I85PREP
⌘ K
CRIE study materials
CRIE study resources

CRIE practice questions

One question at a time. Build your CRIE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Incident Response Fundamentals and Frameworks

Which phase of the incident response lifecycle immediately follows detection and validation of a potential security incident?

  1. Containment Correct answer.
  2. Preparation
  3. Recovery
  4. Lessons learned

Explanation

After an incident is detected and validated, the team works to limit its scope and impact through containment before moving to eradication and recovery. Preparation precedes detection, and lessons learned comes at the end.

Question 2Incident Response Fundamentals and Frameworks

In the NIST incident response framework, which activity is part of the 'Detection and Analysis' phase?

  1. Validating whether an observed event is truly an incident Correct answer.
  2. Restoring systems from clean backups
  3. Establishing incident response team roles
  4. Conducting a post-incident review

Explanation

Detection and Analysis focuses on monitoring, identifying, and validating events to confirm which are actual incidents. Role definition belongs to preparation, restoration to recovery, and reviews to post-incident activity.

Question 3Incident Response Fundamentals and Frameworks

A security analyst receives an alert and must decide whether it represents a genuine security incident. What is this decision step called?

  1. Triage Correct answer.
  2. Containment
  3. Eradication
  4. Escalation

Explanation

Triage is the process of evaluating and prioritizing alerts to determine which are real incidents and how urgently they must be handled. Escalation, eradication, and containment are subsequent actions taken once an incident is confirmed.

Question 4Incident Response Fundamentals and Frameworks

Which document defines the authority, roles, and step-by-step procedures a team follows during an incident?

  1. Incident response plan Correct answer.
  2. Risk register
  3. Asset inventory
  4. Business impact analysis

Explanation

An incident response plan establishes authority, roles, communication paths, and procedures for handling incidents. The other documents support risk and asset management but do not govern incident response actions.

Question 5Incident Response Fundamentals and Frameworks

What is the primary purpose of the containment phase in incident response?

  1. To identify the root cause of the incident
  2. To return systems to normal operation
  3. To document lessons for future incidents
  4. To limit the spread and impact of the incident Correct answer.

Explanation

Containment aims to stop an incident from spreading and to minimize its impact while preserving evidence. Root cause analysis, restoration, and documentation occur in other phases.

Question 6Incident Response Fundamentals and Frameworks

Which term describes the maximum tolerable time a business process can be unavailable before serious harm occurs?

  1. Mean time to detect
  2. Recovery time objective Correct answer.
  3. Service level agreement
  4. Recovery point objective

Explanation

The recovery time objective (RTO) is the target duration within which a process must be restored after disruption. The recovery point objective concerns acceptable data loss, not downtime duration.

Question 7Incident Response Fundamentals and Frameworks

Which activity belongs to the preparation phase of incident response?

  1. Isolating an infected host
  2. Conducting tabletop exercises Correct answer.
  3. Writing the final incident report
  4. Analyzing malware in a sandbox

Explanation

Preparation builds readiness before incidents occur, including training, exercises, tooling, and plan development. The other activities happen during or after an actual incident.

Question 8Incident Response Fundamentals and Frameworks

Which framework organizes incident response into preparation, detection and analysis, containment/eradication/recovery, and post-incident activity?

  1. ISO 27001
  2. COBIT
  3. PCI DSS
  4. NIST SP 800-61 Correct answer.

Explanation

NIST SP 800-61 defines the incident response lifecycle with those four phases. The other standards address broader security management, payment security, or IT governance.

Question 9Incident Response Fundamentals and Frameworks

During an incident, a team isolates an affected server from the network but keeps it powered on for later forensic examination. Which containment strategy does this represent?

  1. Network isolation with evidence preservation Correct answer.
  2. Full reimage of the host
  3. Destructive containment by wiping disks
  4. Monitoring-only containment

Explanation

Isolating a host while preserving its state balances stopping the spread with retaining evidence for investigation. Reimaging or wiping would destroy forensic artifacts.

