22 Incident Response, Assets & Testing Practice Questions & Answers

1. 1. A security committee asks why the incident response plan must be approved and distributed while nothing is going wrong, rather than assembled at the moment an attack is detected. Which explanation is BEST?

   • A.Regulators require a written plan on file, so the document's main purpose is to satisfy auditors rather than responders.
   • B.Decisions about roles, authority and notification are made calmly in advance, so responders execute instead of improvising.✓ Answer
   • C.A plan written in advance removes the need for detection tooling, because documented procedures identify incidents on their own.
   • D.Writing the plan early transfers legal liability for any breach to the vendors and insurers named within the document itself.

   The plan is a product of the preparation phase: authority, severity classification and notification duties are settled while people can still think clearly. During an incident the responders then execute an agreed procedure rather than inventing one under time pressure, which is why the plan loses most of its value if it is written after detection.

   Source: ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand Incident Response; NIST SP 800-61, Preparation phaseReport a problem with this question

2. 2. A newly hired analyst reads the organization's incident response plan for the first time. Which set of contents is MOST characteristic of that document?

   • A.Approved hardware and software models, purchase records, warranty end dates, and depreciation schedules for every asset
   • B.Ranked recovery order of business functions, maximum tolerable downtime per function, and alternate processing site contracts
   • C.Defined roles and authority, incident classification criteria, escalation and notification paths, and current contact lists✓ Answer
   • D.Firewall rule sets, router configurations, address assignments, and the change tickets that authorized each network edit

   An incident response plan is procedural: it states who acts and with what authority, how an event is classified by severity, how it escalates, and whom to reach at any hour. Recovery ordering, maximum tolerable downtime and alternate-site contracts are continuity and disaster recovery content, and inventory or network configuration records are separate artifacts the plan may reference but does not contain.

   Source: NIST SP 800-61, incident response policy and plan elements; ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand Incident ResponseReport a problem with this question

3. 3. A mid-size company is chartering a computer security incident response team (CSIRT). Which statement BEST describes how the team should be composed?

   • A.It is staffed only by senior security engineers, because involving non-technical departments slows the technical response.
   • B.It is outsourced entirely to the cyber-insurance carrier, whose adjusters direct containment and speak for the company.
   • C.It is assembled after an incident is declared, drawing whoever is free from the help desk and the affected business unit.
   • D.It is cross-functional, pairing security and IT responders with management, legal, human resources and communications staff.✓ Answer

   Incidents force decisions that security engineers have no authority to make: whether to notify a regulator, how to handle an implicated employee, what to tell customers, and whether to involve law enforcement. The team is therefore chartered in advance as a cross-functional body, with management, legal, human resources and communications named alongside the technical responders.

   Source: NIST SP 800-61, incident response team structure; ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand Incident ResponseReport a problem with this question

4. 4. During a confirmed intrusion, three managers each call a different executive with conflicting information, and a business-unit employee posts details publicly before the facts are verified. Which element of the incident response plan was MOST clearly missing?

   • A.A stronger technical containment procedure describing how to isolate affected hosts from the rest of the production network
   • B.A data retention schedule setting how long incident evidence and correlated log records are kept before scheduled deletion
   • C.A defined communication and escalation path naming who is informed, in what order, and who may speak outside the company✓ Answer
   • D.A separate recovery site agreement specifying where operations move when the primary facility becomes unusable for staff

   The plan must define a single chain for reporting and escalation and must name the one role authorized to speak to customers, regulators and the press. Without it, executives receive contradictory accounts, unverified information reaches the public, and the organization may breach its own notification obligations while the facts are still being established.

   Source: NIST SP 800-61, incident communications, coordination and reportingReport a problem with this question

5. 5. Which sequence correctly orders the phases of incident response as described in standard incident-handling guidance?

