CCNA Incident Management Questions

The incident response plan is an essential programme component, defining scope, roles, escalation paths, communication procedures and response phases. Without it, teams lack a coordinated, repeatable approach to detecting, containing and recovering from incidents, undermining the entire programme's effectiveness.

Exceeding the maximum tolerable downtime means recovery within the primary environment is no longer viable, so escalating to activate business continuity and disaster recovery plans restores critical services through alternate arrangements. This directly satisfies the MTD constraint.

The incident response manager owns end-to-end coordination of the P1 response, directing technical teams while acting as the single conduit for executive updates, which satisfies the stem's requirement for both overall coordination and timely leadership communication.

Under Article 33 of the GDPR, a controller must notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. This strict deadline applies specifically because the breach involves EU residents’ personal data, triggering the GDPR’s territorial and material scope. The 72-hour window is the maximum statutory period, not a recommended target, and failure to comply can result in administrative fines under Article 83.

Activating business continuity and disaster recovery plans allows the organization to maintain or restore critical functions while systems are recovered. This directly addresses the business impact of a multi-day outage and aligns with CISM guidance that incident management must integrate with continuity and recovery capabilities. It is the most appropriate immediate action to keep essential operations running during restoration.

Volatile artefacts disappear on shutdown, so they must be collected first, following the order-of-volatility principle. Once memory, connections, and process state are preserved, the server can be rebuilt from trusted media to restore service. This satisfies both the forensic and legal requirements and the business need to recover, which is the balanced outcome the scenario demands.

CISM emphasizes that breach communication must be coordinated with legal counsel and communications teams to ensure regulatory notifications and customer messaging are accurate, timely, and compliant. This approach balances transparency with legal obligations and reputational management. It is the best action because it follows a structured, stakeholder-informed process rather than unilateral or premature disclosure.

Legal counsel advises on statutory notification duties and preserves attorney–client privilege over breach findings, satisfying the stem's demand for the primary reason. Privilege protection prevents compelled disclosure of incident assessments, while regulatory expertise ensures timely compliance with breach reporting deadlines.

A retainer pre-negotiates rates, scope, contacts and legal terms with a forensics provider, so engagement begins immediately when an incident occurs. This removes procurement and contracting delays, directly reducing the time required to engage external forensics and preserving volatile evidence.

Hourly sitreps satisfy the P1 escalation cadence executives require during ransomware, prioritising business impact and key actions over technical forensics. This keeps decision-makers informed on service disruption, containment progress and recovery timelines without overwhelming them with indicators of compromise, preserving their ability to authorise business-continuity and communication decisions.

Declaring a disaster activates the BC/DR plan, which provides pre-approved recovery strategies, resource allocation and escalation paths when MTD cannot be met. The MTD breach is the trigger criterion; the BC/DR plan exists precisely to restore critical services beyond normal incident response capabilities, ensuring business continuity within recovery objectives.

A documented plan provides the structure responders rely on when an incident occurs, defining who does what and how events escalate. Without it, response becomes ad hoc, delayed, and inconsistent, increasing impact. CISM treats the incident response plan as a foundational control that should be approved by management, communicated to stakeholders, and tested regularly. It also supports regulatory expectations for demonstrable preparedness and gives the CISO a basis for measuring and improving response capability.

Forensically sound collection follows the order of volatility, starting with the most perishable data such as memory and network connections, then moving to disk. Documenting the state and maintaining a chain of custody ensures evidence integrity and admissibility. This approach aligns with CISM guidance to preserve evidence properly while supporting incident analysis and any subsequent legal or regulatory actions.

The CMT owns reputational and stakeholder impact, so it approves external communications and public statements, ensuring legal, regulatory and messaging consistency. This satisfies the stem by keeping disclosure decisions at strategic level rather than with technical responders, who lack authority to commit the organisation publicly.

The existence of validated, tested backups determines whether the organization can recover without funding criminals and without relying on the attackers' promises. This is the most important factor because it directly affects business continuity, data integrity, and the organization's negotiating position. If backups are reliable, payment becomes unnecessary; if they are not, the CISO must weigh residual risk and legal implications. This aligns with CISM's emphasis on resilience and risk-based decision making.

Pre-approved communication templates let the IR team notify stakeholders, regulators and customers quickly and consistently during a high-pressure incident, satisfying the plan's requirement for defined escalation and messaging procedures rather than improvising statements under time pressure.

A post-incident review brings together the responders and business stakeholders to examine what happened, why it happened, and what should change. It produces documented improvement actions that feed back into the incident response plan, controls, and training. CISM treats this feedback loop as essential to maturing the incident management capability. Without a structured review, the organisation risks repeating the same failures and cannot demonstrate due diligence to regulators or auditors.

Communication templates satisfy the stakeholder-notification constraint by pre-drafting regulatory, legal and executive messaging, so notifications occur within mandated breach-reporting windows rather than being composed under pressure. They also standardise severity-dependent escalation paths, ensuring consistent disclosure across jurisdictions and preventing inadvertent admission of liability during Microsoft Entra ID compromise investigations.

A lessons-learned review converts the incident into durable improvement by examining what worked, what failed, and which controls, procedures, or training need change. CISM treats post-incident review as the mechanism that closes the loop between response and prevention, ensuring the same weakness is not exploited again. Without it, the organization returns to its prior state and repeats mistakes. It is the defining pre-closure activity because it captures organizational learning while details remain fresh.

