CCISO Incident Management & Response 5

Question 1

During a major security incident, the CEO asks the CISO for a real-time status update every 30 minutes. What is the BEST way to handle this without compromising the IR team's effectiveness?

Accepted Answer

Designate a communications liaison to provide structured executive briefings on a defined schedule while the IR team focuses on response

Answer

Assign the CISO to provide updates personally, pulling them away from oversight duties

Answer

Halt all IR activities during briefing periods to ensure accuracy

Answer

Refuse executive briefings until the incident is fully resolved

Question 2

Which NIST SP 800-61 phase involves activities such as reimaging systems, changing all compromised credentials, and patching exploited vulnerabilities?

Accepted Answer

Eradication

Answer

Detection and Analysis

Answer

Containment

Answer

Post-Incident Activity

Question 3

A CISO is building metrics to demonstrate IR program maturity to the board. Which combination of metrics BEST conveys both efficiency and effectiveness of the IR program?

Accepted Answer

MTTD, MTTC, MTTR, and incident recurrence rate

Answer

Number of phishing emails blocked and firewall rule count

Answer

Number of IR team certifications and training hours completed

Answer

Annual IR budget and headcount

Question 4

An IR investigation reveals that attackers pivoted from a compromised workstation to a domain controller using pass-the-hash. Which remediation strategy MOST directly addresses the technique used?

Accepted Answer

Implementing Credential Guard and restricting NTLM authentication to reduce hash extraction and reuse

Answer

Increasing password complexity requirements

Answer

Deploying additional endpoint antivirus signatures

Answer

Increasing firewall logging verbosity

Question 5

A CISO implements a 'purple team' program as a continuous improvement mechanism for incident response. What distinguishes this from a traditional red team engagement?

Accepted Answer

Purple teams involve real-time collaboration between offensive and defensive teams to improve detection and response in place, rather than a blind adversarial test

Answer

Purple teams only test physical security controls

Answer

Purple teams are always conducted by external consultants only

Answer

Purple teams replace the need for incident response plans

Question 6

Which of the following scenarios would MOST likely trigger a legal hold that affects how an IR team handles forensic evidence?

Accepted Answer

Anticipated or active litigation, regulatory investigation, or law enforcement involvement related to the incident

Answer

A routine system patch that causes unplanned downtime

Answer

An employee requesting remote work accommodations

Answer

A vendor contract renewal negotiation

Question 7

A CISO is responsible for ensuring that incident response capabilities scale appropriately as the organization grows. Which approach BEST supports scalable IR capability over time?

Accepted Answer

Implementing a tiered response model with defined escalation paths, regularly updated playbooks, and integration of automation for high-volume, low-complexity incidents

Answer

Hiring a fixed-size IR team and maintaining static playbooks indefinitely

Answer

Outsourcing all IR activities permanently with no internal capability

Answer

Relying solely on law enforcement for all incident response activities