CCNA Incident Management Questions

A retainer pre-negotiates rates, scope and contact details with the forensic firm, so engagement begins immediately when an incident strikes rather than after procurement and contracting delays. This directly reduces the time to engage, preserving volatile evidence.

Severity classification must reflect the business impact, including regulatory, financial, and reputational consequences. Exposure of payment card data triggers mandatory notification and potential fines under PCI DSS and privacy regulations. CISM emphasizes that incident prioritization is driven by impact to the organization, not by technical metrics alone, making this the primary factor for assigning severity.

Strategic decisions, communications and resource allocation sit with the crisis management team, which handles business-level direction rather than technical containment. This satisfies the stem's P1 constraint: the CMT's mandate is enterprise-wide impact and stakeholder messaging, while the incident response team performs tactical containment and eradication.

A tabletop exercise gathers stakeholders for a facilitated discussion of a hypothetical scenario, walking through plans and procedures without deploying systems or simulating live traffic. This format directly satisfies the stem's requirement for a discussion-based review, distinguishing it from functional or full-scale exercises that test operational response.

A playbook supplies prescriptive, step-by-step procedures for a specific incident type such as ransomware, unlike a policy, which states intent, or a plan, which sets broad structure. It satisfies the need for detailed handling instructions.

Disabling the compromised account removes the attacker's known access path, and rotating privileged credentials invalidates any other stolen secrets the attacker may hold. This contains the incident without shutting down business operations, which supports the CISM principle of balancing security with business continuity. It also addresses the likelihood that the attacker harvested additional credentials from the compromised administrator's session or memory, closing related entry points.

Board or executive management approval confers enterprise-wide authority and accountability, since only top leadership can mandate compliance across all business units and commit resources. This satisfies the policy's requirement for authority and accountability by placing ownership at the highest governance level.

A pre-established forensic retainer defines scope, rates and contacts in advance, so the firm can be engaged immediately when an incident occurs. This directly satisfies the stem's constraint of reducing engagement delay, avoiding procurement and legal negotiation during the critical containment window when evidence preservation is time-sensitive.

The CEO sits on the crisis management team to authorise strategic decisions, external communications and resource commitments during a major incident. This satisfies the stem's selection of typical CMT roles, distinguishing executive crisis governance from the tactical incident response team handling containment and recovery.

When recovery cannot meet the maximum tolerable downtime, the incident ceases to be a technical problem and becomes a continuity problem. Escalating to activate the business continuity/disaster recovery plan invokes pre-authorised alternate processing arrangements, restoring critical services through failover rather than waiting for server restoration.

Holding the lessons learned meeting within two weeks of resolution captures details while memories remain fresh and evidence is accessible, yet allows initial recovery to settle. This timing balances accuracy against operational demands, yielding actionable improvements to the incident response programme.

5 Whys is an iterative interrogative technique that repeatedly asks 'why' to strip away symptomatic layers and expose the underlying causal factor. Applied after containment, it drills from the immediate ransomware trigger down to the root weakness, satisfying the root cause analysis requirement.

A P1 ransomware attack encrypting critical systems threatens business continuity and may involve extortion, regulatory notification and executive decisions beyond IT's authority. This severity and cross-functional impact trigger crisis management team involvement, satisfying the stem's requirement for incidents demanding strategic, organisation-wide response rather than routine technical remediation.

CISM defines crisis declaration around significant business impact and the need for strategic coordination across the organization. When an incident threatens critical business functions, reputation, or regulatory obligations, the CMT should be activated to provide executive direction, prioritize resources, and manage stakeholder communications. This factor directly reflects the purpose of the CMT and is the most reliable basis for the decision.

The incident response manager runs the response end to end, tasking technical teams and assigning severity classifications that trigger escalation and notification thresholds. This satisfies the stem's requirement for the coordinating role, distinguishing it from the executive sponsor's governance remit and the communications lead's messaging duties.