A technical vulnerability is a symptom; CISM root cause analysis must progress to the management system. Determining which process failed to identify, assess, or remediate that vulnerability addresses the underlying governance weakness, preventing recurrence rather than merely patching one flaw.

An ISAC provides a trusted, sector-specific sharing channel with anonymisation and legal protections, letting peers block the same indicators quickly. This satisfies the stem's need for the best sharing approach, since public disclosure risks tipping off the attacker and exposing the victim.

The CEO sits on the crisis management team because major incidents demand strategic decisions on business continuity, regulatory disclosure, and resource authorisation that exceed operational authority. Their presence satisfies the stem's requirement for executive-level command during a major cybersecurity incident.

Insider cases typically end in disciplinary or criminal proceedings, so the plan must define how IR liaises with HR and legal. This coordination preserves evidence integrity, satisfies employment law obligations and ensures sanctions are lawfully applied rather than handled unilaterally by the security team.

Pre-approved templates and defined approval paths remove the delays and ambiguity that allow rumors or media to outpace official communication. By aligning legal, communications, and executives in advance, the organization can issue accurate, timely notifications within regulatory windows and preserve stakeholder trust. This directly addresses the gap of customers hearing from media first.

The IR manager owns and directs the response, coordinating the team, making escalation decisions and liaising with executives and the crisis management team. This command-and-control function is a standard, defined role in any incident response structure.

After containment, the next phase is eradication, which removes the malicious code, closes the initial access vector, and remediates the underlying weakness. Returning systems to production before eradication risks immediate reinfection. Eradication may include reimaging, patching, credential resets, and removing persistence mechanisms, and it must be verified before recovery begins so that restored systems are clean and stable.

The exercise exposed uncertainty about who can authorize a disruptive action, which is a governance gap. Clearly documented authority, thresholds, and escalation paths remove ambiguity and speed decision-making during real incidents. CISM emphasizes that incident response plans must define roles, responsibilities, and decision rights in advance. This directly addresses the identified weakness and improves response effectiveness.

The CEO holds ultimate authority to approve external communications and commit organisational resources, which no other CMT member can exercise. This satisfies the stem's requirement for the CEO's primary responsibility during an activated crisis management team.

A structured lessons-learned review identifies gaps in detection, response, and controls, and translates them into concrete improvements to the incident response plan and security architecture. This is the core of the post-incident phase in CISM and directly reduces the likelihood of recurrence by fixing root causes and process weaknesses. Involving all stakeholders ensures that technical, legal, and business perspectives are captured. The resulting updates make the organization more resilient for future incidents.

Routing forensic work through legal counsel and marking deliverables privileged brings the investigation under attorney work product, shielding it from disclosure. This satisfies the privilege-preservation objective by establishing counsel as the directing client rather than the incident response team.

Authorizing emergency expenditure is a strategic, fiduciary decision that sits with the crisis management team because it involves significant cost and enterprise risk. Engaging external counsel and forensic firms often requires executive approval beyond normal procurement thresholds. The CMT balances the financial impact against the need for rapid expert support. This is a governance responsibility that enables the technical response rather than executing it.

Holding the meeting within two weeks captures recollections while still fresh, before details fade, yet allows enough time to gather evidence and complete initial investigation. Longer delays erode accuracy and weaken the corrective actions derived.

A post-incident review delivers value only when findings translate into tracked remediation. Capturing lessons learned and converting them into corrective actions with named owners and deadlines closes the loop, ensures accountability, and drives measurable improvement in the incident response plan, controls, and monitoring. Without ownership and deadlines, observations remain recommendations that are rarely implemented.

Classification must be anchored to business impact so that severity reflects real consequences rather than technical symptoms alone. Mapping each severity level to a specific escalation path and timeframe ensures executives are engaged consistently and quickly for high-impact events. This creates a repeatable, auditable decision structure that satisfies leadership's need for timely notification and gives responders clear triage guidance.

Attorney-client privilege depends on confidentiality; disclosure to third parties can waive it. Restricting forensic reports to need-to-know recipients acting under legal direction preserves the protected communication channel, satisfying counsel's instruction and preventing inadvertent waiver during the breach investigation.

Classification and severity criteria allow the organization to triage incidents consistently, allocate resources appropriately, and determine when to escalate to management or activate the crisis management team. CISM treats this as foundational because it ensures that response efforts are proportional to business impact and that critical incidents receive immediate attention, while lower-severity events are handled efficiently.

Eradication is the phase that eliminates the adversary's presence and the vulnerability that allowed it. Deleting malware, scheduled tasks, rogue services, and web shells from every affected host is core eradication work. If any artifact survives on even one system, restoration will reintroduce the compromise, so completeness across the entire affected scope is the defining requirement of this activity.

Severe reputational damage meets the CMT escalation threshold because it threatens enterprise-wide viability, not just operational continuity. Crisis management governs strategic and stakeholder response, so incidents with potential brand, regulatory or public-trust consequences require their oversight rather than routine incident handling.

Evidence handling procedures define the chain-of-custody steps, packaging methods and documentation required to preserve artefacts during incident response. This directly satisfies the stem's evidence-handling requirement, ensuring collected data remains admissible and unaltered from seizure through analysis, which generic response or communication components cannot guarantee.

The General Counsel advises on legal exposure, regulatory notification duties, contractual obligations, privilege and potential litigation arising from the breach. Including the GC ensures crisis decisions account for legal risk, satisfying the CMT's need for authoritative legal counsel during a major incident.