Incident Management

An organization's incident response (IR) policy should be approved by which of the following to ensure authority and accountability?

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is unable to restore operations within the maximum tolerable downtime (MTD). Which action should be taken next?

Which incident severity level requires executive notification and a 24/7 response?

Following a data breach, an organization conducts a root cause analysis using the 5 Whys technique. The analysis identifies that a misconfigured firewall allowed unauthorized access. What is the most important next step to prevent recurrence?

An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?

Which of the following is typically a member of the crisis management team (CMT) during a major cybersecurity incident?

As part of post-incident activities, an organization schedules a lessons learned meeting. When should this meeting ideally take place?

During a data breach investigation, legal counsel instructs the forensics team to preserve evidence under attorney-client privilege. Which of the following actions is most critical to maintain that privilege?

An organization is updating its incident response playbook after a ransomware attack. Which of the following should be included as a key step in the ransomware playbook?

Which of the following is the primary purpose of having a pre-established forensic retainer agreement?

After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?

Which TWO of the following are essential components of an incident response programme?

Which THREE of the following should be included in an incident communication template?

Which TWO of the following are appropriate actions for preserving evidence during a cybersecurity incident?

During a major security incident classified as P1, which of the following is the MOST appropriate communication frequency to the executive team?

An organization's incident response team has contained a ransomware incident. What is the NEXT step according to the incident management program?

An organization has just experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Which of the following is the PRIMARY purpose of an incident response plan?

During a DDoS attack classified as P2, what is the EXPECTED response time and notification level?

An organization is conducting a root cause analysis after an insider threat incident. Which of the following tools is MOST appropriate for identifying the underlying management governance failure?

When should an incident response transition to business continuity and disaster recovery (BC/DR) activation?

Which of the following is the FIRST step when engaging an external forensics firm for an incident?

An organization has experienced a credential compromise incident. Which playbook should the incident response team primarily use?

During a major incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the communications lead on the CMT?

What is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

An organization's incident response team has identified that a data breach involves customer personal information. Which of the following should be done FIRST to preserve evidence for potential litigation?

Which TWO of the following are essential components of an incident response plan? (Select two.)

Which TWO of the following are key roles on the crisis management team (CMT) for a major cybersecurity incident? (Select two.)

Which THREE of the following are incident severity levels defined in a typical incident management program? (Select three.)

During a P1 incident, the incident response team identifies that the root cause is a misconfigured firewall. According to best practices, which of the following should be the PRIMARY focus of the root cause analysis?

An organization has experienced a ransomware attack that has encrypted critical servers. The incident response team is unable to contain the incident within the maximum tolerable downtime (MTD). Who has the authority to declare a disaster and activate the business continuity plan?

Which of the following is the PRIMARY purpose of having a pre-established contract with a digital forensics firm before an incident occurs?

During a data breach investigation, the incident response team discovers that a backup was encrypted by ransomware. The team needs to determine the sequence of events leading to the encryption. Which of the following documentation is MOST critical to preserve for potential litigation?

An organization's incident response team is handling a P2 incident involving an insider threat. The team has identified the employee responsible. The communications lead is preparing a notification to affected parties. Which of the following should be included in the notification?

Following a major security incident, the lessons learned meeting is scheduled. Which of the following outcomes is MOST important to ensure the effectiveness of future incident response?

Which incident severity level requires executive notification and a 24/7 response?

During a DDoS attack, the incident response team is struggling to mitigate the attack. The team decides to engage the organization's ISP and a DDoS mitigation service. Which of the following should be done FIRST?

An organization is subject to GDPR and experiences a data breach involving personal data. What is the maximum timeframe to notify the supervisory authority?

Following a credential compromise incident, the incident response team is conducting root cause analysis using the 5 Whys technique. The first 'why' reveals that the password was weak. The second 'why' reveals that the password policy allowed simple passwords. What should be the focus of the third 'why'?

An incident response team is conducting an exercise to test its playbook for a ransomware incident. Which of the following is the PRIMARY benefit of such an exercise?

During a P1 incident, the incident response manager is preparing an executive sitrep. Which of the following should be included to preserve legal privilege?

