During an investigation, an incident responder needs to collect evidence from a running server without losing volatile data. Which evidence collection step should be performed first?

Document the system time and date.

Disconnect the server from the network.

Create a forensic image of the hard drive.

Capture the contents of memory (RAM).

A series of data breaches occurred over several months, each involving a different vulnerability. The incident response team suspects a common underlying cause. Which technique is most appropriate for root cause analysis?

Review each incident independently and document the technical details.

Immediately patch all identified vulnerabilities and close the incidents.

Conduct a '5 Whys' analysis to trace each incident back to a common contributing factor.

Replace the affected systems with new hardware.

During incident triage, which factor is primarily used to determine the priority of a security incident?

The name of the system that reported the incident

The severity and impact on business operations

The time of day the incident was reported

The number of security tools that detected the incident

Certified Secure Software Lifecycle Professional

Domain 7Objective 8

Execute the Incident Response Plan CSSLP Practice Questions (Page 7)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

7concepts

11%of the exam

Questions 31–33

31application · medium
During an investigation, an incident responder needs to collect evidence from a running server without losing volatile data. Which evidence collection step should be performed first?
Select an answer first
32application · medium
A series of data breaches occurred over several months, each involving a different vulnerability. The incident response team suspects a common underlying cause. Which technique is most appropriate for root cause analysis?
Select an answer first
33foundation · easy
During incident triage, which factor is primarily used to determine the priority of a security incident?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Execute the Incident Response Plan CSSLP Practice Questions (Page 7)

Questions 31–33

During an investigation, an incident responder needs to collect evidence from a running server without losing volatile data. Which evidence collection step should be performed first?

A series of data breaches occurred over several months, each involving a different vulnerability. The incident response team suspects a common underlying cause. Which technique is most appropriate for root cause analysis?

During incident triage, which factor is primarily used to determine the priority of a security incident?

Keep studying — Secure Software Deployment, Operations, Maintenance