   • A.Detection and analysis, preparation, recovery, containment, eradication, lessons learned
   • B.Detection and analysis, containment, preparation, recovery, eradication, lessons learned
   • C.Preparation, containment, detection and analysis, lessons learned, eradication, recovery
   • D.Preparation, detection and analysis, containment, eradication, recovery, lessons learned✓ Answer

   The order follows the logic of the work: preparation happens before anything occurs, an event must be detected and analyzed before it can be contained, containment stops the spread before eradication removes the cause, recovery returns service, and the lessons-learned review closes the cycle by feeding improvements back into preparation.

   Source: NIST SP 800-61, incident response life cycleReport a problem with this question

6. 6. A workstation is confirmed to be infected with malware that is spreading to file shares. A junior administrator proposes reformatting the machine immediately and rebuilding it from a standard image. What is the BEST response, and why?

   • A.Leave the host connected and watch it until the lessons-learned meeting decides whether a rebuild is really needed.
   • B.Reformat immediately as proposed: removing the malware fastest is the priority and evidence can be recovered later.
   • C.Isolate the host from the network first: containment limits the spread and preserves evidence that a rebuild destroys.✓ Answer
   • D.Restore the file shares from backup first: recovering shared data outranks any action on the infected workstation.

   Containment always precedes eradication. Disconnecting the host stops the malware reaching further systems while keeping memory contents, logs and the malware sample intact; reformatting first is eradication performed too early, and it destroys exactly the evidence needed to establish scope, root cause and whether data was taken.

   Source: NIST SP 800-61, Containment, Eradication and Recovery — containment strategy and evidence preservationReport a problem with this question

7. 7. The malware has been removed from every affected system and the exploited vulnerability has been patched. The team now restores data from known-good backups, validates each system, and monitors it closely before returning it to normal service. Which phase does this describe?

   • A.Containment, because limiting the damage is what restoring service to users is intended to accomplish
   • B.Recovery, because systems are returned to normal operation and verified once the threat has been removed✓ Answer
   • C.Eradication, because removing the threat is not complete until the affected data has been replaced
   • D.Detection and analysis, because validating restored systems is how the scope of the incident is set

   Eradication ended when the malware was removed and the vulnerability closed. Restoring from known-good backups, confirming the systems behave correctly and watching them for signs of reinfection before they carry production traffic again is the defining work of the recovery phase.

   Source: NIST SP 800-61, RecoveryReport a problem with this question

8. 8. Post-incident review is the phase organizations skip most often, usually because responders are exhausted and management treats the matter as closed once service is restored. What is MOST directly lost when it is skipped?

   • A.The root cause stays unaddressed and the plan and controls are never updated, so the same incident happens again.✓ Answer
   • B.Evidence collected during the incident is automatically destroyed, since the review is what authorizes its retention.
   • C.The organization loses its ability to detect the next intrusion, because monitoring stops when the review is skipped.
   • D.Regulatory notification is never sent, because the breach notification clock starts only when the review is closed.

   The lessons-learned phase is the only step that converts an incident into improvement: it establishes root cause and drives updates to the plan, the controls and the detection rules. Skip it and service is restored on top of the same weakness, so the organization is exposed to a repeat of the identical incident.

   Source: NIST SP 800-61, Post-Incident Activity (lessons learned)Report a problem with this question

9. 9. A manager compares two ways of validating the incident response plan: a tabletop exercise and a full interruption test. Which statement BEST describes the difference between them?

   • A.A tabletop is a discussion-based walkthrough of decisions; a full interruption test actually stops production systems.✓ Answer
   • B.A tabletop is run by external auditors only; a full interruption test is run internally by the response team itself.
   • C.A tabletop tests the backup hardware under load; a full interruption test reviews the documented roles on paper only.
   • D.A tabletop is required every year by federal law; a full interruption test is optional and left to management's choice.

   A tabletop is discussion-based: participants talk through a scenario to test roles, decisions and escalation, and no production system is touched, which makes it cheap and low risk. A full interruption test actually halts live operations and switches to recovery capability, giving the highest fidelity at the highest business risk.

   Source: NIST SP 800-84, Guide to Test, Training and Exercise Programs — tabletop exercises versus functional and full-scale testingReport a problem with this question

10. 10. A hurricane floods a company's primary data center. Which statement correctly matches the incident response plan, the business continuity plan and the disaster recovery plan to their purposes?