An organization is updating its incident response plan. Which TWO components should be included to ensure effective evidence handling? (Select TWO.)

During a major cybersecurity incident, the crisis management team (CMT) is activated. Which THREE roles are typically part of the CMT? (Select THREE.)

An incident response team is creating playbooks for different incident types. Which TWO incident types should have a dedicated playbook? (Select TWO.)

During a major cybersecurity incident classified as P1, the incident response team has been activated. The crisis management team (CMT) is also convened. Which of the following is the PRIMARY responsibility of the CMT during this incident?

An organization's incident response plan includes a ransomware playbook. After detecting ransomware on a critical server, which of the following should be the FIRST action according to best practices?

During a post-incident root cause analysis, the team uses the '5 Whys' technique and identifies a technical vulnerability as the cause. According to CISM best practices, what should be the NEXT level of analysis?

An incident has been declared as P2 (high severity). According to the incident classification, what is the expected response timeframe and notification requirement?

In the context of incident management, which of the following is the PRIMARY purpose of conducting lessons learned meetings within two weeks of incident resolution?

During a data breach investigation, an organization engages an external forensics firm. To preserve attorney-client privilege, which of the following is the BEST practice?

What is the PRIMARY reason for having an incident response team roster and contact list readily available?

After a DDoS attack, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). According to best practices, what should happen next?

An organization is required to report a material cybersecurity incident to the SEC within 4 business days (proposed rule). However, the incident is still under investigation. What is the BEST course of action?

Which of the following incident types is MOST likely to require activation of the crisis management team (CMT) due to potential regulatory and reputational impact?

In the incident response team structure, who is typically responsible for coordinating communication with external stakeholders such as customers and the media?

An organization maintains evidence handling procedures for incident response. A forensic investigator needs to collect a hard drive from a compromised server. Which of the following is the MOST critical step to ensure admissibility in court?

An organization is updating its incident response plan. Which TWO components are essential to include for effective insider threat management? (Select TWO.)

After a data breach involving customer PII, the incident response team is conducting a root cause analysis. Which THREE factors should be examined according to CISM best practices? (Select THREE.)

An organization is preparing for a potential supply chain incident. According to CISM best practices, which THREE elements should be included in the supply chain incident playbook? (Select THREE.)

An organization has experienced a ransomware attack that encrypted critical servers. The incident has been classified as P1. Which of the following is the FIRST action the incident response team should take according to the IR plan?

Which of the following is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

During a major data breach investigation, legal counsel advises the incident response team to preserve attorney-client privilege over communications with external forensic investigators. Which of the following actions BEST supports this objective?

An organization's incident response team is handling a P2 insider threat incident involving unauthorized access to customer data. According to the incident classification, which of the following is the MOST appropriate notification and response timeframe?

Which of the following is the PRIMARY reason for having a pre-established forensic retainer agreement before an incident occurs?

During a P1 incident, the crisis management team (CMT) has been activated. The CEO asks for an hourly sitrep. Which of the following is the MOST appropriate content for the sitrep?

An organization has experienced a DDoS attack that is overwhelming its internet-facing services. The incident response team has implemented mitigations, but services remain degraded. The maximum tolerable downtime (MTD) for the affected services is 4 hours, and 3 hours have passed. Which of the following should the incident manager do NEXT?

Which of the following is the BEST approach for sharing threat intelligence indicators of compromise (IoCs) after an incident?

Which of the following is the PRIMARY reason for including communication templates in the incident response plan?

An organization is conducting a root cause analysis after a data breach. Which of the following sequences BEST aligns with the 5 Whys approach from a CISM perspective?

During a P1 incident involving a ransomware attack, the crisis management team has been activated. The communications lead is drafting an all-staff internal communication. Which of the following should be INCLUDED in this communication?

Which of the following is the PRIMARY role of the executive sponsor in the incident response team structure?

Which of the following incident categories would typically require the involvement of the crisis management team?

An organization's incident response plan requires that evidence be preserved for potential litigation. Which of the following actions is MOST critical to ensure the admissibility of digital evidence?

