CCNA Incident Management Questions

Having a pre-negotiated contract reduces the time to engage forensic experts, which is critical during an incident.

If an incident cannot be resolved within the MTD, it should transition to BC/DR activation. The decision authority (e.g., CISO or CMT) should declare a disaster.

The CMT handles strategic decisions, communication, and resource allocation, while the IR team focuses on technical response.

A tabletop exercise is a discussion-based exercise where team members walk through a scenario to identify strengths and gaps.

Playbooks (or runbooks) provide detailed procedures for specific incident types, while the IR plan is a broader document.

The IR policy requires senior management approval to demonstrate organizational commitment and allocate necessary resources.

The primary purpose of a pre-established forensic retainer agreement is to reduce the time to engage during an incident. By having a contract already in place, the organization can bypass procurement and legal review delays, enabling the forensics firm to begin work immediately when an incident occurs, which is critical for preserving volatile evidence and minimizing damage.

The CEO is correct because as the highest-ranking executive, they provide strategic direction, authorize critical decisions (e.g., public disclosure, resource allocation), and serve as the primary liaison to the board of directors during a major incident. The GC is correct because they manage legal risks, ensure compliance with breach notification laws (e.g., GDPR, CCPA), and oversee communications with regulators and law enforcement. The CFO is correct because they assess financial impacts, approve emergency budgets, and coordinate with insurance carriers for cyber liability claims.

When an incident cannot be resolved within MTD, it escalates to business continuity/disaster recovery activation to restore operations.

Lessons learned meetings should occur within two weeks of incident resolution while details are fresh, to capture accurate feedback and improve the IR plan.

The 5 Whys technique is a simple root cause analysis method that iteratively asks 'why' to move from symptoms to root causes.

A P1 critical-severity ransomware attack encrypting critical systems requires immediate activation of the crisis management team because it poses an existential threat to business operations, often involving legal, PR, executive, and regulatory stakeholders. The crisis management team handles incidents that exceed the capacity of the incident response team, typically those with high business impact, widespread system compromise, or potential for significant financial/reputational damage.

The IR manager leads the team, coordinates activities, and classifies incidents based on severity.

When litigation is anticipated, a legal hold must be issued to prevent destruction of relevant evidence, and forensic copies should be made before remediation.

When MTD is exceeded, the incident escalates to business continuity/disaster recovery activation. The BC/DR decision authority should be notified to declare a disaster and activate recovery plans.

An IR team with defined roles and a signed retainer with a forensics firm are critical preparatory elements. The IR plan is also prepared, but the question asks for components established before an incident.

The scenario describes an account compromise where credentials are likely stolen and used to gain unauthorized access.

Communication templates should include the incident description, affected parties, and guidance on actions to take. Technical details and attacker attribution are not typically included in templates.

Sharing IoCs helps other organizations detect and defend against similar threats, improving collective security.

For critical incidents, regular and frequent communication is required to keep executives informed.

Engaging the forensic firm through legal counsel and having them work under the direction of legal helps protect communications under attorney-client privilege. Direct engagement by the business may waive privilege.

Root cause analysis (RCA) digs into multiple layers to find underlying issues, often using techniques like 5 Whys or fishbone diagrams.

Rapid activation of the IR team depends on knowing who to contact and their backup.

For P1 (critical) incidents, hourly situation reports (sitreps) are expected to keep executives informed of rapidly evolving events.

GDPR requires notification within 72 hours. The SEC proposed rule requires notification within 4 business days for material cybersecurity incidents.

The executive sponsor provides authority, resources, and strategic direction, and ensures the IR team has the support needed to respond effectively.

GDPR Article 33 requires notification within 72 hours of becoming aware of the breach.

Legal counsel involvement helps protect communications under attorney-client privilege and avoids speculation that could create liability.

P1 (Critical) incidents have major business impact, require executive notification, and demand a 24/7 response effort.

A P1 data breach involving customer PII triggers mandatory breach notification laws (e.g., GDPR Article 33, HIPAA Breach Notification Rule) and often requires immediate CMT activation to manage regulatory filings, legal liability, and public relations. The CMT is designed for high-severity incidents with significant business, legal, or reputational consequences, which a P1 breach directly entails.

The lessons learned meeting aims to identify improvements to the incident response process.

Communication templates ensure that notifications are consistent, accurate, and timely during the stress of an incident, reducing the risk of errors or omissions.

The communications lead manages external and internal messaging, including media and customer notifications.

Admissibility of digital evidence in court hinges on demonstrating that the evidence has not been tampered with from the moment of collection to presentation. The chain of custody is the legally mandated documentation that tracks every person who handled the evidence, the time and date of each transfer, and the purpose of each action. Without a complete and verifiable chain of custody, the opposing counsel can successfully argue that the evidence may have been altered, making it inadmissible regardless of how securely it was stored or imaged.

P1 (critical) incidents have the highest severity and require immediate, around-the-clock response.

Industry best practices and many frameworks recommend holding a lessons learned meeting within two weeks of incident resolution while details are still fresh.

The IR plan provides a structured approach to manage incidents, minimizing impact and ensuring efficient response.

Immediate containment and notification of key internal stakeholders (executive sponsor, legal, communications) is the first priority to coordinate response and manage legal/regulatory obligations.