    • A.Business continuity addresses the event as it unfolds, disaster recovery sustains critical operations, incident response restores normal service.
    • B.Incident response addresses the event as it unfolds, business continuity sustains critical operations, disaster recovery restores normal service.✓ Answer
    • C.Incident response addresses the event as it unfolds, disaster recovery sustains critical operations, business continuity restores normal service.
    • D.Disaster recovery addresses the event as it unfolds, incident response sustains critical operations, business continuity restores normal service.

    The three plans are sequential in purpose. Incident response manages the event itself as it happens, business continuity keeps critical functions running while the disruption lasts, and disaster recovery rebuilds the damaged capability and returns operations to normal afterward. Continuity and recovery planning sit in the governance domain of the exam outline rather than under incident response.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand Incident Response, and Security Governance — understand redundancy (business continuity and disaster recovery)Report a problem with this question

11. 11. A new security manager finds that nobody can say how many servers, laptops and cloud subscriptions the company has. Vulnerability scanning, patching and access reviews are all running. Which action should be taken FIRST, and why?

    • A.Build a complete asset inventory, because controls can only be applied to assets the organization knows it has.✓ Answer
    • B.Increase the scanning frequency, because more frequent scans will eventually enumerate everything worth protecting.
    • C.Encrypt all endpoint storage, because protecting the data makes the underlying asset count largely irrelevant.
    • D.Buy more cloud subscriptions, because centralizing purchasing matters more than recording what already exists.

    The inventory is the prerequisite control, because every other control is applied to a list of known assets. Scanning more often still only covers the address ranges and accounts that are already known, so an unrecorded server or an unmanaged cloud subscription stays unscanned, unpatched and unreviewed no matter how good the tooling is.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand asset protection; CIS Critical Security Controls, inventory and control of enterprise assetsReport a problem with this question

12. 12. Laptops that have reached end of life are being collected for disposal by a recycler, and their storage media have already been sanitized. Which step BEST completes the asset lifecycle?

    • A.Reassign the device identifier to a replacement laptop so the inventory count stays constant and the reporting stays simple.
    • B.Keep the record active for the depreciation period so finance can continue reporting the hardware as an operating asset.
    • C.Delete the inventory entry as soon as the machine leaves the building, since retired hardware needs no further tracking.
    • D.Record the disposal, retire the entry from the asset inventory, and revoke the licences and credentials tied to the device.✓ Answer

    Disposal is the closing stage of the asset lifecycle and it is not finished when the media are wiped. The inventory entry must be retired with a dated disposal record, and the certificates, software licences and machine accounts bound to the device must be revoked, otherwise credentials remain valid and the organization keeps defending assets it no longer holds.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand asset protection; NIST SP 800-88, Guidelines for Media Sanitization (disposal documentation)Report a problem with this question

13. 13. A department depends on an application whose vendor has announced end of support. The software still works correctly today. Which statement BEST describes the security risk this creates?

    • A.Newly discovered vulnerabilities in it will never be patched, so exposure keeps growing even though nothing changes.✓ Answer
    • B.The software will stop executing on the announced date, so the risk is an unplanned outage rather than a security one.
    • C.The risk transfers to the vendor under the support contract, so the organization's own residual exposure is nearly zero.
    • D.Existing vulnerabilities are removed at end of support, so only configuration errors introduced later create exposure.

    End of support means the vendor issues no further security fixes. The code itself does not change, but the stock of publicly known and permanently unpatched weaknesses in it grows over time, so risk rises steadily until the system is replaced or ringfenced with compensating controls such as segmentation and restricted access.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand asset protection (end-of-life and unsupported assets)Report a problem with this question

14. 14. As part of configuration management, a team publishes a hardened build standard that every new server must match before it may be placed in production. What is this standard, and what does it provide?

