An organization faces two simultaneous incidents: a low-severity phishing campaign targeting a few users, and a high-severity ransomware attack on a critical database server. The incident response team has limited staff. How should the team prioritize its response?

Split the team equally between both incidents

Handle the phishing campaign first because it was detected earlier

Focus on the phishing campaign first because it is easier to contain

Focus on the ransomware attack because it has higher severity and impact

A company is responding to a data breach that involves a critical application server. The server contains volatile evidence that may be lost if the system is shut down. However, the attacker is actively using the server to exfiltrate data. What is the most appropriate containment strategy?

Immediately shut down the server to stop data exfiltration

Allow the exfiltration to continue to gather more evidence

Isolate the server from the network while keeping it running

Disconnect the server and reboot it to clear the attacker's session

Why is timely and accurate incident reporting important?

It is only required for regulatory compliance

It eliminates the need for forensic investigation

It guarantees that the incident will be fully resolved

It enables a faster response and reduces potential damage

What is the purpose of maintaining a chain of custody for digital evidence?

To speed up the forensic analysis process

To encrypt the evidence for storage

To ensure the evidence is admissible in legal proceedings

To reduce the cost of forensic tools

What is the primary goal of the containment phase in incident response?

To limit the spread and impact of the incident

To collect evidence for legal proceedings

To restore systems to normal operation

To identify the root cause of the incident

Certified Information Systems Auditor

Domain 5Objective 6

Incident Response and Forensics CISA Practice Questions (Page 1)

Part of the Protection of Information Assets domain, which accounts for 26% of the CISA exam.

41questions here

9free pages

12concepts

26%of the exam

12 Concepts in This Objective

Incident Response Lifecycle
Incident Classification and Triage
Incident Response Roles and Responsibilities
Incident Response Procedures and Playbooks
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Evidence Collection and Handling
Forensic Imaging and Data Acquisition
Forensic Analysis and Examination
Forensic Tools and Techniques
Legal and Regulatory Considerations in Forensics
Documentation and Reporting of Forensic Findings

Questions 1–5

1expert · hard
An organization faces two simultaneous incidents: a low-severity phishing campaign targeting a few users, and a high-severity ransomware attack on a critical database server. The incident response team has limited staff. How should the team prioritize its response?
Select an answer first
2expert · hard
A company is responding to a data breach that involves a critical application server. The server contains volatile evidence that may be lost if the system is shut down. However, the attacker is actively using the server to exfiltrate data. What is the most appropriate containment strategy?
Select an answer first
3foundation · easy
Why is timely and accurate incident reporting important?
Select an answer first
4foundation · easy
What is the purpose of maintaining a chain of custody for digital evidence?
Select an answer first
5foundation · easy
What is the primary goal of the containment phase in incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.