Which factor is MOST important when prioritizing the response to multiple security incidents?

The time of day the incident was reported

The potential impact on business operations

The number of incident responders available

A company's intrusion detection system (IDS) generates an alert for suspicious outbound traffic from a server. The security analyst on duty is unsure if this is a true positive or a false positive. According to incident detection and reporting best practices, what should the analyst do first?

Ignore the alert because it might be a false positive

Escalate the alert to the incident response team immediately

Wait for additional alerts before taking any action

Investigate the alert to determine if it is a true positive

A forensic investigator needs to acquire evidence from a server that is still running and cannot be shut down due to business continuity requirements. The investigator must capture volatile data and create a forensic image of the hard drive. What is the most appropriate approach?

Copy only the files needed for the investigation

Capture volatile data first, then create a forensic image using a write blocker

Create the forensic image first, then capture volatile data

Shut down the server to capture volatile data and then image the drive

What is the primary purpose of forensic analysis of digital evidence?

To delete malicious files from the system

To restore the system to its original state

To identify indicators of compromise and reconstruct events

Certified Information Systems Auditor

Domain 5Objective 6

Incident Response and Forensics CISA Practice Questions (Page 4)

Part of the Protection of Information Assets domain, which accounts for 26% of the CISA exam.

41questions here

9free pages

12concepts

26%of the exam

12 Concepts in This Objective

Incident Response Lifecycle
Incident Classification and Triage
Incident Response Roles and Responsibilities
Incident Response Procedures and Playbooks
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Evidence Collection and Handling
Forensic Imaging and Data Acquisition
Forensic Analysis and Examination
Forensic Tools and Techniques
Legal and Regulatory Considerations in Forensics
Documentation and Reporting of Forensic Findings

Questions 16–20

16foundation · easy
Which factor is MOST important when prioritizing the response to multiple security incidents?
Select an answer first
17application · medium
A company's intrusion detection system (IDS) generates an alert for suspicious outbound traffic from a server. The security analyst on duty is unsure if this is a true positive or a false positive. According to incident detection and reporting best practices, what should the analyst do first?
Select an answer first
18expert · hard
A forensic investigator needs to acquire evidence from a server that is still running and cannot be shut down due to business continuity requirements. The investigator must capture volatile data and create a forensic image of the hard drive. What is the most appropriate approach?
Select an answer first
19foundation · easy
What is the primary purpose of forensic analysis of digital evidence?
Select an answer first
20foundation · easy
After an incident has been contained and eradicated, which phase involves restoring systems to normal operation and validating that they function as expected?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.