    • A.A back-out plan: the approved procedure for returning a system to service after a change fails in production.
    • B.A business impact analysis: the ranking of functions used to decide which servers are rebuilt first after an outage.
    • C.An asset register: the authoritative record of hardware ownership used to assign custodians and support contracts.
    • D.A baseline standard: the approved secure configuration that systems are built to and later audited against for drift.✓ Answer

    A baseline is the approved secure configuration for a class of system, typically derived from a recognized hardening benchmark. It gives configuration management a defined known-good state: builds are created from it and later audits compare the running system against it, which is how configuration drift becomes visible.

    Source: NIST SP 800-128, Guide for Security-Focused Configuration Management — secure configuration baselinesReport a problem with this question

15. 15. An auditor asks a team to distinguish configuration management from change management. Which statement is correct?

    • A.Configuration management applies only to network device settings; change management applies only to application code.
    • B.Configuration management governs how alterations are authorized; change management governs the system's approved state.
    • C.Configuration management governs the system's approved state; change management governs how alterations are authorized.✓ Answer
    • D.Configuration management is performed after deployment; change management is performed only during initial purchasing.

    Configuration management is about state: identifying items, defining the approved baseline, and verifying that systems still match it. Change management is about process: how a proposed alteration is requested, assessed for risk, approved, tested, scheduled and recorded before that state is allowed to change.

    Source: NIST SP 800-128, configuration management and change control processesReport a problem with this question

16. 16. An administrator opens a firewall port at 2 a.m. to clear an outage and never files a ticket. The port stays open for months and is later used by an attacker. Which statement BEST describes this situation?

    • A.The change was undocumented and is itself a security incident, since it altered the approved baseline unreviewed.✓ Answer
    • B.The change was a configuration error only, and it becomes an incident solely at the moment the attacker exploits it.
    • C.The change was acceptable because it resolved an outage, and emergency work is exempt from documentation requirements.
    • D.The change belongs to capacity management rather than security, since opening a port is a performance-related decision.

    An alteration made outside the change process is an unauthorized deviation from the approved baseline, and that qualifies as a security incident in its own right whether or not anyone exploits it, because the organization can no longer state its own configuration. Emergency changes may be approved on an expedited path, but they must still be documented and reviewed afterward.

    Source: NIST SP 800-128, unauthorized change as a security-relevant event; ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident ResponseReport a problem with this question

17. 17. An organization runs an exercise in which one group attacks, another defends, and a third function makes both share findings as the exercise proceeds so that detections improve. Which description is correct?

    • A.Red defends, blue attacks, and purple is the collaboration that feeds attacker findings back into defensive detection.
    • B.Red attacks, blue defends, and purple is the collaboration that feeds attacker findings back into defensive detection.✓ Answer
    • C.Red attacks, blue defends, and purple is a second offensive team that attacks independently of the red team's scope.
    • D.Red attacks, blue reviews documentation, and purple is the external referee that scores the exercise and reports on it.

    Red is the offensive side that simulates the adversary and blue is the defensive side that detects and responds. Purple is not a third attacking team: it is the collaborative function that pairs red's techniques with blue's telemetry in real time so that detection gaps are identified and closed while the exercise is still running.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand security testing (red, blue and purple teaming)Report a problem with this question

18. 18. Management asks why a quarterly vulnerability scan does not remove the need for a periodic penetration test. Which distinction is correct?

    • A.A scan exploits weaknesses to prove impact; a penetration test only lists known weaknesses from a published database.
    • B.A scan identifies and reports known weaknesses; a penetration test exploits them to demonstrate real business impact.✓ Answer
    • C.A scan examines source code without running the software; a penetration test examines only the running application.
    • D.A scan requires written authorization and scope; a penetration test may proceed without approval as a routine check.

    A vulnerability scan is automated and broad: it compares systems against a catalogue of known weaknesses and reports what may be present, so its findings still have to be validated for false positives. A penetration test is expert-driven and narrow: it attempts controlled exploitation and chaining to show what an attacker could actually reach, which a scanner never demonstrates.

