CCISO Incident Management & Response 4

Question 1

A CISO is evaluating whether to outsource incident response to a managed security service provider (MSSP). Which factor represents the GREATEST risk of this arrangement?

Accepted Answer

Potential loss of institutional knowledge and delayed response due to lack of organizational context

Answer

MSSPs may lack deep organizational context, which can slow investigation and remediation when incidents involve specific business processes or custom systems.

Question 2

Which of the following BEST describes the role of threat intelligence in the incident response lifecycle?

Accepted Answer

Enriching detection and providing adversary context to accelerate investigation and improve containment decisions

Answer

Threat intelligence provides indicators of compromise and adversary TTPs that accelerate identification, scope assessment, and informed containment during incident response.

Question 3

An insider threat incident is discovered involving a privileged administrator who copied sensitive data to personal cloud storage over six months. Which IR process failure allowed the prolonged activity?

Accepted Answer

Lack of user and entity behavior analytics (UEBA) or privileged user monitoring controls

Answer

UEBA and privileged user monitoring detect anomalous behavior patterns over time, which are necessary to catch slow-burn insider threats that evade signature-based detection.

Question 4

During incident containment, the IR team isolates an infected endpoint by removing it from the network. This action is BEST classified as which type of containment?

Accepted Answer

Short-term containment to limit immediate spread

Answer

Network isolation of an infected endpoint is a short-term containment measure that limits the immediate spread of an incident while investigation and eradication planning proceed.

Question 5

A CISO must decide how long to retain incident-related logs and forensic artifacts. Which factor should MOST influence this retention period?

Accepted Answer

Legal hold requirements, regulatory mandates, and statute of limitations for potential litigation

Answer

Legal holds, regulatory requirements, and litigation timelines dictate minimum retention periods for incident artifacts to ensure evidence availability for legal and compliance purposes.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Incident Management & Response 4