Root cause analysis, updating the IR plan/playbooks, and sharing IoCs with ISACs are all post-incident activities. Activating the DR site occurs during the response, not post-incident.

Issuing a legal hold ensures that all relevant data is preserved and not deleted, which is the first step in evidence preservation.

The primary purpose of a pre-established contract with a digital forensics firm is to eliminate procurement delays during an incident. When an incident occurs, time is critical; having a signed contract in place allows the firm to be engaged immediately without waiting for legal or administrative approvals, which directly supports the incident response goal of minimizing damage and preserving evidence.

The incident response plan provides the high-level strategy and coordination framework.

Lessons learned aims to improve future response by identifying what worked and what didn't.

C is correct because an incident response playbook provides detailed, step-by-step technical instructions for handling a specific type of security incident (e.g., ransomware, DDoS, phishing). Unlike the higher-level incident response plan, a playbook contains precise technical actions, such as commands to isolate a host, indicators of compromise (IOCs) to block, and escalation criteria tailored to a particular threat.

Root cause analysis should identify not only the technical cause but also the process and management failures that allowed the misconfiguration to occur.

The technical cause is the phishing email, the process failure is the lack of review of email filter configurations, and the management/governance failure is the absence of a change management process for security controls.

Preserving the chain of custody and ensuring forensic copies are made before remediation is critical for evidence admissibility. Legal hold ensures that relevant data is preserved.

Option C is correct because the incident involves unauthorized use of legitimate credentials to access a sensitive database, which is the defining characteristic of an account compromise. The immediate disabling of the account and remediation aligns with standard incident response procedures for credential theft, where the attacker has gained authenticated access without authorization. This is distinct from a data breach, which focuses on the exfiltration or exposure of data, not the method of access.

Before any remediation, preserving evidence (forensic image) is critical for investigation and potential legal action. Then notify the incident manager to follow the playbook.

Involving legal counsel is essential to establish and preserve attorney-client privilege over the forensic investigation. Legal counsel can direct the scope of the investigation, issue a 'Kovel letter' to engage the external forensics firm as an agent of the attorney, and ensure that all communications and findings are protected under the work-product doctrine. Without this step, any evidence of criminal activity could be deemed discoverable and waive privilege, potentially compromising the organization's legal defense.

Internal communication, especially to executives, is typically the first priority to ensure leadership is informed.

The IR team includes security analysts, forensic investigators, and legal counsel; the CMT includes executives like CEO; HR is not a standard IR role.

The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications; a security analyst is part of the incident response team, not the CMT.

Evidence collection should occur during containment, eradication, and recovery, but ideally before remediation to preserve forensic data. In a DDoS, logs and traffic captures should be preserved early.

If MTD cannot be met, business continuity or disaster recovery plans should be activated.

The proposed SEC rules require reporting within 4 business days for material cybersecurity incidents. GDPR requires 72 hours for personal data breaches.

Ransomware and data breach are common incident types that require specific procedures.

RCA aims to identify underlying causes to prevent recurrence. While it may involve understanding the technical cause, the ultimate goal is to improve processes and controls.

Insider threat incidents are caused by employees, contractors, or other trusted insiders.

P1 — Critical incidents, such as a complete system outage or data breach, require immediate executive notification and a 24/7 response because they pose an imminent threat to business operations, legal compliance, or data integrity. This severity level triggers the highest escalation path, often involving the CEO, CISO, and legal counsel, with round-the-clock resource allocation to contain and remediate the issue.

P1 (critical) incidents have major business impact and require immediate executive notification and round-the-clock response.

The primary outcome of a lessons learned meeting is to identify improvements and update the IR plan, not just document or blame.

Chain of custody documentation is essential to prove the integrity and admissibility of digital evidence in court.

The communications lead handles external messaging to ensure consistency and accuracy.

An incident response playbook provides detailed, step-by-step technical procedures for handling specific incident types (e.g., ransomware, DDoS, phishing). Unlike higher-level documents, playbooks contain actionable commands, tool-specific instructions, and decision trees that guide responders through containment, eradication, and recovery. This granularity ensures consistent and efficient execution during an active security event.

Updating the IR plan and playbooks based on lessons learned is the definitive post-incident activity that directly incorporates findings from the after-action review into the operational documentation. This ensures the plan reflects actual gaps or improvements identified during the incident, making it actionable for future events. Without this update, the plan remains static and fails to evolve with the organization's threat landscape.

Playbooks are specific to incident types (e.g., ransomware) and provide step-by-step guidance, whereas the IR plan is a high-level document and policy sets overall intent.

Internal communications during an incident should provide clear guidance to employees on actions they need to take, such as not connecting devices, while avoiding speculation or blame.

Involving legal counsel in communications can help preserve attorney-client privilege. The sitrep should avoid speculation and include legal counsel input.

For P1 incidents, hourly sitreps keep executives informed of rapidly evolving situations.

Regulatory deadlines must be met even if information is incomplete; disclose what is known and update later.

After containment, the next priority is eradication of the threat to remove all traces of the malware and restore systems securely.

The main goal is to improve future incident response by identifying what worked and what didn't.

Ransomware and insider threat are defined incident categories; phishing is a technique, not a category; vulnerability is a condition; theft is too broad.

A ransomware attack with major business impact is a critical incident (P1), requiring executive notification and 24/7 response.