Escalating per the incident response plan ensures the right stakeholders are engaged and that actions are coordinated, documented, and authorized. Documentation supports forensic analysis, legal requirements, and post-incident review. This step aligns with CISM principles of following established procedures, maintaining chain of custody, and avoiding unilateral actions that could compromise the investigation or business operations.

Crisis classification is driven by potential enterprise-level impact, spanning brand reputation, financial loss, legal or regulatory exposure, and continuity of critical services. When an incident threatens these dimensions beyond the tolerance defined by executive management, the CMT must be activated because response now requires cross-functional executive authority, external communications, and strategic decision-making rather than technical containment alone.

A legal hold suspends routine deletion and triggers preservation obligations, while forensic imaging captures a bit-for-bit copy without altering the original media. Together they satisfy the litigation constraint by keeping evidence admissible and unmodified, which mere containment or continued live analysis would jeopardise.

When recovery exceeds the maximum tolerable downtime, the incident manager must escalate to the BC/DR team and the authority empowered to declare a disaster, since only that authority can activate continuity arrangements and commit resources beyond the IR team's remit. Continuing technical recovery alone would breach the MTD.

Isolating the workstation is the immediate containment step that stops the malware from communicating with the command-and-control server and prevents potential lateral movement or data exfiltration. This aligns with the containment phase of incident response. Once isolated, the team can conduct a thorough investigation and remediation without the risk of the attacker continuing to operate.

The CMT is responsible for strategic decision-making during a crisis, including ensuring business continuity, managing communications with stakeholders, and aligning incident response with organizational objectives. Technical details are important but are inputs to these decisions. The CMT focuses on the big picture, such as whether to shut down systems, how to inform customers, and how to maintain trust.

A pre-negotiated retainer with a forensics firm guarantees specialist capacity and defined rates are available immediately, avoiding procurement delays during containment. This satisfies the stem's requirement that the component be established before an incident occurs, since forensic demand spikes and vendors cannot be onboarded mid-crisis.

Failed logins followed by a successful login from an unusual location indicate credentials were obtained and used by an unauthorised party, which is account compromise. Brute force alone would show only failures; this pattern confirms access succeeded.

Naming affected systems or data tells recipients the incident's scope, so they can judge exposure and prioritise their own checks. This satisfies the template's need to convey impact precisely, rather than leaving recipients guessing which assets are involved.

ISAC membership is bidirectional: members submit IoCs and receive aggregated, sector-specific threat intelligence and early warnings. This reciprocal exchange satisfies the objective of gaining timely threat information while strengthening collective defence, which unilateral internal monitoring cannot deliver.

A predefined team with clear roles ensures that during an incident, personnel know exactly what to do, who to report to, and what decisions they are authorized to make. This reduces confusion and delays. CISM emphasizes that incident response planning must include an organizational structure with defined responsibilities, escalation paths, and decision-making authority to enable a coordinated and timely response.

Routing the forensic engagement through legal counsel, with the firm working at counsel's direction, brings the work product within attorney-client privilege and the work-product doctrine. This satisfies the stem's constraint that external expert communications remain legally protected during breach investigation.

RCA uniquely spans all three layers named in the stem: technical cause, the process failure enabling it, and the governance failure permitting that process weakness. Other post-incident activities, such as lessons learned meetings or metric reporting, address only one layer.

A current roster with verified contact details removes the delay of identifying and locating team members during an incident. That directly enables rapid activation, ensuring the right responders engage immediately rather than losing critical containment time.

Preserving a forensic image of both persistent storage and volatile memory satisfies the investigator's need for evidence while allowing the rebuild to proceed. This approach respects the pending regulatory investigation and maintains chain of custody, which is essential if the evidence is later challenged. CISM supports continuity of operations balanced with legal preservation, making this the appropriate resolution of the conflict.

The SEC's proposed rule requires registrants to report material cybersecurity incidents on Form 8-K within four business days of determining materiality, satisfying the stem's regulatory notification deadline. This fixed, short window reflects the US securities regime's emphasis on prompt investor disclosure, distinct from GDPR's 72-hour supervisory authority timescale.

