What is the main goal of a post-incident review?

To collect forensic evidence for legal proceedings

To contain the incident and prevent further damage

To document lessons learned and improve future incident response

To identify the attacker's identity

After a malware infection, the incident response team removed the malware, patched the exploited vulnerability, and restored the affected systems from clean backups. Before declaring the incident resolved, what should the team do to verify remediation effectiveness?

Review the incident response plan for lessons learned.

Notify the users that the systems are safe to use.

Run a vulnerability scan and verify that the systems are clean and patched.

Immediately return the systems to production to minimize downtime.

Forensic analysts are investigating a breach and have collected logs from a firewall, a web server, and an authentication server. They need to determine the attack vector. What is the most effective approach?

Analyze the web server logs only, since the web application is the most likely target.

Correlate timestamps and IP addresses across the logs to reconstruct the sequence of events.

Interview the system administrators to get their perspective.

Search the logs for known malware signatures.

Which activity is part of forensic analysis?

Patching the vulnerability exploited by the attacker

Creating a forensic image of a hard drive

Notifying law enforcement of the incident

Examining log files to trace attacker actions

What is the primary goal of remediation planning?

To collect forensic evidence for legal proceedings

To identify the root cause of the incident

To contain and eradicate the incident while minimizing business impact

To document lessons learned from the incident

Certified Secure Software Lifecycle Professional

Domain 7Objective 8

Execute the Incident Response Plan CSSLP Practice Questions (Page 4)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

11%of the exam

Questions 16–20

16foundation · easy
What is the main goal of a post-incident review?
Select an answer first
17application · medium
After a malware infection, the incident response team removed the malware, patched the exploited vulnerability, and restored the affected systems from clean backups. Before declaring the incident resolved, what should the team do to verify remediation effectiveness?
Select an answer first
18application · medium
Forensic analysts are investigating a breach and have collected logs from a firewall, a web server, and an authentication server. They need to determine the attack vector. What is the most effective approach?
Select an answer first
19foundation · easy
Which activity is part of forensic analysis?
Select an answer first
20foundation · easy
What is the primary goal of remediation planning?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.