CCISO Incident Management & Response 2 — Questions and Answers
Question 1: A CISO learns that an attacker exfiltrated 500GB of sensitive data before the intrusion was detected. Which gap in the incident response program most directly contributed to this outcome?
- Lack of a formal incident response policy
- Insufficient data loss prevention and egress monitoring controls (Correct answer)
- Failure to conduct annual tabletop exercises
- Absence of a bug bounty program
Correct answer: Insufficient data loss prevention and egress monitoring controls
Insufficient egress monitoring and DLP controls allow large-scale data exfiltration to go undetected, directly enabling prolonged data loss.
Question 2: During post-incident analysis, the IR team determines that the mean time to detect (MTTD) was 47 days. As CISO, which metric should you prioritize improving first to reduce business impact from future incidents?
- Mean time to recover (MTTR)
- Mean time to contain (MTTC)
- Mean time to detect (MTTD) (Correct answer)
- Mean time between failures (MTBF)
Correct answer: Mean time to detect (MTTD)
Reducing MTTD shortens the window attackers have to cause damage, directly reducing overall business impact before containment can even begin.
Question 3: A ransomware attack has encrypted critical operational systems. The IR team recommends paying the ransom to restore operations quickly. What should the CISO do FIRST?
- Approve the payment to minimize downtime
- Consult legal counsel and law enforcement before authorizing payment (Correct answer)
- Restore from backup without notifying law enforcement
- Issue a public statement accepting responsibility for the breach
Correct answer: Consult legal counsel and law enforcement before authorizing payment
Legal counsel must assess sanctions exposure and regulatory obligations, and law enforcement engagement may be legally required before any ransom payment is made.
Question 4: Which forensic principle ensures that evidence collected during an incident investigation is admissible in legal proceedings?
- Chain of custody documentation (Correct answer)
- Using the fastest available imaging tool
- Conducting analysis on live systems to preserve uptime
- Deleting logs after analysis to protect privacy
Correct answer: Chain of custody documentation
Chain of custody documents who handled evidence, when, and how, ensuring its integrity and admissibility in court.
Question 5: An IR team discovers that an attacker maintained persistence via a scheduled task that survived reimaging because it was stored on a network share. This illustrates which concept?
- Lateral movement
- Privilege escalation
- Persistent foothold via off-system storage (Correct answer)
- Spear phishing
Correct answer: Persistent foothold via off-system storage
Storing persistence mechanisms on network shares rather than local disk allows them to survive endpoint reimaging, a technique CISOs must account for in remediation plans.
Question 6: A CISO is designing a tiered incident severity classification scheme. Which criterion is MOST important when assigning the highest severity tier?
- Number of helpdesk tickets generated
- Potential impact on business-critical operations, regulatory obligations, or reputational damage (Correct answer)
- Whether the incident involved an external actor
- Whether antivirus detected the threat
Correct answer: Potential impact on business-critical operations, regulatory obligations, or reputational damage
Severity classification must be anchored to business impact, regulatory exposure, and reputational risk, not merely technical indicators or source of attack.
Question 7: During an active intrusion, an IR analyst recommends immediately blocking all outbound traffic to stop exfiltration. The CISO must weigh this against which competing concern?
- Risk of alerting the attacker before evidence is collected (Correct answer)
- Cost of firewall rule changes
- Potential violation of the Computer Fraud and Abuse Act
- Loss of the bug bounty program eligibility
Correct answer: Risk of alerting the attacker before evidence is collected
Premature containment actions can alert attackers to change tactics or destroy evidence before forensic collection is complete, undermining the investigation.
CCISO Incident Management & Response 2
A CISO learns that an attacker exfiltrated 500GB of sensitive data before the intrusion was detected.
Which gap in the incident response program most directly contributed to this outcome?