Question 10Incident Response Fundamentals and Frameworks

An analyst discovers a workstation communicating with a known malicious command-and-control server. Following the incident lifecycle, what should happen immediately after the analyst validates the incident?

  1. Contain the affected workstation Correct answer.
  2. Notify the media
  3. Perform a full root cause analysis
  4. Conduct a lessons-learned meeting

Explanation

Once an incident is validated, the priority is containment to stop further damage or data exfiltration. Root cause analysis and lessons learned come later, and media notification is not a standard immediate step.

Question 11Incident Response Fundamentals and Frameworks

Which metric best measures how quickly an organization identifies security incidents after they begin?

  1. False positive rate
  2. Recovery point objective
  3. Mean time to recover
  4. Mean time to detect Correct answer.

Explanation

Mean time to detect measures the average elapsed time between incident onset and detection. The other metrics describe recovery speed, data loss tolerance, or alert quality.

Question 12Incident Response Fundamentals and Frameworks

A ransomware outbreak is spreading across shared network drives. Which containment action most directly limits further encryption?

  1. Resetting user passwords
  2. Disabling the affected network shares and segmenting hosts Correct answer.
  3. Scheduling a vulnerability scan
  4. Reviewing firewall rule documentation

Explanation

Ransomware spreads through accessible shares, so disabling shares and segmenting hosts directly interrupts propagation. Password resets, documentation review, and scans do not immediately stop active encryption.

Question 13Incident Response Fundamentals and Frameworks

When should an organization escalate an incident to executive management and legal counsel?

  1. Only after the incident is fully resolved
  2. When the incident may involve regulated data, significant financial impact, or legal obligations Correct answer.
  3. Never, because technical teams handle all incidents
  4. Whenever any single endpoint alert fires

Explanation

Escalation criteria typically include potential regulatory, legal, financial, or reputational impact requiring executive and legal involvement. Routine endpoint alerts are handled by technical teams without executive escalation.

Question 14Incident Response Fundamentals and Frameworks

What is the main benefit of conducting tabletop exercises during preparation?

  1. They automatically patch vulnerable systems
  2. They rehearse roles and decision-making without a real incident Correct answer.
  3. They guarantee incidents will not occur
  4. They replace the need for an incident response plan

Explanation

Tabletop exercises let teams practice coordination, communication, and decisions in a low-risk setting, revealing gaps in the plan. They do not patch systems, replace the plan, or prevent incidents.

Question 15Incident Response Fundamentals and Frameworks

A team must preserve volatile evidence on a compromised host. Which order of collection best follows accepted forensic practice?

  1. Printed reports first, then memory
  2. Disk image first, then memory
  3. Backup tapes first, then logs
  4. Memory and network state first, then disk Correct answer.

Explanation

Volatile data such as memory and network connections is lost on shutdown or reboot, so it is captured before more persistent disk data. This follows the order of volatility principle.

Question 16Incident Response Fundamentals and Frameworks

Which action best supports chain of custody for digital evidence?

  1. Documenting every transfer, handler, and time of evidence Correct answer.
  2. Allowing any team member to modify evidence freely
  3. Storing evidence on a shared drive without access controls
  4. Deleting original logs after copying them

Explanation

Chain of custody requires documenting who handled evidence, when, and every transfer to demonstrate integrity. Uncontrolled access or modification undermines admissibility.

Question 17Incident Response Fundamentals and Frameworks

An organization wants to reduce the time between an incident occurring and its detection. Which investment most directly addresses this goal?

  1. Additional backup tapes
  2. More frequent password complexity changes
  3. Enhanced logging and centralized monitoring with alerting Correct answer.
  4. A larger legal retainer

Explanation

Detection speed improves through visibility: comprehensive logging, centralized collection, and timely alerting. The other investments support legal response, authentication hygiene, or recovery but not detection latency.

Question 18Incident Response Fundamentals and Frameworks

During eradication, what must be done before restoring a compromised system to production?

  1. Notify all customers immediately
  2. Disable all logging to reduce noise
  3. Delete the incident ticket
  4. Remove the root cause and verify the threat is eliminated Correct answer.

