CCNA Incident Management Questions

Notifying executive leadership first satisfies the P1 escalation requirement, ensuring senior management can authorise crisis resources and fulfil governance duties. Executives need immediate awareness to make strategic decisions, manage regulatory exposure and coordinate external messaging, whereas technical containment proceeds in parallel. This aligns with incident response escalation protocols prioritising executive notification for critical incidents.

The security analyst is a core incident response team role, performing detection, triage and initial containment of the event. This hands-on technical function is consistently listed alongside incident lead, forensics and communications roles in typical CISM team structures.

A security analyst performs hands-on triage and evidence collection, an operational role rather than a strategic one. The CMT comprises decision-makers such as the CISO, legal counsel, communications and business leaders who authorise response and manage enterprise impact, so the analyst supports the team rather than sitting on it.

A major breach demands skills, surge capacity, and objectivity that most internal teams cannot sustain while also running day-to-day security. External investigators bring specialized tooling and prior case experience, and their independent findings carry more weight with regulators, courts, card brands, and insurers. Engaging outside counsel also helps structure the work under privilege, protecting sensitive analysis from later disclosure.

Evidence collection belongs to the containment, eradication, and recovery phase, where volatile data such as memory, logs, and network captures must be preserved before systems are rebuilt or wiped. This satisfies the stem's legal-action constraint, since forensic artefacts degrade or vanish once recovery overwrites affected hosts.

When recovery cannot be achieved within the maximum tolerable downtime, the incident exceeds incident management's remit and threatens critical service delivery. Escalating to business continuity and disaster recovery teams activates alternate recovery strategies, restoring operations within acceptable timeframes as best practise dictates.

Decisions about engaging outside counsel, invoking privilege, and timing regulatory notification carry enterprise legal and reputational consequences that exceed the tactical team's remit. The crisis management team is chartered to make these governance-level calls because they affect the whole organization, require executive authority, and often involve the board. Tactical responders supply technical facts, but the authority to commit the enterprise to a disclosure position belongs at this strategic layer.

Including an alternate incident response manager ensures continuity of leadership if the primary is unavailable. This is a critical component of incident response planning, as it prevents delays in decision-making during a crisis. The alternate should have the same authority and training as the primary. This addresses the gap directly and is a best practice for business continuity and incident management.

Lasting improvement requires converting findings into owned, time-bound actions that are tracked until verified complete. This creates accountability and makes gaps visible to management. Tracking to closure also provides evidence for auditors and regulators that the organisation acted on the incident rather than merely documenting it, which is the essence of an effective lessons-learned process.

Ransomware demands a dedicated playbook because its encryption, extortion and recovery steps differ fundamentally from other incidents. A predefined sequence covering isolation, backup validation, decryption decisions and ransom policy enables rapid, consistent containment, matching the stem's call for playbooks tailored to distinct incident types.

An incident response policy provides the mandate and framework for the programme, while procedures detail the steps to follow during an incident. These documents ensure consistent and effective response, define roles and responsibilities, and align with business objectives. Without them, response efforts may be ad hoc and inefficient. They are foundational components that must be established before an incident occurs.

RCA examines the underlying process and governance failures that permitted the incident, not merely the technical trigger. This satisfies the stem's demand for the primary purpose: preventing recurrence by correcting systemic weaknesses in controls, oversight and decision-making, rather than attributing blame or documenting the event itself.

Insider threat covers misuse by employees, contractors or partners holding legitimate access, so it directly satisfies the stem's requirement that the actor be an individual within the organization. Unlike external attacks, the access is authorised initially, making detection harder and distinguishing it from other incident categories.

P1 Critical denotes the highest severity, where business-critical systems or data are affected, so the plan mandates immediate round-the-clock response and escalation to executives. This satisfies the stem's requirement linking executive notification with continuous 24/7 response.

