CCISO Incident Management & Response 5

Question 1

During a major security incident, the CEO asks the CISO for a real-time status update every 30 minutes. What is the BEST way to handle this without compromising the IR team's effectiveness?

Accepted Answer

Designate a communications liaison to provide structured executive briefings on a defined schedule while the IR team focuses on response

Answer

A designated communications liaison allows executive stakeholders to receive regular updates without disrupting the IR team's focus on containment and investigation activities.

Question 2

Which NIST SP 800-61 phase involves activities such as reimaging systems, changing all compromised credentials, and patching exploited vulnerabilities?

Accepted Answer

Eradication

Answer

The Eradication phase focuses on removing the threat from the environment by reimaging, patching, and eliminating all attacker footholds before recovery begins.

Question 3

A CISO is building metrics to demonstrate IR program maturity to the board. Which combination of metrics BEST conveys both efficiency and effectiveness of the IR program?

Accepted Answer

MTTD, MTTC, MTTR, and incident recurrence rate

Answer

MTTD, MTTC, MTTR, and recurrence rate together measure how quickly threats are found, stopped, recovered from, and whether root causes are addressed, providing a complete maturity picture.

Question 4

An IR investigation reveals that attackers pivoted from a compromised workstation to a domain controller using pass-the-hash. Which remediation strategy MOST directly addresses the technique used?

Accepted Answer

Implementing Credential Guard and restricting NTLM authentication to reduce hash extraction and reuse

Answer

Credential Guard protects NTLM hashes from extraction from memory, and restricting NTLM directly reduces the attack surface for pass-the-hash lateral movement.

Question 5

A CISO implements a 'purple team' program as a continuous improvement mechanism for incident response. What distinguishes this from a traditional red team engagement?

Accepted Answer

Purple teams involve real-time collaboration between offensive and defensive teams to improve detection and response in place, rather than a blind adversarial test

Answer

Purple teaming emphasizes continuous knowledge transfer and joint improvement between red and blue teams, whereas traditional red teams operate independently to test without bias.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Incident Management & Response 5