Explanation

Eradication removes malware, closes the exploited vulnerability, and confirms the threat no longer persists before recovery begins. Restoring without eradication risks reinfection.

Question 19Incident Response Fundamentals and Frameworks

Which element is essential in an incident communication plan?

  1. A list of employee birthdays
  2. A schedule of office cleaning
  3. A list of approved spokespersons and escalation contacts Correct answer.
  4. A catalog of every software license

Explanation

A communication plan defines who speaks publicly, how internal escalation flows, and whom to contact, ensuring accurate and coordinated messaging. The other items are unrelated to incident communication.

Question 20Incident Response Fundamentals and Frameworks

A SOC receives thousands of alerts daily and cannot investigate all of them. Which approach best allocates limited analyst resources?

  1. Ignore all alerts from endpoint tools
  2. Prioritize alerts by severity and potential business impact Correct answer.
  3. Disable alerting to reduce workload
  4. Investigate alerts in random order

Explanation

Risk-based prioritization focuses analyst effort on alerts with the greatest potential impact, consistent with triage principles. Random ordering, ignoring sources, or disabling alerting reduces effectiveness.

Question 21Incident Response Fundamentals and Frameworks

Which statement best distinguishes an event from an incident?

  1. An event is always malicious, while an incident is benign
  2. An incident is a planned maintenance window
  3. An event is any observable occurrence, while an incident is an event that harms or threatens security Correct answer.
  4. An event and an incident are identical terms

Explanation

An event is any observable occurrence in a system or network, whereas an incident is a specific event that actually or potentially jeopardizes security. Not every event rises to an incident.

Question 22Incident Response Fundamentals and Frameworks

An organization must choose between shutting down a compromised server and isolating it on the network. Which factor most strongly favors isolation over shutdown?

  1. The need to install new hardware
  2. The desire to reduce electricity costs
  3. The wish to free up rack space
  4. The need to preserve volatile memory for investigation Correct answer.

Explanation

Isolation keeps the system running, preserving volatile memory and active sessions that would be lost on shutdown. Cost, rack space, and hardware changes are unrelated to this forensic trade-off.

Question 23Incident Response Fundamentals and Frameworks

After an incident is resolved, which activity most improves future response capability?

  1. Deleting all logs to reclaim storage
  2. Conducting a structured lessons-learned review and updating the plan Correct answer.
  3. Reassigning the response team to unrelated duties
  4. Archiving the incident without review

Explanation

A structured post-incident review identifies what worked and what failed, and its findings should feed back into the plan and controls. Archiving without review or deleting logs forfeits that learning.

Question 24Incident Response Fundamentals and Frameworks

A team detects an intrusion but lacks the authority to take systems offline. Which preparation gap does this most likely reveal?

  1. Unclear incident response authority and escalation paths Correct answer.
  2. Excessive backup frequency
  3. Insufficient logging coverage
  4. Overly strong password policy

Explanation

When responders cannot act decisively, the plan likely fails to define authority and escalation. Logging, backups, and password policy do not grant operational decision rights during an incident.

Question 25Incident Response Fundamentals and Frameworks

An incident spans multiple jurisdictions with differing breach notification laws. What should the response plan require?

  1. A single global notification deadline applied uniformly
  2. No notification until the investigation is fully closed
  3. Notification only to internal staff
  4. Coordination with legal counsel to meet each applicable jurisdiction's requirements Correct answer.

Explanation

Multi-jurisdiction incidents require legal analysis to satisfy each applicable notification law and deadline. A uniform deadline, indefinite delay, or internal-only notice risks noncompliance.

Question 26Incident Response Fundamentals and Frameworks

Which document, approved in advance by senior management, formally authorizes an incident response team to take disruptive actions such as isolating systems or disabling accounts during an incident?

  1. The incident response charter or policy Correct answer.
  2. The vulnerability management standard
  3. The disaster recovery runbook
  4. The business impact analysis

Explanation

A charter or policy approved by executive leadership grants the IR team its mandate and delegated authority, so responders can act decisively without seeking ad hoc approval mid-incident. Other planning artifacts describe impacts or procedures but do not confer authority.