Updating plans and playbooks converts lessons-learned findings into revised procedures, directly satisfying the stem's requirement for effective future incident response. Unlike awareness or reporting changes, this closes the loop by embedding corrective actions into documented, repeatable steps responders follow under pressure, ensuring the same failures are not repeated.

After containment, eradication, and recovery, CISM emphasizes performing a post-incident review to identify root causes, evaluate the effectiveness of the response, and feed improvements back into the incident response plan and security controls. This is the correct next step because it transforms the incident into actionable organizational learning rather than simply returning to a normal state without any improvement.

Chain of custody documentation records who handled the backup media, when, and how, proving evidence integrity. Without it, encrypted media may be ruled inadmissible, undermining litigation. It directly satisfies the stem's requirement to preserve documentation critical for potential legal proceedings.

The communications lead owns external messaging, translating technical incident details into statements for customers, regulators and the media. This satisfies the stem's coordination constraint by centralising stakeholder communication, preventing engineers or executives from issuing conflicting accounts. Unlike the incident commander, who directs containment and recovery, this role carries no operational authority over remediation.

A playbook provides prescriptive, step-by-step technical procedures for a specific incident type, such as ransomware or phishing. This contrasts with the broader incident response plan, which sets policy, roles and lifecycle phases rather than granular remediation actions.

Updating the IR plan and playbooks translates lessons learned into revised procedures, contacts and decision criteria, ensuring the next response benefits from the post-incident review. This satisfies the stem's requirement directly, since documentation changes are the mechanism by which findings actually alter future incident handling.

Playbooks translate the incident response plan into documented, step-by-step procedures for a specific incident category, such as ransomware or data breach. This granular, scenario-specific detail is precisely what the stem requests, distinguishing playbooks from broader plans, policies and general procedures.

When containment is achieved but recovery threatens to exceed the tolerance of manual workarounds, the decision to invoke the business continuity plan involves enterprise trade-offs beyond the incident response team's authority. Escalating to the CMT ensures executives can authorize alternate processing sites, customer communications, or resource commitments before the workaround fails, preventing an avoidable operational outage.

The communications lead owns the organization's external messaging, including media statements, public disclosures, and stakeholder updates. During a high-profile incident, this role works with legal, executive leadership, and the incident response manager to ensure accurate, consistent, and timely communication while protecting the organization's reputation and meeting disclosure obligations.

A single pre-authorized spokesperson with a defined approval chain ensures consistent, legally reviewed messaging and prevents conflicting statements to regulators, law enforcement, and media. This directly addresses the CISO's need for coordinated and defensible external communications before, during, and after a high-severity breach, and it aligns with CISM guidance on incident communication roles and escalation paths.

Hourly sitreps match the tempo a P1 ransomware crisis demands, where encryption spreads and containment decisions change rapidly. Executives need current impact and recovery status to authorise escalation and communications, so a fixed hourly cadence prevents stale information during the critical early containment window.

Before notifying regulators or affected individuals, the organization must understand exactly what data was compromised, how many records, and which jurisdictions are affected. This impact assessment informs legal notification obligations and the content of notifications. It is a critical step to ensure accurate and compliant reporting, and it aligns with CISM's emphasis on risk assessment and legal coordination during incident recovery.

SEC rules permit filing with incomplete details provided you amend promptly, so filing within the 4-business-day deadline satisfies the reporting constraint while updates cover the ongoing investigation. Waiting for full findings breaches the deadline; silence is not an option.

Containment stops spread but leaves malicious artefacts resident. Eradication removes malware, persistence mechanisms, and compromised accounts, after which systems are restored from trusted backups. This follows the incident management lifecycle sequence, so eradication and restoration is the next step after containment.

Conducting lessons learned within two weeks, while details remain fresh, enables prompt revision of the incident response plan and playbooks. This directly satisfies the stem's primary purpose, embedding findings into documented procedures before organisational memory fades.

P1 Critical is reserved for incidents causing major business disruption, such as encrypted critical servers halting operations. It triggers immediate escalation, full crisis team activation and continuous response until resolved, matching the severity criteria stated in the stem.

