CCISO Incident Management & Response 3

Question 1

A financial institution experiences a breach affecting 100,000 customer records. Under US regulations, which regulatory body typically requires notification within a specific timeframe for this type of institution?

Accepted Answer

Federal banking regulators under the GLBA Safeguards Rule notification requirements

Answer

Under the GLBA Safeguards Rule, financial institutions must notify their primary federal banking regulator as soon as possible within 36 hours of discovering a notification event.

Question 2

Which component of a business continuity plan most directly supports the incident response function during a major cyber event?

Accepted Answer

Recovery time objectives (RTOs) and recovery point objectives (RPOs) for critical systems

Answer

RTOs and RPOs define acceptable downtime and data loss thresholds, guiding IR prioritization decisions about which systems to restore first.

Question 3

A CISO wants to test whether the IR team can handle a simulated advanced persistent threat without disrupting production systems. Which exercise type is MOST appropriate?

Accepted Answer

Purple team exercise in an isolated lab environment

Answer

Purple team exercises in isolated environments allow realistic adversary simulation and IR testing without risking production system availability.

Question 4

When a security incident involves a third-party cloud provider, the CISO's incident response plan should address which unique challenge?

Accepted Answer

Limited direct access to infrastructure and reliance on provider cooperation for evidence collection

Answer

In cloud environments, the organization often cannot directly access underlying infrastructure, making evidence collection dependent on the provider's cooperation and contractual SLAs.

Question 5

An attacker used compromised credentials obtained via credential stuffing to access a customer portal. After containment, which remediation action has the highest long-term impact on preventing recurrence?

Accepted Answer

Implementing multi-factor authentication across all customer-facing portals

Answer

MFA prevents credential stuffing attacks from succeeding even when valid credentials are obtained, addressing the root cause rather than symptoms.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Incident Management & Response 3