CIR Practice Questions - PECB Certified Incident Responder (CIR) Exam - CIR Practice Questions - PECB Certified Incident Responder (CIR) Exam

Question 1

Which sequence correctly orders the main phases of the incident response lifecycle as used in the PECB Certified Incident Responder body of knowledge?

Preparation, detection, containment, recovery, eradication, lessons learned Preparation, detection, containment, eradication, recovery, lessons learned Detection, preparation, containment, eradication, lessons learned, recovery Preparation, containment, detection, eradication, recovery, lessons learned

Correct Answer:

Preparation, detection, containment, eradication, recovery, lessons learned

Question 2

What is the primary goal of the containment phase of incident response?

To remove all malware and persistence mechanisms from affected systems To restore business services from verified clean backups as quickly as possible To limit the spread of the incident and prevent further damage while preserving evidence To document root cause and improvements for the final incident report

Correct Answer:

To limit the spread of the incident and prevent further damage while preserving evidence

Question 3

Which of the following is the clearest example of an indicator of compromise (IoC)?

A newly hired employee receiving a standard corporate laptop image An unexpected outbound connection from a workstation to an IP address associated with known malware command-and-control infrastructure A scheduled antivirus scan completing successfully on a file server A user resetting their password through the self-service portal

Correct Answer:

An unexpected outbound connection from a workstation to an IP address associated with known malware command-and-control infrastructure

Question 4

Why is maintaining a chain of custody essential when collecting evidence during an incident investigation?

It encrypts all collected evidence so attackers cannot read it It documents who handled the evidence, when, and how, preserving its integrity and admissibility for legal or disciplinary action It guarantees that the evidence will identify the attacker with certainty It allows responders to share evidence freely with any third party that requests it

Correct Answer:

It documents who handled the evidence, when, and how, preserving its integrity and admissibility for legal or disciplinary action

Question 5

A responder wants to inspect running processes on a Windows host, including parent-child process relationships and verified signatures. Which built-in or Sysinternals tool is best suited for this task?

Process Explorer Notepad Disk Defragmenter Windows Fax and Scan

Correct Answer:

Process Explorer

Exam overview

About this Exam

Prepare with the CIR Practice Questions - PECB Certified Incident Responder (CIR) Exam practice quiz. This question bank includes 100 questions covering ransomware, incident, malware, analysis, and responder. Use it to review important concepts, identify knowledge gaps, and build confidence for the related exam, course, or assessment.

More details

Additional Information

CIR Practice Questions - PECB Certified Incident Responder (CIR) Exam

This practice set contains 100 questions from the matching question bank and focuses on ransomware, incident, malware, analysis, and responder. Work through each question carefully, review the provided solutions, and revisit topics that need more study before your next attempt.

This is an independent study resource intended for practice and review; it is not an official examination or an endorsement by any organization named in the title.

Quiz information

Frequently Asked Questions

The complete question count is available after full access is unlocked.

No fixed duration is currently configured for this quiz.

Question explanations are included where they are available in the quiz content, helping you review the reasoning after answering.

Yes. You can retake the practice test again as you continue studying during your available access period.

After your access is confirmed, you can continue into the complete practice exam from this quiz flow.

Unless explicitly stated otherwise, this page provides independent practice material for study and exam preparation and is not the official examination itself.

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

Correct Answer:

About this Exam

Additional Information

CIR Practice Questions - PECB Certified Incident Responder (CIR) Exam

Frequently Asked Questions

Related Questions

ISC2 Certified in Cybersecurity Practice Exam

Arizona CNA Certified Nursing Assistant Practice Exam

Certified Professional Public Buyer (CPPB) Practice Exam

Certified Specialist Business Intelligence (CSBI) Practice Test

Certified Specialist In Renal Nutrition (CSR) Practice Exam

Certified Specialist Physician Practice Management (CSPPM) Practice Exam