Chain of custody preserves evidence integrity so it remains admissible in legal or disciplinary proceedings. When an external firm handles artefacts, unbroken documented transfer records satisfy the evidentiary constraint the scenario demands, preventing challenges to forensic findings.

Forensic evidence must remain admissible and defensible, which requires verifiable integrity and unbroken custody. Hashing the images at acquisition proves they were not altered, while a documented chain of custody records every transfer, and a restricted repository prevents tampering. Because litigation is still undecided, preserving evidence in this rigorous manner keeps all options open. This approach satisfies both internal investigation needs and potential legal proceedings without prejudging the outcome.

Phishing that yields unauthorised account access is credential compromise, so the credential compromise playbook prescribes password resets, session revocation, MFA enforcement and account monitoring. A malware or data breach playbook would not address the stolen-credential vector that enabled the intrusion.

Engaging the forensics firm under legal counsel's direction extends attorney-client privilege to the firm's work product, satisfying the stem's privilege-preservation constraint. Counsel retains the vendor, directs the investigation, and receives findings, so communications and deliverables fall within privilege rather than becoming discoverable business records.

Predefined templates accelerate communication during high-pressure incidents and ensure consistent, accurate messaging. They reduce the risk of ad hoc statements that could create legal or reputational problems. CISM recommends preparing templates for internal staff, customers, regulators, and media in advance. This directly improves the organization's ability to communicate effectively when time and attention are constrained.

Isolating affected systems cuts command-and-control and lateral movement paths, preventing the ransomware from spreading to further hosts before eradication and recovery begin. This satisfies the stem's requirement for a key playbook step, and preserves the isolated systems for later forensic examination.

An incident response policy supplies the mandated authority, scope and governance framework that best practice requires before any procedural or technical capability is built. It defines roles, escalation thresholds and management commitment, satisfying the programme's foundational requirement. Without it, plans and playbooks lack approved direction, so this option is a required component.

5 Whys iteratively probes causal layers beyond the immediate actor, exposing management governance failures such as inadequate segregation of duties, absent oversight or weak policy enforcement. Technical tools identify what happened; only causal questioning reaches the underlying governance deficiency that enabled the insider threat.

GDPR Article 33 mandates notifying the supervisory authority within 72 hours of becoming aware of a personal data breach, unless it poses no risk to rights and freedoms. This precise deadline directly satisfies the question's maximum timeframe requirement.

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in risk to data subjects. This fixed regulatory deadline is the constraint the incident manager must satisfy.

Lessons learned exists to close the gap between planned and actual response. Feeding findings back into the plan incorporates corrective improvements, reducing the likelihood of recurrence and strengthening future response capability, which is the stated primary purpose of the update.

A documented chain of custody, cryptographic hashes, and access controls preserve evidence integrity and demonstrate that it has not been altered. This is essential for admissibility in legal proceedings and for defending investigative conclusions. CISM emphasizes that evidence handling procedures must be defined before incidents occur and followed rigorously, especially when criminal prosecution or regulatory action is possible.

Exercising the playbook validates that documented procedures actually work under realistic ransomware conditions, exposing gaps such as unclear escalation paths, missing containment steps or untested recovery dependencies. This directly satisfies the stem's test objective: confirming the plan's effectiveness and surfacing improvement areas before a real incident, rather than merely reviewing documentation.

Severity exists to align response effort and escalation with the harm an incident can cause, so it must be derived from business impact and asset criticality. This lets the same event type be rated differently depending on which systems and data are touched. It also produces consistent, defensible escalation to management, which is exactly what the incident response plan and governance require.

External legal counsel sits outside the organisation yet is engaged during incidents for breach notification, regulatory and privilege advice. Listing them as a vendor contact satisfies the stem's requirement for an external stakeholder, since internal roles such as the CISO or IT staff are not external parties.

