CCNA Incident Management Questions

Managing external forensics involves defining scope, ensuring proper evidence handling and chain of custody, maintaining confidentiality, and preserving attorney-client privilege.

Credential compromise incidents, such as account takeover via phishing, are handled by the credential compromise playbook.

Engaging the forensics firm under the direction of legal counsel is the best practice because it extends attorney-client privilege to the investigation. When counsel directs the work, communications and findings are protected as work product, preventing disclosure in litigation. This is a foundational principle in incident response legal strategy.

Ransomware playbooks should include isolating infected systems to prevent spread, as containment is a priority.

The SEC's proposed rules (now final) require publicly traded companies to report material cybersecurity incidents on Form 8-K within 4 business days of determining materiality. This is a specific U.S. securities regulation, not a privacy or payment card standard, and it directly mandates the 4-business-day notification window for material incidents.

The 5 Whys technique is a simple but effective method to drill down from technical cause to process failure to management failure.

GDPR requires notification within 72 hours of becoming aware of the breach.

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Chain of custody documentation is essential for evidence integrity and admissibility.

The primary purpose is to incorporate improvements to prevent recurrence and improve response effectiveness.

Common severity levels include P1 (critical), P2 (high), P3 (medium), and P4 (low). P0 is not standard; P5 is not used.

Exercises validate the effectiveness of the plan and identify gaps before a real incident.

Third-party contacts such as legal firms, forensic investigators, PR agencies, and insurance providers are essential for incident response. Internal contacts are separate.

If the MTD is at risk, the incident response team should escalate to BC/DR to activate continuity or recovery plans. This ensures business functions are restored.

The CMT typically includes the CEO and CISO, among others, to make strategic decisions.

Having a pre-existing retainer agreement reduces time to engage and ensures terms are already in place.

Root cause analysis should continue to identify why the password policy was not enforced or why it was inadequate, which is a process failure.

The BC/DR plan typically specifies a designated authority, such as the CEO or a crisis management team, to declare a disaster when MTD is breached.

An insider threat is the correct category because it specifically involves harm caused by individuals within the organization, whether through malicious intent (e.g., data exfiltration, sabotage) or accidental actions (e.g., misconfiguration, phishing click). This aligns with the CISM definition of insider threats as incidents originating from employees, contractors, or trusted partners who have authorized access to information systems.

The crisis management team is typically activated by the incident response manager or a designated authority when an incident has major business impact. The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications lead.

Lessons learned meetings are designed to identify strengths and weaknesses in the incident response process and to implement improvements.

A legal hold is essential because it suspends the normal data retention and deletion policies, ensuring that potentially relevant evidence is preserved from alteration or destruction. This is a foundational step in the e-discovery process and directly supports the admissibility of evidence by demonstrating that the organization took proactive steps to prevent spoliation.

Regulatory notifications must include a description of the incident, data involved, and mitigation steps, while avoiding speculation.

Root cause analysis should identify technical, process, and management failures.

P2 incidents require management notification and a response during business hours.

Supply chain incidents require specific procedures for vendor coordination, technical response, and communication.

Legal hold prevents spoliation of evidence; it must be issued before any remediation that could alter data.

The IR plan should include pre-established contacts and procedures; contacting the ISP and mitigation service should follow the plan's escalation process.

Preserving evidence includes creating forensic images and issuing legal holds to prevent spoliation. Disconnecting systems without imaging and rebooting can destroy evidence.

Lessons learned meetings aim to identify what happened, what worked well, and what didn't, and to develop recommendations for improvement. Sharing IoCs with ISACs is a separate activity, not a meeting objective.

For a P1 incident, the IR plan dictates immediate containment to prevent further spread, followed by notification to the executive sponsor and activation of the crisis management team.

The primary reason for a pre-established forensic retainer agreement is to reduce the time needed to bring forensic experts on board during an incident. In incident management, every minute of delay can allow an attacker to exfiltrate data or destroy evidence; a retainer bypasses the procurement and contracting process, enabling immediate deployment of the forensic team to preserve volatile memory and capture network artifacts.

The 5 Whys should drill down from technical cause to process failure to management/governance failure, as per the domain content.

During a P1 incident, the CMT must provide timely, concise updates to the board to maintain trust and enable strategic decisions. Option A is correct because it balances frequency (hourly) with content discipline (avoiding speculation) and includes legal counsel review, which is critical for compliance and liability management. This aligns with the CISM Incident Management domain's emphasis on clear, non-technical communication to senior leadership.

Playbooks are tailored to incident types; credential compromise has its own specific playbook.

When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation.

The immediate priority in ransomware containment is to prevent lateral movement and further encryption of systems. Disconnecting the server from the network (e.g., unplugging the Ethernet cable or disabling the virtual switch port) stops the ransomware from communicating with its command-and-control (C2) server and encrypting additional network shares. This aligns with the NIST SP 800-61 incident response containment strategy, which emphasizes isolation before any other action.