After a data breach involving personal data of EU residents, the incident manager must ensure compliance with GDPR notification requirements. Within how many hours must the organization notify the relevant supervisory authority of the breach?

Which TWO of the following are essential components of an incident response (IR) plan? (Select TWO)

Which THREE of the following are typical roles in an incident response team? (Select THREE)

Which TWO of the following are key considerations when managing an external forensics firm during an incident? (Select TWO)

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident?

During a P1 (critical) incident, the incident response manager is coordinating response activities. Who is primarily responsible for activating the crisis management team (CMT)?

Following a ransomware incident where data was encrypted and exfiltrated, the root cause analysis reveals that the initial access occurred through a phishing email that bypassed email filters due to a misconfiguration. The misconfiguration was not identified because the security team lacked a formal process to review firewall rule changes. Which of the following is the most appropriate management/governance failure to document in the lessons learned?

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the relevant supervisory authority?

Which incident severity level requires executive notification and 24/7 response, and has major business impact?

During a major incident, the incident response team discovers that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

An organization is engaging an external forensics firm to investigate a suspected data breach. Which of the following is the most important step to ensure that evidence remains admissible in legal proceedings?

Which role in the incident response team structure is responsible for coordinating all response activities and making decisions about incident severity classification?

A security analyst detects a series of failed login attempts followed by a successful login from an unusual geographic location. The account is a standard user account. Which incident category best describes this scenario?

After a major incident, the lessons learned meeting is scheduled. According to best practices, when should this meeting typically be held after incident resolution?

During a P1 incident involving a ransomware attack, the incident response manager needs to communicate with executives. Which of the following is the most appropriate approach for executive communication?

An organization is updating its incident response plan after a lessons learned meeting. Which of the following is the primary purpose of updating the plan based on lessons learned?

A company experiences a DDoS attack that overwhelms its internet-facing services. The incident response team implements mitigation measures. During which phase of incident response is it most appropriate to collect and preserve evidence for potential legal action?

Which type of incident response exercise involves a facilitated discussion of a hypothetical scenario to review plans and procedures?

An organization has a policy to share indicators of compromise (IoCs) with an Information Sharing and Analysis Center (ISAC). This activity is most closely associated with which phase of incident management?

Which TWO of the following are essential components of an incident response programme that should be established before an incident occurs? (Select TWO.)

Which TWO of the following are appropriate criteria for escalating an incident to the crisis management team (CMT)? (Select TWO.)

Which THREE of the following are key activities during the post-incident phase of incident management? (Select THREE.)

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident, such as ransomware or data breach?

During a P1 (critical) security incident, which of the following is the MOST appropriate frequency for providing executive status updates?

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is working on containment. Which communication should the incident manager prioritize FIRST?

Which post-incident activity involves identifying the technical cause, the process failure that allowed it, and the management/governance failure that permitted the process failure?

Which incident severity level is characterized by major business impact, requires executive notification, and demands 24/7 response?

An organization's incident response team has contained a data breach. Legal counsel has advised that litigation is likely. Which of the following actions should the team take to preserve evidence?

During a major cybersecurity incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the CEO as a member of the CMT?

What is the recommended timeframe for holding a lessons learned meeting after an incident has been resolved?

Which of the following is a key reason to have a forensic retainer in place before an incident occurs?

An incident response team is handling a supply chain compromise that has affected a critical business process. The estimated recovery time exceeds the maximum tolerable downtime (MTD). What should the incident manager do NEXT?

Which of the following is a key objective of sharing threat intelligence, such as indicators of compromise (IoCs), with an Information Sharing and Analysis Center (ISAC)?

Which incident category involves unauthorized access to systems or data by an individual within the organization?

An organization has experienced a P2 incident. According to standard incident severity definitions, which response timeframe is typically expected?

A security analyst suspects a credential compromise involving an executive's account. The analyst has isolated the system. What should be the NEXT step according to best practices?

Which of the following is the PRIMARY reason to include legal counsel in the incident response team?

Which TWO of the following are required components of an incident response programme according to best practices? (Select two.)