Question 27Incident Response Fundamentals and Frameworks

An incident responder needs a shared vocabulary for describing adversary behavior so that detection content written by one analyst can be understood and reused by others. Which model is designed primarily for this purpose?

  1. The OSI reference model
  2. The MITRE ATT&CK knowledge base Correct answer.
  3. The CIA triad
  4. The ITIL service lifecycle

Explanation

ATT&CK catalogs adversary tactics and techniques in a structured, commonly understood taxonomy, which lets teams map detections and share them consistently. The other models describe networking, security objectives, or service management rather than adversary behavior.

Question 28Incident Response Fundamentals and Frameworks

A mid-sized company has no formal incident response plan. Leadership asks which framework structure should be adopted as the backbone of a new program. Which choice provides the most widely recognized lifecycle for organizing incident response activities?

  1. The ISO 27001 certification audit cycle
  2. The SANS top twenty controls
  3. The NIST incident response lifecycle Correct answer.
  4. The OWASP Top Ten

Explanation

The NIST lifecycle (preparation; detection and analysis; containment, eradication, and recovery; post-incident activity) is the reference structure most organizations adopt as a program backbone. The other options address certification, web application risks, or control prioritization rather than the response lifecycle.

Question 29Incident Response Fundamentals and Frameworks

A responder arrives at a compromised host and must decide what to collect first. The host is still running and has active network connections, a populated memory space, and a large disk. Which collection order reflects accepted volatile-data precedence?

  1. Disk image first, then memory, then network state
  2. Physical labels and cabling first, then disk, then memory
  3. Network state and memory first, then disk contents Correct answer.
  4. Disk contents, then logs, then memory

Explanation

Volatile data such as network connections and memory contents is lost on shutdown or continued operation, so it is captured before more persistent storage like disks. Ordering by volatility preserves evidence that would otherwise disappear.

Question 30Incident Response Fundamentals and Frameworks

During a review, an analyst notes that the team detected a breach quickly but spent weeks deciding who owned containment, duplicating work across teams, and disputing who could approve shutdowns. Which program deficiency does this pattern most directly indicate?

  1. Insufficient endpoint detection coverage
  2. Inadequate log retention periods
  3. Weak vulnerability patching cadence
  4. Unclear roles, responsibilities, and decision rights in the response plan Correct answer.

Explanation

Detection was timely, so the failure lies in coordination: ambiguous ownership, duplicated effort, and contested approval authority point to undefined roles and decision rights. Response plans must assign clear responsibilities and escalation authority to prevent this friction.

Question 31Preparation and Incident Response Planning

In incident response planning, which document defines the authority, scope, and responsibilities for handling a security incident and is formally approved by management?

  1. The incident response policy Correct answer.
  2. The backup rotation log
  3. The asset inventory spreadsheet
  4. The network topology diagram

Explanation

An incident response policy is the management-approved document that establishes authority, scope, and assigned responsibilities for incident handling. Supporting artifacts like diagrams, inventories, and logs inform operations but do not confer authority.

Question 32Preparation and Incident Response Planning

Which phase of the incident response lifecycle immediately follows detection and involves validating whether an event is truly a security incident?

  1. Analysis Correct answer.
  2. Eradication
  3. Lessons learned
  4. Recovery

Explanation

After detection, the analysis phase validates and scopes the event to confirm whether it is a genuine incident and to determine its impact. Eradication and recovery come later once the incident is understood.

Question 33Preparation and Incident Response Planning

A security team wants to define how quickly each severity level of incident must be acknowledged and escalated. Which planning artifact is most appropriate?

  1. A vulnerability scan report
  2. A firewall rule audit
  3. A business impact analysis questionnaire
  4. A service level agreement for escalation timelines Correct answer.

Explanation

Escalation timelines tied to severity levels are typically codified in an SLA or escalation matrix within the response plan. The other artifacts support risk assessment or technical review but do not set response time commitments.

Question 34Preparation and Incident Response Planning

What is the primary purpose of conducting a tabletop exercise during incident response preparation?