The executive sponsor supplies strategic direction, budget and decision-making authority, satisfying the stem's requirement for executive-level governance during incidents. This role resolves escalated business-impact decisions and authorises resource commitments that operational responders cannot make, distinguishing it from tactical containment or forensic investigation duties.

Isolation decisions during an active exfiltration hinge on balancing containment against operational and evidentiary consequences. Cutting the network link stops data loss but may destroy volatile evidence such as live network connections and in-memory artifacts, and can disrupt critical business services. CISM emphasizes that containment strategy must weigh business impact, legal obligations, and evidence preservation before acting, making this the primary guiding factor.

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in risk. This fixed deadline satisfies the stem's maximum timeframe constraint for EU resident data.

The CMT exists to manage enterprise-level consequences, so escalation criteria should be tied to potential business impact rather than technical characteristics. Significant financial, legal, regulatory, or reputational exposure requires executive coordination across functions. CISM defines crisis management as the discipline of managing the wider business effects of an incident. Using impact thresholds ensures the right incidents reach the CMT without flooding it with routine technical events.

P1 – Critical incidents demand immediate 24/7 response and executive notification because they cause major business impact, such as widespread service outage or data breach. This severity tier exists precisely to trigger escalation to leadership, satisfying the stem's requirement for executive involvement alongside continuous remediation until service restoration.

Unauthorized privileged account creation is a potential security incident that must be escalated promptly through the established incident response process. The analyst's first duty is to recognize and report, not to remediate independently. Following the documented classification and escalation path ensures the right resources are engaged and that the incident is tracked, prioritized, and handled consistently. This preserves the integrity of the response process and aligns with CISM's emphasis on defined roles and procedures.

Because the contractor's actions may constitute a criminal offense or trigger regulatory notification duties, the security manager must involve legal counsel immediately and ensure forensic evidence is preserved with documented chain of custody. This protects the organization's ability to pursue legal action, support law enforcement, and meet breach notification obligations. Preserving evidence before any further system changes prevents spoliation and keeps the investigation defensible.

A P1 breach of customer PII triggers notification duties under GDPR and similar regimes, plus severe reputational fallout. That combination of regulatory exposure and public trust damage exceeds routine IR handling, so the crisis management team must be activated to coordinate legal, communications and executive response.

Capturing what worked and failed during response feeds directly into revising the IR plan and playbooks, satisfying the stem's demand for the primary reason. This closes the improvement loop, embedding corrective actions into future response procedures rather than merely documenting the incident for compliance or post-mortem reporting purposes.

Pre-approved templates remove drafting delays and standardise wording, so stakeholders receive accurate, timely notifications during high-pressure incidents. This directly satisfies the stem's primary-reason constraint: communication speed and consistency, rather than investigation, containment or forensic accuracy, which other options address.

The communications lead owns the single authoritative voice during a major incident, coordinating internal staff messaging and external stakeholder, media, and regulator communications. This prevents conflicting statements and satisfies the stem's requirement for unified crisis messaging under CMT direction.

Documenting the chain of custody provides an unbroken, auditable record of who handled each artefact, when, and for what purpose. This directly satisfies the litigation constraint in the stem, since courts require proof that evidence remained unaltered from seizure to presentation; gaps or undocumented transfers render it inadmissible regardless of technical accuracy.

P1 critical is defined by major business impact, executive notification and continuous 24/7 response. The stem's three constraints — severe impact, executive escalation and round-the-clock engagement — map precisely onto this highest severity tier, distinguishing it from P2's business-hours handling.

Holding the review within two weeks balances memory retention against operational recovery, satisfying the stem's post-resolution timing constraint. Participants still recall technical details and decisions while the incident remains relevant, yet have had sufficient time to decompress. This window also allows evidence gathering and timeline reconstruction before details fade or staff rotate.

Legal counsel determines whether a litigation hold or preservation duty applies, and the response must respect that obligation. The manager can often restore service using alternate infrastructure, network isolation, or forensic imaging before rebuild, satisfying both operational and legal needs. Consulting counsel first ensures the chosen containment method does not inadvertently destroy evidence and keeps the response defensible.

