10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The C)IHE exam has 100 questions and runs 2 hours.
These 10 free C)IHE questions are organized by exam domain, so you can see how each part of the Certified Incident Handling Engineer blueprint is tested. Reveal the answer and explanation under each question.
An organization is creating its incident response documentation. Which document should define the high-level authority, responsibilities, and expectations for incident handling?
Correct answer: A - Incident response policy
A multinational company has regional security teams that handle local events while coordinating major incidents centrally. Which incident response team model characteristic is demonstrated?
Correct answer: B - A model selected to match organizational requirements
A response team publishes information about a newly discovered threat so other internal groups can prepare. Which incident response team service is being performed?
Correct answer: A - Advisory distribution
A security team wants to identify malicious activity before a confirmed compromise occurs. Which preparation activity BEST supports this objective?
Correct answer: A - Threat hunting based on hypotheses and available indicators
A security analyst observes repeated failed administrator logins followed by a successful login from an unfamiliar geographic location. Which action BEST represents the initial detection and analysis activity?
Correct answer: B - Document the indicators and analyze whether the activity represents a security incident
An investigator finds malware hash values, suspicious domains, and unusual outbound connections during an analysis. These findings are BEST classified as:
Correct answer: C - Indicators of compromise
During a ransomware investigation, a responder must limit damage while preserving the ability to investigate. Which consideration is MOST important when selecting a containment strategy?
Correct answer: C - The balance between reducing impact and preserving investigative requirements
After collecting a compromised workstation for forensic examination, which practice BEST protects the reliability of the evidence?
Correct answer: B - Maintain proper evidence handling and documentation
Following a major incident, the response team meets to determine what worked, what failed, and what should change. The PRIMARY purpose of this activity is to:
Correct answer: C - Capture lessons learned and improve future response
A company joins a collaborative exercise where defenders and offensive testers work together to improve security visibility. This activity is known as:
Correct answer: A - Purple teaming
The C)IHE exam also covers these domains. Drill them in the full free practice test:
The full bank has 1,020 more C)IHE questions with explanations.
Continue in the free practice test →
View plans