  1. To practice decision-making and communication in a simulated scenario Correct answer.
  2. To certify analysts on malware reverse engineering
  3. To validate backups can be restored
  4. To measure the raw throughput of the SIEM

Explanation

A tabletop exercise is a discussion-based simulation that tests roles, decisions, and communications without touching production systems. Technical validation tasks such as backup restoration or tool throughput are separate activities.

Question 35Preparation and Incident Response Planning

Which role in an incident response team is typically responsible for making the final business decision on whether to take critical systems offline during an incident?

  1. The incident commander Correct answer.
  2. The forensic analyst
  3. The system administrator
  4. The communications lead

Explanation

The incident commander coordinates the response and holds decision authority, including business-impacting choices such as taking critical systems offline. Analysts, communications staff, and administrators execute specialized tasks under that direction.

Question 36Preparation and Incident Response Planning

A plan that describes the order in which systems should be restored after a major incident is best described as which of the following?

  1. An evidence retention schedule
  2. A change management policy
  3. A communications plan
  4. A prioritization or recovery sequence plan Correct answer.

Explanation

Recovery sequencing defines the order in which systems are restored based on business criticality and dependencies. Communications, evidence retention, and change management address different concerns.

Question 37Preparation and Incident Response Planning

Which of the following is the best example of a preventive control in an incident response program?

  1. Endpoint detection and response alerts
  2. Mandatory multi-factor authentication Correct answer.
  3. A post-incident review meeting
  4. A forensic disk image

Explanation

Preventive controls stop incidents from occurring or reduce their likelihood, and MFA is a preventive authentication control. Alerts are detective, reviews are corrective/learning, and disk images are evidentiary.

Question 38Preparation and Incident Response Planning

What should an incident response plan specify about out-of-band communication channels?

  1. That they are documented and tested as a fallback when primary channels are compromised Correct answer.
  2. That they are optional and left to analyst discretion
  3. That they are restricted to the legal team
  4. That they are only used after the incident is closed

Explanation

Out-of-band channels must be pre-documented and tested so responders can communicate if primary systems are unavailable or compromised. Leaving them undefined or restricted defeats their purpose.

Question 39Preparation and Incident Response Planning

An organization classifies an incident as high severity. According to typical planning, which action should occur first?

  1. Perform a full forensic analysis of every endpoint
  2. Activate the incident response team and initiate the escalation process Correct answer.
  3. Notify all customers via public press release
  4. Schedule a lessons-learned meeting

Explanation

High-severity incidents trigger activation of the response team and the defined escalation path before broader actions. Public notification and full forensic sweeps follow confirmation and scoping, and lessons learned occurs after resolution.

Question 40Preparation and Incident Response Planning

Why should an incident response plan include predefined evidence-handling procedures?

  1. To ensure forensic artifacts remain admissible and trustworthy Correct answer.
  2. To guarantee incidents never recur
  3. To reduce the number of alerts generated by the SIEM
  4. To eliminate the need for legal review

Explanation

Predefined evidence-handling procedures preserve integrity and chain of custody so artifacts remain trustworthy and potentially admissible. They do not reduce alert volume, replace legal review, or prevent recurrence.

Question 41Preparation and Incident Response Planning

A business impact analysis identifies that an order-processing system can tolerate only two hours of downtime. How should this finding be used in incident response planning?

  1. It sets the maximum password age for the system
  2. It determines the encryption algorithm for backups
  3. It informs recovery time objectives and prioritization during response Correct answer.
  4. It defines the number of analysts on the team

Explanation

BIA findings on tolerable downtime drive recovery time objectives and help prioritize restoration during an incident. Password policy, encryption selection, and staffing are separate decisions.

Question 42Preparation and Incident Response Planning

Which element is essential in a communications plan for an incident involving potential customer data exposure?

  1. A list of approved spokespersons and notification templates Correct answer.
  2. A copy of the source code repository
  3. The network switch configuration
  4. The server rack elevation diagrams

Explanation

A communications plan for data exposure must define approved spokespersons and pre-approved notification templates to ensure consistent, compliant messaging. Technical artifacts like source code, switch configs, and rack diagrams do not serve this purpose.