Capturing volatile data first preserves memory-resident evidence, active network connections, and encryption keys that would be lost on shutdown. Isolating the system from the network afterward prevents remote tampering or further data exfiltration while maintaining the system state. This sequence aligns with forensic best practices and supports legal preservation requirements, making it the most defensible first action in this scenario.

Eradication focuses on eliminating the root cause and any residual malicious components so the threat cannot recur. Transitioning from containment to eradication means the organization has stabilized the situation and can now remove the threat. Recovery, which follows, restores systems to normal operation. Performing eradication first prevents reinfection during recovery and is the defining activity of this phase.

Notification obligations are driven by the classification of the data involved and the laws or regulations that apply to the organization, such as privacy statutes, industry rules, or contractual requirements. Determining whether personal, financial, or health information was exposed, and in which jurisdictions, allows legal counsel and compliance to assess mandatory reporting timelines and thresholds accurately.

Once recovery cannot meet the maximum tolerable downtime, the incident exceeds IT response capability and becomes a business continuity matter. Escalating to the BC/DR team enables assessment and possible activation of continuity plans to sustain critical business functions.

Clear roles and current contact information let the team mobilize quickly and avoid confusion about who decides, who communicates, and who executes. This is foundational to any response capability because incidents rarely occur during business hours with everyone available. Without defined responsibilities, response stalls at the moment speed matters most, increasing impact and cost.

Root cause analysis examines logs, forensic artifacts, and timeline data to determine how the attacker gained entry, such as a phishing email, exposed service, or stolen credential. Identifying and remediating that vector prevents recurrence and informs improvements to controls, monitoring, and the incident response plan. It also supports lessons learned and any regulatory or insurance reporting requirements.

Network isolation stops command-and-control communication and lateral movement while keeping the system running so memory, active connections, and process state can be captured. This preserves volatile evidence and supports scoping the intrusion, satisfying both containment and investigation needs. It is the standard balanced approach when a system must be contained without destroying forensic value.

Breach notification obligations vary by jurisdiction and often carry strict deadlines, content requirements, and prescribed recipients. Legal counsel must review external communications to avoid conflicting statements, waiving privileges, or missing mandatory timelines. Aligning messages with regulatory requirements protects the organization from penalties and ensures affected parties receive accurate, timely information while the investigation continues.

Declaring a disaster exceeds operational incident authority, requiring executive mandate to commit organisation-wide resources and invoke continuity arrangements. The CEO or designated crisis management team holds that strategic authority, satisfying the stem's MTD-exceeded escalation trigger.

This is correct because after containment, the next phase in the incident response lifecycle is eradication. Eradication involves removing the cause of the incident, such as malware, backdoors, or vulnerabilities, to prevent recurrence. CISM follows the standard incident response phases: preparation, identification, containment, eradication, recovery, and lessons learned. Eradication must be completed before recovery to ensure the environment is clean.

Insider threats uniquely cover harm caused by employees, whether malicious or accidental, matching the stem's requirement for internal actors. Unlike external categories such as hacktivists or nation-states, this classification hinges on the actor's authorised access and trusted position within the organisation, satisfying the intent and origin constraints.

The meeting's output is corrective: identified gaps, control failures and response weaknesses are translated into revised procedures, playbooks and controls. Without feeding findings back into the plan, the same deficiencies recur, so plan and playbook updates are the primary purpose rather than blame allocation or reporting.

A legal hold preserves relevant data and prevents routine deletion or alteration once litigation is reasonably anticipated. Issuing it early satisfies the admissibility requirement by ensuring potentially relevant evidence remains intact and available for forensic collection and court presentation.

Root cause analysis must extend beyond the immediate technical trigger to the governance layer. Examining the management or governance failure that permitted the process failure to persist identifies systemic accountability gaps, enabling corrective controls that prevent similar PII breaches recurring.