    Source: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment — vulnerability scanning versus penetration testingReport a problem with this question

19. 19. An application security team already runs static analysis on every code commit. Which class of flaw is dynamic testing of the running application MOST likely to find that the static analysis will miss?

    • A.A hard-coded credential committed into the source tree and left in a configuration file inside the build.
    • B.Unsafe use of a string-copying function written directly in the application's own source code repository files.
    • C.Faults of runtime and deployment, such as a misconfigured server, a broken session, or an exposed test path.✓ Answer
    • D.A logic branch that no caller ever invokes and that is therefore never reached while the program executes.

    Static analysis reads code that is not executing, so it sees source-level defects but has no view of how the software is deployed or how it behaves once running. Dynamic testing drives the live application from outside and therefore surfaces server misconfiguration, session and authentication handling faults, and endpoints that exist only in the deployed environment.

    Source: NIST SP 800-115, static analysis versus dynamic application testingReport a problem with this question

20. 20. Before any code is written for a new payment feature, architects meet to enumerate how an attacker might spoof identities, tamper with data or elevate privileges, and to choose a countermeasure for each. What is this activity?

    • A.Penetration testing, an authorized attack against the finished system to prove which weaknesses can be exploited.
    • B.Threat modeling, a structured design-time analysis that identifies likely threats and the controls that address them.✓ Answer
    • C.Vulnerability scanning, an automated comparison of a deployed system against a database of published known flaws.
    • D.Post-incident review, a structured analysis performed after an event to establish root cause and improve controls.

    Threat modeling is proactive and happens at design time: the team walks the design against threat categories such as spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege, and selects a countermeasure for each. Fixing a design flaw on paper is far cheaper than discovering it in a test of shipped code.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand security testing; STRIDE threat categoriesReport a problem with this question

21. 21. During an authorized physical security assessment, a tester slips through a badge-controlled door right behind an employee who never notices him. On a second attempt, a different employee sees him, accepts his story about a forgotten badge, and holds the door open. What are the two techniques, in order?

    • A.Tailgating, then piggybacking, because the first entry went unnoticed and the second had the employee's cooperation.✓ Answer
    • B.Piggybacking, then tailgating, because the first entry went unnoticed and the second had the employee's cooperation.
    • C.Shoulder surfing, then pretexting, because both entries depended on observing and then reusing employee behavior.
    • D.Impersonation, then baiting, because the tester first assumed a false role and then relied on the employee's curiosity.

    Both techniques are unauthorized entry behind an authorized person, and the distinguishing factor is consent. Tailgating occurs without the employee's knowledge, while piggybacking involves the employee knowingly admitting the person, usually after a plausible story, which is why awareness training and access vestibules or turnstiles are the standard countermeasures.

    Source: ISC2 Certified in Cybersecurity Exam Outline, Security Operations and Incident Response — understand security testing (physical and social-engineering testing)Report a problem with this question

22. 22. A security team is asked to test whether employees will surrender credentials to a simulated phishing email and whether testers can reach the server room in person. What must happen FIRST?

    • A.Notify every employee of the exact dates so that nobody is deceived by the simulated messages during the test window.
    • B.Purchase a commercial phishing platform so that the simulated messages match the sophistication of real attacks today.
    • C.Brief the local police so that the physical portion of the assessment is treated as an approved law-enforcement drill.
    • D.Obtain written authorization defining scope, targets, timing and rules of engagement before any testing activity starts.✓ Answer

    Signed authorization with a defined scope, target list, time window and rules of engagement must exist before any social engineering or physical entry attempt. Without it the activity is indistinguishable from a real attack, the testers have no legal protection, and responders have no way to tell an exercise from a genuine intrusion.

    Source: NIST SP 800-115, rules of engagement and written authorization prior to assessmentReport a problem with this question

Practice questions based on the ISC2 Certified in Cybersecurity (CC) Exam Outline. This site is not affiliated with or endorsed by ISC2, and these are not real exam questions. ISC2 revises the domains and their weights periodically and sets the exam length, passing standard and eligibility terms — confirm the current outline and requirements with ISC2 before you register. Official CC exam outline →