Question 43Preparation and Incident Response Planning

During a simulated incident, the team discovers that the on-call analyst list is outdated. Which planning improvement most directly addresses this gap?

  1. Establishing a regularly reviewed and tested contact roster Correct answer.
  2. Increasing the log retention period
  3. Adding more intrusion detection sensors
  4. Purchasing additional forensic workstations

Explanation

An outdated on-call list is a contact management problem best solved by a roster that is regularly reviewed and tested. Sensors, log retention, and workstations address technical detection and capacity concerns, not contact accuracy.

Question 44Preparation and Incident Response Planning

What distinguishes a functional exercise from a tabletop exercise in incident response testing?

  1. A functional exercise avoids any participant interaction
  2. A functional exercise is discussion-based only
  3. A functional exercise replaces the need for a written plan
  4. A functional exercise simulates actions in a controlled environment without full production impact Correct answer.

Explanation

A functional exercise has participants actually perform response actions in a controlled setting, whereas a tabletop is discussion-based. It does not eliminate interaction or remove the need for a written plan.

Question 45Preparation and Incident Response Planning

An incident response plan should define severity classification criteria primarily to do which of the following?

  1. Establish the annual security budget
  2. Drive consistent escalation, resourcing, and notification decisions Correct answer.
  3. Set the organization's acceptable use policy
  4. Determine which tools are installed on endpoints

Explanation

Severity criteria create a consistent basis for escalation, resource allocation, and notification decisions. Tool installation, acceptable use, and budgeting are governed by other processes.

Question 46Preparation and Incident Response Planning

Which of the following best describes the role of a predefined incident response runbook?

  1. It provides step-by-step procedures for handling a specific incident type Correct answer.
  2. It documents the organization's overall risk appetite
  3. It replaces the need for analyst judgment
  4. It serves as the legal contract with third-party vendors

Explanation

A runbook gives step-by-step procedures for a specific incident type to standardize response. It supports rather than replaces judgment and does not define risk appetite or serve as a vendor contract.

Question 47Preparation and Incident Response Planning

An organization wants to ensure third-party service providers know their obligations during an incident. What should the incident response plan include?

  1. A list of internal employee birthdays
  2. The physical office floor plan
  3. Defined notification and coordination requirements for external parties Correct answer.
  4. The marketing campaign calendar

Explanation

Plans should specify how and when external parties such as providers are notified and coordinated with during an incident. Unrelated data like birthdays, marketing calendars, and floor plans do not address third-party obligations.

Question 48Preparation and Incident Response Planning

What is the primary reason to document a chain of custody during incident response?

  1. To speed up malware analysis
  2. To demonstrate that evidence was handled without tampering or loss Correct answer.
  3. To satisfy marketing reporting requirements
  4. To reduce the number of affected hosts

Explanation

Chain of custody records who handled evidence and when, demonstrating integrity and preventing claims of tampering. It does not accelerate analysis, reduce host impact, or serve marketing needs.

Question 49Preparation and Incident Response Planning

A plan review identifies that the incident response team lacks authority to isolate endpoints without management approval, causing delays. What change best resolves this?

  1. Require approval from all department heads
  2. Remove endpoint isolation from the plan
  3. Eliminate the incident commander role
  4. Grant pre-approved authority for defined containment actions Correct answer.

Explanation

Pre-approving defined containment actions gives responders the authority to act quickly within agreed limits. Removing isolation, adding broad approvals, or eliminating command structure would worsen delays.

Question 50Preparation and Incident Response Planning

Which metric best measures the effectiveness of an incident response program's detection-to-containment capability?

  1. The number of employees trained
  2. The mean time from detection to containment Correct answer.
  3. The total count of firewall rules
  4. The number of policies written

Explanation

Mean time from detection to containment directly reflects how quickly the program limits incident impact. Policy counts, rule counts, and training headcounts are inputs, not effectiveness measures of containment speed.