What is the primary purpose of an incident response playbook?

To provide step-by-step guidance for responding to specific types of incidents

To document the organization's overall security policy

To record the details of past incidents for historical reference

To replace the need for trained incident responders

An organization's incident response playbook for ransomware is outdated and does not address recent variants that disable backup systems. During an actual ransomware incident, the team discovers that the backups are encrypted. The playbook instructs to restore from backups. What should the team do?

Ignore the incident and wait for the backups to be restored automatically

Deviate from the playbook and implement alternative containment and recovery measures

Stop all response activities until the playbook is updated

Follow the playbook and attempt to restore from backups

Which technique is used to ensure that a forensic image is an exact copy of the original media?

Encrypting the image with a strong algorithm

Compressing the image to reduce its size

Copying only the files that are currently in use

Hashing the image and comparing it to the original

What is the primary purpose of a forensic investigation report?

To store raw data for future analysis

To communicate findings clearly to both technical and non-technical audiences

To replace the need for oral testimony

To provide a detailed list of all forensic tools used

Certified Information Systems Auditor

Domain 5Objective 6

Incident Response and Forensics CISA Practice Questions (Page 5)

Part of the Protection of Information Assets domain, which accounts for 26% of the CISA exam.

41questions here

9free pages

12concepts

26%of the exam

12 Concepts in This Objective

Incident Response Lifecycle
Incident Classification and Triage
Incident Response Roles and Responsibilities
Incident Response Procedures and Playbooks
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Evidence Collection and Handling
Forensic Imaging and Data Acquisition
Forensic Analysis and Examination
Forensic Tools and Techniques
Legal and Regulatory Considerations in Forensics
Documentation and Reporting of Forensic Findings

Questions 21–25

21foundation · easy
What is the primary purpose of an incident response playbook?
Select an answer first
22foundation · easy
Which role is typically responsible for coordinating the overall response effort and making final decisions during a security incident?
Select an answer first
23expert · hard
An organization's incident response playbook for ransomware is outdated and does not address recent variants that disable backup systems. During an actual ransomware incident, the team discovers that the backups are encrypted. The playbook instructs to restore from backups. What should the team do?
Select an answer first
24foundation · easy
Which technique is used to ensure that a forensic image is an exact copy of the original media?
Select an answer first
25foundation · easy
What is the primary purpose of a forensic investigation report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.