After a phishing incident is contained and eradicated, the incident response team holds a meeting to discuss what went well, what did not, and what could be improved. Which post-incident activity is this, and why is it important?

Containment, to ensure the threat is fully stopped

Lessons learned, to identify improvements and update the incident response plan

Evidence preservation, to maintain forensic data for legal proceedings

Recovery, to restore systems to normal operation

A SOC analyst receives an alert about a possible malware infection on a server. The analyst reviews the alert, checks the server's recent process activity, and determines that the file is a false positive. Which phase of incident response is the analyst performing?

Detection and analysis, because the analyst is verifying whether an incident actually occurred

Eradication, because the analyst is removing the malware

Containment, because the analyst is taking steps to stop the spread

Recovery, because the analyst is restoring the server to normal operation

A security analyst is investigating a potential data breach. The analyst finds that an attacker used a compromised account to access sensitive data. The analyst wants to determine the scope of the breach. Which action would best help the analyst determine the scope?

Immediately resetting the compromised account's password

Disconnecting the compromised system from the network

Reviewing logs to identify all systems and data accessed by the compromised account

A malware infection is confirmed on several servers. The incident response team has isolated the affected servers and identified the malicious files. What should the team do next to ensure the threat is completely removed and the systems can be safely restored?

Conduct a lessons-learned meeting

Notify customers about the potential data exposure

Eradicate the malware by removing malicious files and cleaning affected systems

Immediately restore the servers from the latest backup

Certified in Cybersecurity

Domain 2Objective 3

2.3 - Understand Incident Response CC Practice Questions (Page 6)

Part of the Business Continuity (BC), Disaster Recovery (DR) & Incident Response Concepts domain, which accounts for 10% of the CC exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 2–3 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

10%of the exam

Questions 26–30

26foundation · easy
Which incident response phase involves actions taken to stop the spread of an incident and limit damage?
Select an answer first
27application · medium
After a phishing incident is contained and eradicated, the incident response team holds a meeting to discuss what went well, what did not, and what could be improved. Which post-incident activity is this, and why is it important?
Select an answer first
28application · medium
A SOC analyst receives an alert about a possible malware infection on a server. The analyst reviews the alert, checks the server's recent process activity, and determines that the file is a false positive. Which phase of incident response is the analyst performing?
Select an answer first
29expert · hard
A security analyst is investigating a potential data breach. The analyst finds that an attacker used a compromised account to access sensitive data. The analyst wants to determine the scope of the breach. Which action would best help the analyst determine the scope?
Select an answer first
30application · medium
A malware infection is confirmed on several servers. The incident response team has isolated the affected servers and identified the malicious files. What should the team do next to ensure the threat is completely removed and the systems can be safely restored?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CC” is a trademark of its owner, used for identification only.