CND Incident Response & Disaster Recovery Practice Questions — Questions and Answers

Question 1: During the containment phase of incident response, which strategy isolates an infected host while preserving forensic evidence?

Immediate shutdown of the host
Network segmentation using VLAN or firewall ACL changes (Correct answer)
Reinstalling the operating system
Disabling all network interfaces permanently

Correct answer: Network segmentation using VLAN or firewall ACL changes

Network segmentation via VLANs or ACLs isolates the compromised host from the rest of the network while keeping it powered on to preserve volatile memory evidence.

Question 2: What does the term 'RTO' represent in disaster recovery planning?

Recovery Time Objective — the maximum tolerable downtime after a disaster (Correct answer)
Recovery Transfer Operation — moving data to a backup site
Redundant Transfer Output — secondary data path speed
Restoration Time Offset — lag between backup creation and restoration

Correct answer: Recovery Time Objective — the maximum tolerable downtime after a disaster

RTO (Recovery Time Objective) defines the maximum acceptable length of time that a system can be offline after a disaster before business impact becomes unacceptable.

Question 3: Which artifact should an incident responder collect FIRST from a live Windows system before pulling the power?

Event log files from disk
Contents of RAM (memory dump) (Correct answer)
Registry hive backups
Prefetch files from the filesystem

Correct answer: Contents of RAM (memory dump)

RAM holds volatile data including running processes, network connections, and encryption keys that are permanently lost when power is removed, so it must be captured first.

Question 4: An organization's DR plan calls for a 'warm site.' Which statement best describes a warm site?

A fully operational duplicate data center that can take over in minutes
A facility with hardware and connectivity pre-installed but requiring data restoration before use (Correct answer)
An empty building where equipment can be shipped after a disaster
A cloud-only recovery environment with no physical infrastructure

Correct answer: A facility with hardware and connectivity pre-installed but requiring data restoration before use

A warm site has pre-installed hardware and network connectivity but requires restoring recent backups before it becomes fully operational, balancing cost and recovery speed.

Question 5: Which incident response phase involves removing malware, closing vulnerabilities, and restoring affected systems to normal operation?

Identification
Eradication (Correct answer)
Lessons Learned
Detection

Correct answer: Eradication

Eradication is the phase where root causes are eliminated — malware removed, patches applied, and compromised credentials reset — before systems are returned to production.

Question 6: A chain of custody document in incident response is primarily used to:

Record which analysts were on call during the incident
Track evidence handling to ensure its integrity and admissibility in legal proceedings (Correct answer)
Log system performance metrics during recovery
Document software licenses used during the investigation

Correct answer: Track evidence handling to ensure its integrity and admissibility in legal proceedings

Chain of custody records every person who handled evidence, when, and why, ensuring that evidence integrity can be proven in court or disciplinary proceedings.

Question 7: During post-incident analysis, what is the PRIMARY purpose of a 'lessons learned' meeting?

To assign blame to the team members who made errors
To identify process gaps and improve defenses before the next incident (Correct answer)
To calculate the total financial loss from the incident
To notify regulators about the breach details

Correct answer: To identify process gaps and improve defenses before the next incident

Lessons learned meetings focus on improving processes, tools, and training so that the organization responds more effectively to future incidents.

Question 8: What is the key difference between an 'incident' and an 'event' in the context of NIST SP 800-61?

Events are always malicious; incidents may be benign
An incident is an adverse event that threatens security; an event is any observable occurrence (Correct answer)
Incidents occur only on endpoints; events occur only on networks
Events require immediate escalation; incidents do not

Correct answer: An incident is an adverse event that threatens security; an event is any observable occurrence

NIST SP 800-61 defines an event as any observable occurrence in a system, while an incident is an event that actually or potentially jeopardizes confidentiality, integrity, or availability.

Question 9: Which backup strategy captures only the data changed since the LAST INCREMENTAL backup, resulting in the fastest backup but slowest restore?

Full backup
Differential backup
Incremental backup (Correct answer)
Mirror backup

Correct answer: Incremental backup

Incremental backups only capture changes since the previous backup (full or incremental), making them fast to create but requiring all increments to be restored sequentially, slowing recovery.

Question 10: A security analyst notices C2 beaconing traffic from an internal host every 60 seconds. In which incident response phase should the analyst formally document this as a confirmed incident?

Preparation
Identification (Correct answer)
Containment
Eradication

Correct answer: Identification

The Identification phase is where events are analyzed, correlated, and formally declared as confirmed incidents after meeting defined threshold criteria.

Question 11: Which disaster recovery metric defines the maximum age of data that an organization can afford to lose in a disruption?

RTO (Recovery Time Objective)
MTTR (Mean Time to Repair)
RPO (Recovery Point Objective) (Correct answer)
MTBF (Mean Time Between Failures)

Correct answer: RPO (Recovery Point Objective)

RPO (Recovery Point Objective) defines how much data loss is tolerable, directly determining how frequently backups must be taken.

Question 12: When performing forensic disk imaging, which tool creates a bit-for-bit copy and generates an MD5/SHA hash to verify integrity?

Wireshark
dd or dcfldd (Correct answer)
Nmap
Netstat

Correct answer: dd or dcfldd

Tools like dd and dcfldd create forensically sound bit-for-bit disk images and compute cryptographic hashes to verify that the copy is identical to the original.

