CCISO Incident Management & Response 2

Question 1

A CISO learns that an attacker exfiltrated 500GB of sensitive data before the intrusion was detected. Which gap in the incident response program most directly contributed to this outcome?

Accepted Answer

Insufficient data loss prevention and egress monitoring controls

Answer

Insufficient egress monitoring and DLP controls allow large-scale data exfiltration to go undetected, directly enabling prolonged data loss.

Question 2

During post-incident analysis, the IR team determines that the mean time to detect (MTTD) was 47 days. As CISO, which metric should you prioritize improving first to reduce business impact from future incidents?

Accepted Answer

Mean time to detect (MTTD)

Answer

Reducing MTTD shortens the window attackers have to cause damage, directly reducing overall business impact before containment can even begin.

Question 3

A ransomware attack has encrypted critical operational systems. The IR team recommends paying the ransom to restore operations quickly. What should the CISO do FIRST?

Accepted Answer

Consult legal counsel and law enforcement before authorizing payment

Answer

Legal counsel must assess sanctions exposure and regulatory obligations, and law enforcement engagement may be legally required before any ransom payment is made.

Question 4

Which forensic principle ensures that evidence collected during an incident investigation is admissible in legal proceedings?

Accepted Answer

Chain of custody documentation

Answer

Chain of custody documents who handled evidence, when, and how, ensuring its integrity and admissibility in court.

Question 5

An IR team discovers that an attacker maintained persistence via a scheduled task that survived reimaging because it was stored on a network share. This illustrates which concept?

Accepted Answer

Persistent foothold via off-system storage

Answer

Storing persistence mechanisms on network shares rather than local disk allows them to survive endpoint reimaging, a technique CISOs must account for in remediation plans.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Incident Management & Response 2