Feeding lessons learned back into plans and playbooks closes the improvement loop, ensuring the next incident is handled better. This directly satisfies the post-incident phase's objective of institutionalising corrective actions rather than merely restoring service.

A legal hold must be issued first because it immediately suspends routine deletion and alteration of potentially relevant data, preserving evidence and avoiding spoliation sanctions. Subsequent forensic imaging and collection then proceed under that hold's protection.

A retainer establishes pre-negotiated rates, scopes and call-out procedures, so the firm can be mobilised immediately rather than negotiating terms mid-incident. That directly satisfies the stem's constraint of reducing engagement time when every hour of dwell time increases damage.

This is correct because severity should be based on the potential impact to the business, including financial, operational, legal, and reputational consequences. CISM emphasizes that incident severity must reflect business impact. The volume, source, and detection method are secondary to the actual or potential harm to the organization.

If adversaries are inside the environment, any channel they can read or manipulate becomes unsafe for coordination, so the team must fall back to a pre-provisioned out-of-band capability. Pre-establishing and testing it means contact details, credentials, and access methods are already known and will work under pressure, which preserves both the confidentiality of response decisions and the integrity of the coordination process.

The incident response plan is the governing document defining response strategy, team roles, responsibilities, escalation paths and communication procedures organisation-wide. It provides the overarching framework that individual playbooks and procedures sit beneath, satisfying the requirement for an organisation-level strategy.

Lessons learned meetings capture what worked and what failed during the incident, then feed those findings back into the incident response plan and procedures. This directly satisfies the stem's requirement for the primary purpose: systematic improvement of future response capability rather than assigning blame or closing tickets.

An incident response playbook delivers the step-by-step technical instructions the stem demands, mapping specific containment, eradication and recovery actions to a defined incident type. Unlike broader plans or procedures, it prescribes exact commands and decision points, so responders execute consistent, repeatable actions under pressure.

Best practise targets the systemic layer: why the misconfiguration occurred and why change management failed to catch it. Fixing only the firewall setting leaves the governance weakness intact, so the same class of error recurs.

Severity levels are defined in advance against business impact criteria, so the on-call responder can classify an event consistently within minutes and trigger the agreed escalation path. This removes subjective judgement during the most chaotic phase of an incident and ensures the crisis management team is invoked only when the documented thresholds are met.

Sinkholing command-and-control and confirming that no hosts continue to beacon provides concrete evidence that the adversary has lost remote control of compromised systems. This is a strong, observable containment indicator because active implants would keep attempting to reach their infrastructure. It directly demonstrates that the attacker's ability to operate within the environment has been disrupted.

Containment always involves trade-offs: taking systems offline stops the attacker but may disrupt revenue, while leaving them online preserves service but allows further damage. The incident commander must balance these competing risks using business impact analysis and current threat intelligence. This risk-based judgment, aligned with organizational priorities, is the primary guide. Neither technical feasibility alone nor cost alone captures the full decision, which is fundamentally about acceptable risk.

RAM contains highly volatile data such as running processes, network connections, and encryption keys, which are lost when the system is powered off. Collecting RAM first is critical to preserve this evidence. This follows the order of volatility, a fundamental concept in digital forensics. Failing to capture RAM first could result in loss of crucial evidence for the investigation.

Network isolation via EDR contains the threat by cutting command-and-control and lateral movement paths while preserving volatile memory and running processes for forensic analysis. This balances the twin CISM goals of limiting business impact and maintaining evidence integrity, allowing investigators to collect memory, logs, and network state before any destructive action. It is the least disruptive containment step that still stops the attack from spreading to the payment card environment.

Isolating network segments can halt the attacker's lateral movement but may also disrupt critical business services, customer-facing systems, and revenue-generating operations. The incident response manager must weigh the security benefit of containment against the business impact, which is a core CISM principle. This decision requires understanding which systems are critical and what tolerances exist for downtime, ensuring the response aligns with organizational risk appetite.

