Which practice is essential when collecting digital evidence to preserve its integrity?

Using the evidence immediately without recording its condition

Working on the original media to avoid duplication errors

Documenting every action taken with the evidence

Storing evidence in a publicly accessible location for transparency

During a major incident, the incident response team discovers that the attack originated from a compromised third-party vendor account. The vendor is critical to operations. The team needs to contain the threat, but the vendor is reluctant to cooperate. What is the most appropriate action?

Proceed with containment without vendor involvement

Terminate the vendor relationship immediately

Escalate to executive management to engage the vendor and enforce cooperation

Publicly disclose the vendor's involvement to pressure them

Why are documented incident response procedures important for an organization?

They ensure that all responders follow the same consistent steps

They guarantee that incidents will be resolved without any impact

They eliminate the need for post-incident reviews

They are required by law in all jurisdictions

During a forensic investigation, an investigator needs to collect evidence from a compromised server. To ensure the evidence is admissible in court, which action is most critical?

Use the fastest available forensic tools

Collect evidence only from the server's hard drive

Inform the system administrator about the investigation

Document the chain of custody for all evidence collected

Certified Information Systems Auditor

Domain 5Objective 6

Incident Response and Forensics CISA Practice Questions (Page 2)

Part of the Protection of Information Assets domain, which accounts for 26% of the CISA exam.

41questions here

9free pages

12concepts

26%of the exam

12 Concepts in This Objective

Incident Response Lifecycle
Incident Classification and Triage
Incident Response Roles and Responsibilities
Incident Response Procedures and Playbooks
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Evidence Collection and Handling
Forensic Imaging and Data Acquisition
Forensic Analysis and Examination
Forensic Tools and Techniques
Legal and Regulatory Considerations in Forensics
Documentation and Reporting of Forensic Findings

Questions 6–10

6foundation · easy
Which practice is essential when collecting digital evidence to preserve its integrity?
Select an answer first
7foundation · easy
During which phase of the incident response lifecycle does an organization focus on establishing policies, tools, and training before an incident occurs?
Select an answer first
8expert · hard
During a major incident, the incident response team discovers that the attack originated from a compromised third-party vendor account. The vendor is critical to operations. The team needs to contain the threat, but the vendor is reluctant to cooperate. What is the most appropriate action?
Select an answer first
9foundation · easy
Why are documented incident response procedures important for an organization?
Select an answer first
10application · medium
During a forensic investigation, an investigator needs to collect evidence from a compromised server. To ensure the evidence is admissible in court, which action is most critical?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.