What is the primary purpose of incident triage?

To determine the root cause of the incident

To update the incident response plan

To prioritize incidents and assign response resources

To collect forensic evidence from affected systems

After a major incident, the incident response team conducts a post-incident review. They identify that the incident response plan lacked clear escalation procedures, which delayed the response. What should the team do with this finding?

Document the finding in the incident report and close the review.

Assign blame to the team members who delayed the response.

Conduct another review to confirm the finding.

Update the incident response plan to include clear escalation procedures.

A forensic investigator is called to a scene where a server is still running and may contain evidence of a data breach. The server is critical to business operations, and the company wants to minimize downtime. The investigator must collect evidence while balancing the need to preserve volatile data and maintain business continuity. What is the most appropriate approach?

Copy the relevant files to an external drive and then shut down the server.

Disconnect the server from the network and leave it running until business hours end.

Capture a memory dump first, then create a forensic image of the disk while the server is still running.

Shut down the server immediately and then create a forensic image of the disk.

A security analyst discovers that an employee's workstation has been compromised and is communicating with a known command-and-control server. The analyst needs to preserve evidence for potential legal action. Which action is most appropriate for forensic evidence collection?

Create a bit-for-bit image of the workstation's hard drive using a write-blocker.

Copy the suspicious files to a USB drive for analysis.

Run a memory dump and then shut down the workstation immediately.

Disconnect the workstation from the network and then reboot it to clear the malware.

What is the primary goal of forensic evidence collection?

To quickly restore systems to normal operation

To delete malicious files from the system

To identify the attacker's identity

To preserve evidence in a manner that maintains its integrity

Certified Secure Software Lifecycle Professional

Domain 7Objective 8

Execute the Incident Response Plan CSSLP Practice Questions (Page 2)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

11%of the exam

Questions 6–10

6foundation · easy
What is the primary purpose of incident triage?
Select an answer first
7application · medium
After a major incident, the incident response team conducts a post-incident review. They identify that the incident response plan lacked clear escalation procedures, which delayed the response. What should the team do with this finding?
Select an answer first
8expert · hard
A forensic investigator is called to a scene where a server is still running and may contain evidence of a data breach. The server is critical to business operations, and the company wants to minimize downtime. The investigator must collect evidence while balancing the need to preserve volatile data and maintain business continuity. What is the most appropriate approach?
Select an answer first
9application · medium
A security analyst discovers that an employee's workstation has been compromised and is communicating with a known command-and-control server. The analyst needs to preserve evidence for potential legal action. Which action is most appropriate for forensic evidence collection?
Select an answer first
10foundation · easy
What is the primary goal of forensic evidence collection?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.