Which THREE of the following are appropriate members of a crisis management team (CMT) for a major cybersecurity incident? (Select three.)

Which TWO of the following are typical notification deadlines for regulatory reporting of a data breach? (Select two.)

Which THREE of the following are objectives of a lessons learned meeting after an incident? (Select three.)

Which component of an incident response program is most likely to include step-by-step technical actions for addressing a specific type of security incident?

During a P1 (critical) security incident involving a ransomware attack that has encrypted critical servers, which role is primarily responsible for coordinating the overall response and ensuring timely communication to executive leadership?

During a data breach investigation, the legal counsel advises the incident response team to ensure that communications with external forensic experts are protected by attorney-client privilege. Which action best preserves this privilege?

After a P2 (high) incident is resolved, the incident response team conducts a lessons learned meeting. Which timeframe is most appropriate for holding this meeting?

When an incident cannot be resolved within the maximum tolerable downtime (MTD), what is the appropriate action regarding business continuity and disaster recovery (BC/DR)?

Which incident category typically involves an employee intentionally or accidentally causing harm to the organization's information systems?

During a P1 incident, the crisis management team (CMT) is activated and meets within the first hour. Which communication practice is most appropriate for the CMT to follow when providing updates to the board of directors?

Which of the following is the primary purpose of conducting a root cause analysis (RCA) after a security incident?

In the context of incident severity classification, which of the following best describes a P3 (medium) incident?

An organization is updating its incident response plan after a major incident. Which post-incident activity should be performed to ensure the plan reflects lessons learned?

A company discovers a credential compromise affecting multiple user accounts. According to best practices, what is the first step the incident response team should take?

Under the proposed SEC rules for cybersecurity incident disclosure, what is the timeframe for reporting a material cybersecurity incident?

Which of the following is an example of an external stakeholder that should be included in the incident response plan's vendor contacts list?

Which TWO of the following are key responsibilities of the crisis management team (CMT) during a major cybersecurity incident?

Which THREE of the following are essential elements of a forensic evidence handling procedure to ensure admissibility in court?

Which component of the incident response programme provides step-by-step technical instructions for handling a specific type of security incident?

During a P1 (critical) incident involving a ransomware attack that has encrypted critical systems, the incident manager needs to provide updates to executives. What is the recommended frequency for situation reports (sitreps)?

A security analyst discovers that an employee's credentials were used to access a sensitive database containing customer PII. The analyst immediately disables the account and begins remediation. Which incident category best describes this scenario?

Following containment of a ransomware incident, the incident response team is conducting a root cause analysis. Which method involves repeatedly asking 'why' to drill down to underlying causes?

What is the primary purpose of having a pre-established forensic retainer agreement with an external forensics firm?

During a major incident, the crisis management team (CMT) has been activated. Which of the following is typically NOT a member of the CMT?

An incident response team is handling a P2 (high) incident. According to the incident severity classification, which of the following is the expected response timeframe?

Which document outlines the overall strategy, roles, and responsibilities for incident response across the organization?

After a data breach incident, the incident response team must preserve evidence for potential litigation. Which of the following actions should be taken FIRST?

An organization is required to notify regulators of a material cybersecurity incident within 4 business days. Which regulation imposes this requirement?

During a DDoS attack, the incident response team determines that the attack cannot be mitigated within the maximum tolerable downtime (MTD). What should happen next?

Which of the following is the primary reason for conducting a lessons learned meeting after an incident?

An organization has just experienced a P1 incident. Which of the following communication steps should occur FIRST?

During a forensic investigation, the external forensics firm discovers evidence that may indicate criminal activity. The incident manager wants to ensure attorney-client privilege is maintained. What should be done?

Which incident severity level requires executive notification and a 24/7 response?

Which TWO of the following are components of an incident response programme?

Which TWO of the following are incident categories in an incident management programme?

Which THREE of the following are typical roles in an incident response team?

An organization has experienced a ransomware attack that has encrypted critical servers and is causing major business disruption. According to incident severity levels, which priority should this incident be assigned?

During a major cybersecurity incident, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?