Root cause analysis should uncover not just technical causes but also the process and governance failures that allowed the misconfiguration. Addressing the management failure (e.g., inadequate change management) provides a systemic fix.

An IR programme must include a formal policy and a documented plan. Playbooks are also important but the core components are policy and plan.

When an incident cannot be resolved within the MTD, it triggers the transition to business continuity and disaster recovery (BC/DR) plans to maintain critical operations.

Best practices recommend holding the lessons learned meeting within two weeks of incident resolution to capture details while they are fresh.

In a P1 ransomware incident, the incident response manager (IRM) is responsible for orchestrating the overall response, prioritizing containment over eradication, and ensuring that executive leadership receives timely, accurate status updates. Unlike technical roles, the IRM owns the incident command structure, coordinates cross-functional teams, and manages communication escalations to stakeholders, which is critical when encrypted servers demand immediate business continuity decisions.

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Legal counsel ensures that actions taken during an incident preserve attorney-client privilege and comply with legal obligations, such as breach notification and litigation holds.

A pre-established retainer reduces the time to engage a forensics firm during an incident, ensuring rapid response.

For critical incidents, hourly sitreps (situation reports) are recommended to keep executives informed. Avoiding speculation and preserving legal privilege with counsel involvement are also key.

When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation to restore operations.

P2 incidents are high severity with significant impact, requiring management notification and response during business hours.

The crisis management team (CMT) is responsible for high-level strategic decisions, including approving external communications and public statements to manage reputation and legal exposure during a major cybersecurity incident. This aligns with the CMT's role in coordinating response efforts and ensuring consistent messaging, as defined in incident management frameworks like NIST SP 800-61.

The IR plan includes the IR team roster and contact list, and communication templates. Procedures for specific incident types are typically in separate playbooks.

Essential components include the IR team roster and contact list, and communication templates for consistent messaging.

A P2 (high) incident requires a response during business hours with management notification, as defined by the incident severity classification. This ensures that the incident is addressed promptly within operational hours while keeping management informed for potential escalation or resource allocation.

The '5 Whys' should drill deeper to uncover process and management failures that allowed the technical vulnerability to exist.

Sharing IoCs with an ISAC (Information Sharing and Analysis Center) helps the broader community defend against similar attacks, which is a key post-incident activity.

The CMT includes senior leaders such as the CEO, CFO, CISO, General Counsel, and Communications head to handle strategic decisions and external communications.

Insider threats require specific playbooks and involvement of HR and legal for proper handling.

During a P1 incident, the CEO requires a concise, actionable sitrep focused on containment status, confirmed facts, and actions taken. Legal counsel input is critical to avoid premature attribution or disclosure that could create liability or violate data breach notification laws. This aligns with the CISM incident management principle of providing decision-ready information to executive leadership without technical clutter.

P1 (critical) incidents have major business impact and require executive notification and around-the-clock response.

The IR team typically includes an IR manager, security analysts, forensic investigators, communications lead, legal counsel, and executive sponsor.

The CEO provides strategic direction and approves major decisions, such as activating business continuity or communicating externally, while the CISO leads the technical response.

Directing forensic investigators to report directly to legal counsel and marking all deliverables as privileged establishes a clear legal framework for attorney-client privilege. This ensures that communications and work product are protected from discovery in litigation, as they are created under the direction of legal counsel for the purpose of providing legal advice.

IR policy and IR plan are core components; vendor contacts are part of the plan, and BIA is not a direct IR component.

P2 incidents require management notification and response during business hours.

Conducting the meeting within two weeks ensures details are fresh and improvements can be implemented quickly.

To preserve attorney-client privilege, communications and work product must be kept confidential and not shared with third parties unless protected by common interest or waiver.

P2 (high) incidents require a response during business hours, as they have significant but not critical impact.

Potential for major financial loss or regulatory penalties and severe reputational damage are key triggers for CMT activation. Technical complexity alone is not sufficient.

Evidence handling procedures and chain of custody documentation are essential for preserving evidence integrity.

A P3 (medium) incident is defined as having limited impact on business operations, allowing for a standard response during normal business hours without requiring immediate escalation. This classification typically applies to incidents that do not affect critical systems or sensitive data, and can be resolved through normal change management processes without urgent intervention.

Sharing IoCs with ISACs is a post-incident activity aimed at improving collective defense and preventing future incidents.

The General Counsel (GC) is a critical member of the CMT because a major cybersecurity incident (e.g., a data breach involving PII) triggers legal obligations under regulations like GDPR, HIPAA, or SOX. The GC provides real-time advice on legal hold, breach notification timelines, and attorney-client privilege, ensuring the organization's response does not create additional liability or waive legal protections.