This is correct because external communications during an incident must comply with laws, regulations, and contracts. For example, data breach notification laws require timely notification to affected parties and regulators. CISM emphasizes that incident response must align with legal and regulatory obligations. This is the primary consideration because failure to comply can result in fines and legal action.

Escalation to the crisis management team exists to mobilize executive decision-making, communications, and resource authority when business objectives or critical services are threatened. Defining thresholds in terms of business impact aligns incident severity with the organization's risk appetite and ensures leadership engages when strategic decisions, regulatory notifications, or customer commitments are at stake.

Legal counsel holds authority over what may be disclosed publicly and what must be reported to regulators, balancing statutory obligations, privilege, and liability. Public statements and regulatory notifications carry legal consequences, so the incident manager must route these decisions through legal. Counsel also determines whether attorney-client privilege should be invoked to protect investigation details from later discovery.

Assigning corrective actions with clear owners and due dates converts findings into accountable, trackable improvements. Without ownership and deadlines, lessons learned remain observations rather than changes. This step ensures the post-incident review produces measurable risk reduction and closes the loop on identified weaknesses, which is essential for continuous improvement of the incident response program.

The immediate priority on confirming active malicious communication is to stop the spread and cut the attacker's control channel. Isolating the terminal halts data exfiltration and lateral movement while keeping the device's state intact for forensic examination. Preserving evidence alongside containment ensures the organization can still determine scope and root cause. This balanced first step protects the business without destroying the information needed to understand the intrusion.

Order of volatility dictates that memory contents, running processes, network connections, and encryption keys are lost on shutdown or reboot. Capturing a forensic image of both RAM and disk preserves the most perishable evidence first, maintaining the chain of custody and enabling later analysis. Without this step, critical artifacts such as active sessions and injected code may be permanently destroyed before remediation begins.

The gap is governance, not technology. Someone must hold pre-delegated authority to make high-impact calls such as taking production offline, and that authority must be documented and endorsed by executives so it is recognized during a crisis. A clear escalation path also tells responders whom to wake at 3 a.m. and who owns the final call when business and security priorities conflict.

The root cause is a governance gap: no change management process governed security control configuration changes, so the email filter misconfiguration went unreviewed. Documenting this management failure addresses the underlying control weakness rather than the phishing symptom.

Issuing a legal hold preserves potentially relevant data and suspends routine deletion, while forensic copies capture the affected systems' state before remediation alters or destroys artefacts. This satisfies the admissibility constraint by maintaining an unbroken chain of custody and preserving original evidence for legal proceedings.

Notification duties vary by jurisdiction in scope, timing, and recipients, so legal expertise is essential to map them accurately. Issuing notices progressively as facts are confirmed satisfies statutory deadlines while avoiding premature or inaccurate disclosures. This approach balances regulatory compliance, customer transparency, and the practical reality that breach investigations evolve over time.

Containment is the immediate priority once an incident is confirmed, because ongoing exfiltration causes continuous business and regulatory harm. Isolating the server stops the loss of customer data while preserving the system state for later forensic analysis and eradication. This aligns with the incident response lifecycle, where containment follows detection and precedes recovery. Delaying containment to gather more information or notify stakeholders allows the attacker to continue extracting data.

Using an employee's credentials to reach customer PII constitutes account compromise: an attacker gained unauthorised access through a legitimate identity rather than malware or a network breach. Disabling the account and remediating addresses the compromised credential itself, confirming this category fits the scenario.

The definitive sign that lessons learned will improve capability is that findings are converted into documented corrective actions with accountable owners and deadlines, then tracked to completion. This closes the loop between analysis and change, ensuring gaps in detection, escalation, or containment are remediated. Tracking to closure also gives management measurable assurance rather than a one-time report.

Involving legal counsel preserves attorney-client privilege by channelling forensic findings through the legal team, since privilege attaches to communications made for legal advice. This satisfies the incident manager's constraint: counsel directs the investigation, and work product produced under their direction remains protected from disclosure during any subsequent criminal proceedings.