A forensic investigator is collecting evidence from a compromised system that is part of a criminal investigation. The investigator accidentally opens a file on the system, altering its access time. What is the most appropriate action?

Document the alteration in the chain of custody and continue the investigation

Hide the alteration to avoid compromising the case

Reimage the system to undo the alteration

Stop the investigation and destroy the evidence

A malware infection is spreading across a network segment. The incident response team needs to contain the threat while preserving evidence for potential legal action. Which containment strategy best balances these needs?

Isolate the affected network segment while keeping systems running

Disconnect the affected systems from the network and then reboot them

Immediately power off all affected systems

Reimage all affected systems to ensure complete eradication

A forensic investigator needs to acquire the contents of a suspect's hard drive without altering the original evidence. Which method should be used?

Create a bit-for-bit forensic image of the drive using a write blocker

Copy all files from the drive to an external storage device

Boot the suspect's system and run a data recovery tool

Use a standard backup utility to create a compressed archive

After completing a forensic investigation, the lead investigator must present findings to the company's board of directors, who are non-technical. What is the most appropriate way to communicate the findings?

Focus only on technical details of the attack

Use technical jargon to demonstrate expertise

Present raw forensic data and logs

Provide a high-level summary with key findings and business impact

Certified Information Systems Auditor

Domain 5Objective 6

Incident Response and Forensics CISA Practice Questions (Page 7)

Part of the Protection of Information Assets domain, which accounts for 26% of the CISA exam.

41questions here

9free pages

12concepts

26%of the exam

12 Concepts in This Objective

Incident Response Lifecycle
Incident Classification and Triage
Incident Response Roles and Responsibilities
Incident Response Procedures and Playbooks
Incident Detection and Reporting
Containment, Eradication, and Recovery Strategies
Evidence Collection and Handling
Forensic Imaging and Data Acquisition
Forensic Analysis and Examination
Forensic Tools and Techniques
Legal and Regulatory Considerations in Forensics
Documentation and Reporting of Forensic Findings

Questions 31–35

31expert · hard
A forensic investigator is collecting evidence from a compromised system that is part of a criminal investigation. The investigator accidentally opens a file on the system, altering its access time. What is the most appropriate action?
Select an answer first
32application · medium
A malware infection is spreading across a network segment. The incident response team needs to contain the threat while preserving evidence for potential legal action. Which containment strategy best balances these needs?
Select an answer first
33application · medium
A forensic investigator needs to acquire the contents of a suspect's hard drive without altering the original evidence. Which method should be used?
Select an answer first
34foundation · easy
Which type of evidence is MOST useful for reconstructing the timeline of a security incident?
Select an answer first
35application · medium
After completing a forensic investigation, the lead investigator must present findings to the company's board of directors, who are non-technical. What is the most appropriate way to communicate the findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.