Incident Response and Forensics CISA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   During which phase of incident response is the root cause of an incident removed from affected systems?

   • AEradication
   • BDetection
   • CContainment
   • DRecovery
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An organization is developing its incident response capability. To ensure consistent and effective response to common incidents like phishing and malware, the team wants to document step-by-step procedures. What is the most appropriate approach?

   • ADevelop a single general procedure for all incidents
   • BCreate detailed playbooks for each common incident type
   • CRely on the expertise of senior analysts during incidents
   • DWait until an incident occurs to develop procedures
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst receives alerts for two incidents simultaneously: (1) a single workstation detected with a known malware signature, and (2) multiple servers showing signs of data exfiltration to an external IP. The analyst has limited resources and must prioritize. Which incident should be handled first?

   • ABoth simultaneously, because all incidents require equal attention
   • BThe server data exfiltration, because it involves multiple systems and potential data loss
   • CThe workstation malware, because it is a known signature and easier to remediate
   • DThe workstation malware, because it was detected first
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of creating a forensic image of a storage device?

   • ATo compress the data to save storage space
   • BTo create an exact bit-for-bit copy for analysis without altering the original
   • CTo encrypt the original device for security
   • DTo delete unnecessary files from the original device
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which element is MOST important to include in a forensic report to ensure it is useful for legal proceedings?

   • AA list of all employees' email addresses
   • BA clear description of the evidence and its chain of custody
   • CA summary of the organization's security policies
   • DA detailed explanation of every forensic tool's user interface
   Reveal Solution Discussion Select an answer first