Isolation procedures contain the supply chain compromise by severing affected systems and network segments, preventing lateral spread to internal assets and other partners. This satisfies the playbook requirement for a containment element that limits operational and data exposure during an active incident.

Legal and regulatory requirements, such as GDPR, HIPAA, or state breach notification laws, mandate when and how affected individuals must be notified. These requirements are the primary consideration because failure to comply can result in fines, legal action, and reputational damage. The organization must assess the breach against these laws to determine its obligations.

A legal hold immediately suspends routine deletion and preserves all relevant data, satisfying the stem's requirement to preserve evidence first. Issuing it before forensic imaging or notification prevents spoliation, ensuring evidence remains admissible for potential litigation.

A bit-for-bit image captures the complete disk contents, including slack space and deleted data, while leaving the original evidence unaltered for examination. This satisfies the stem's requirement for preserving evidence, maintaining chain of custody and enabling repeatable analysis without contaminating the source.

Reviewing what worked and what failed directly satisfies the stem's requirement to identify improvement areas, feeding corrective actions back into the incident response plan. This retrospective analysis exposes control gaps and successful practices, enabling Microsoft Entra ID and other security measures to be tuned against future threats.

Disabling the compromised accounts and resetting passwords immediately terminates the attacker's access and blocks further misuse of those credentials. This containment step precedes deeper investigation, satisfying best practise of stopping active unauthorised access before scoping the full extent of the breach.

Isolating encrypted servers halts lateral spread and further encryption, preserving remaining evidence and business functions before eradication or recovery begins. Containment is the prescribed first phase for a P1 ransomware event, since every minute of continued network access increases damage.

A retainer pre-negotiates rates, scope, contacts and mobilisation terms, so specialists can be engaged immediately when an incident occurs. This directly removes procurement and contracting delays, preserving volatile evidence and meeting breach notification timelines that would otherwise be missed.

This is correct because the containment decision must balance business impact against security risk. The incident response manager should assess how critical the server is to business operations and the potential damage if the attacker remains. This aligns with CISM's focus on aligning incident response with business objectives. The other options are less directly relevant to the immediate containment trade-off.

Hourly brief status reports satisfy the board's need for timely assurance during a P1 while avoiding speculation that could create legal or disclosure risk. Legal counsel review ensures privileged, accurate messaging, aligning with crisis communication governance. This balances transparency with containment, meeting the CMT's obligation to inform directors without premature commitment.

Isolating the endpoint from the network stops active C2 communication and potential lateral movement while preserving volatile evidence in memory and existing connections. Escalating per the incident response plan ensures the incident is triaged at the appropriate severity, the right stakeholders are notified, and containment, eradication, and recovery activities proceed in a coordinated and documented manner.

A credential compromise playbook prescribes the exact sequence for this incident type: revoking active sessions and refresh tokens, forcing password resets, and checking for persistence. Generic playbooks lack these credential-specific steps, so they cannot satisfy the stem's requirement to contain the compromised identity before lateral movement.

When the attack cannot be contained within the maximum tolerable downtime, the incident shifts from response to continuity: activating BC and DR plans restores critical services via alternate arrangements. This satisfies the MTD constraint by prioritising service delivery over attack mitigation.

Isolating the server severs command-and-control and lateral movement paths, halting encryption spread before containment, eradication and recovery proceed. This satisfies the stem's requirement for the first action in the ransomware playbook, since evidence remains intact on the disconnected host.

The 5 Whys exposed a governance gap: unauthorised firewall configuration changes were possible. Change management enforces approval, testing and documentation for configuration alterations, directly addressing that root cause. Patching or monitoring alone would not prevent recurrence of the underlying control weakness.

A structured lessons-learned review captures what worked and what failed while details are fresh, and converting findings into assigned improvement actions ensures the organization actually changes. Without this step, the same weaknesses recur in future incidents. Including both responders and stakeholders broadens perspective, covering technical, process, and communication gaps, and produces prioritized remediation items with owners and due dates.