (Page 6)

Part of the Domain 4: Incident Detection and Response domain, which accounts for 34% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~32–54 in this domain), expect 11–18 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

34%of the exam

Questions 26–30

26application · medium
During an incident investigation, an analyst collects a hard drive from a compromised server. The analyst must ensure the evidence is admissible in court. Which action is most important for maintaining the chain of custody?
Select an answer first
27expert · hard
A company is responding to a ransomware incident that has encrypted critical file servers. The incident response team is working with external cybersecurity consultants and law enforcement. The CEO wants to pay the ransom to restore operations quickly. The incident response team believes that paying the ransom is not advisable. What should the team do?
Select an answer first
28expert · hard
A company's security team discovers that an attacker has been accessing a server that contains proprietary research data. The server is also used for a critical internal application that is currently in use. The team must contain the incident, but the CEO wants to keep the application running to avoid business disruption. The team also needs to preserve evidence for a potential legal case. Which containment action best meets all these requirements?
Select an answer first
29application · medium
A company has just experienced a data breach. The incident response team has completed the containment and eradication phases. They are now moving to the recovery phase. What is the primary goal of the recovery phase?
Select an answer first
30foundation · easy
What is the primary goal of incident containment strategies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Incident Response and Handling CCOA Practice Questions (Page 6)

Questions 26–30

During an incident investigation, an analyst collects a hard drive from a compromised server. The analyst must ensure the evidence is admissible in court. Which action is most important for maintaining the chain of custody?

A company has just experienced a data breach. The incident response team has completed the containment and eradication phases. They are now moving to the recovery phase. What is the primary goal of the recovery phase?

What is the primary goal of incident containment strategies?

Keep studying — Domain 4: Incident Detection and Response