Question 13: An IR team uses the term 'IoC' during an investigation. What does IoC stand for and what is its purpose?

Index of Compromise — tracks patch levels on endpoints
Indicator of Compromise — artifacts that signal a system has been breached (Correct answer)
Instance of Control — defines which team member owns each task
Integrity of Configuration — validates system baseline settings

Correct answer: Indicator of Compromise — artifacts that signal a system has been breached

Indicators of Compromise (IoCs) are forensic artifacts such as malicious IPs, file hashes, or registry keys that indicate a system has been compromised.

Question 14: In a DR test scenario, a 'tabletop exercise' is best described as:

A full failover to the backup site with production traffic
A discussion-based walkthrough of the DR plan without activating systems (Correct answer)
Hardware replacement drill under time pressure
Automated backup restoration test with verification

Correct answer: A discussion-based walkthrough of the DR plan without activating systems

A tabletop exercise is a scenario-driven discussion where team members talk through their responses to a hypothetical disaster without actually executing any technical steps.

Question 15: Which type of malware analysis runs a suspicious file in an isolated environment to observe its behavior without risking production systems?

Static analysis
Code review
Dynamic analysis (sandboxing) (Correct answer)
Signature scanning

Correct answer: Dynamic analysis (sandboxing)

Dynamic analysis executes malware in a controlled sandbox environment to observe real-time behaviors such as file creation, registry changes, and network connections.

Question 16: A company's BCP states that critical payroll processing must continue even if the primary data center is destroyed. Which strategy BEST meets this requirement?

Weekly tape backups stored offsite
Hot site with real-time data replication (Correct answer)
Cold site provisioned within 72 hours
Manual processing using paper records

Correct answer: Hot site with real-time data replication

A hot site with real-time replication ensures zero data loss and near-instant failover, making it the only option that can sustain critical operations immediately after a site-level disaster.

Question 17: Which evidence collection principle states that the most volatile data must be collected before less volatile data?

Locard's Exchange Principle
Order of Volatility (Correct answer)
Chain of Custody
Least Privilege Evidence Handling

Correct answer: Order of Volatility

The Order of Volatility (RFC 3227) dictates collecting data from most volatile (RAM, CPU registers) to least volatile (optical media, paper) to prevent loss of perishable evidence.

Question 18: During incident response, when should an organization notify law enforcement?

Only after the incident is fully remediated
Only if the incident involves physical theft of hardware
When the incident involves criminal activity, significant financial loss, or national security implications (Correct answer)
Law enforcement should never be involved in cyber incidents

Correct answer: When the incident involves criminal activity, significant financial loss, or national security implications

Law enforcement notification is appropriate when incidents involve criminal activity (e.g., ransomware, financial fraud), critical infrastructure, or meet reporting thresholds under applicable laws.

Question 19: What is the primary function of a Security Information and Event Management (SIEM) system in incident response?

Blocking malware before it executes on endpoints
Aggregating and correlating log data from multiple sources to detect incidents (Correct answer)
Encrypting sensitive data at rest across the enterprise
Performing automated vulnerability scans on all network devices

Correct answer: Aggregating and correlating log data from multiple sources to detect incidents

A SIEM collects, normalizes, and correlates log and event data from across the environment to detect suspicious patterns and generate alerts for incident responders.

Question 20: A ransomware attack has encrypted files on 200 workstations. According to IR best practices, what should the team do IMMEDIATELY after detection?

Pay the ransom to restore operations quickly
Disconnect affected systems from the network to prevent further spread (Correct answer)
Reimage all 200 workstations simultaneously
Notify all employees about the attack via company email

Correct answer: Disconnect affected systems from the network to prevent further spread

Immediate network isolation stops ransomware from spreading laterally to additional systems, limiting the blast radius before eradication and recovery begin.

Question 21: Which disaster recovery test method involves actually switching production operations to the backup site to verify full functionality?

Tabletop exercise
Checklist review
Simulation drill
Full interruption test (Correct answer)

Correct answer: Full interruption test

A full interruption test (also called a full-scale test) actually cuts over production to the backup site, providing the most realistic validation but carrying the highest operational risk.

CND Incident Response & Disaster Recovery Practice Questions

During the containment phase of incident response, which strategy isolates an infected host while preserving forensic evidence?

🃏 CND Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full CND Study Guide →

What Practice Test Geeks adds beyond an AI chat for CND

An AI chatbot can quiz you, but it can't reproduce the exam conditions or keep your record. Here you get:

A timed, full-length CND mock exam — 100 questions in 240 minutes with a 70% pass mark, modeled on the official exam's question count and time limit, followed by a score report broken down by exam domain.
A fixed CND question bank: the same test every attempt, so your score is comparable from one try to the next instead of changing with every regenerated quiz.
Progress saved on your device: completed tests, scores and missed questions stay in My Progress, so you can retake only what you got wrong.
A printable CND cheat sheet you can print or save as a PDF.
CND flashcards built from the same question bank.

Start the Timed CND Mock Exam →

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cert.eccouncil.org — Eligibility, fees, renewal, score validity, retake fee, exam format, passing score, time limit, exam information · verified Nov 2026
eccouncil.org — Test delivery · verified Oct 2026