CISM Practice Test 22 — 15 Questions

Question 1

Based on the exhibit, what is the first action the incident response team should take?

Accepted Answer

Review the web server logs on 192.168.1.10 for evidence of exploitation.. Option C is correct because the first step is to investigate the target web server logs to determine if the XSS attempt was successful. Blocking the source IP or disabling the rule may be premature if the attack was not effective, and confirming a false positive is less direct than reviewing logs.

Answer

Confirm the IDS alert is not a false positive.

Answer

Block the source IP 10.5.5.5 on the firewall.

Answer

Disable the firewall rule 'Allow-Internal-Web'.

Question 2

An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)

Accepted Answer

Notify the relevant data protection authority within the required timeframe.. Options B and D are correct. B is required by regulations; D is best practice. Option A is wrong; Option C is wrong because logs are needed for investigation; Option E is wrong because press release should be coordinated.

Answer

Immediately issue a press release without consulting legal.

Answer

Ignore the incident if no customers have complained.

Answer

Delete all system logs to prevent further exposure.

Question 3

An organization's intrusion detection system alerts on a potential C2 communication from an internal host. Which phase of the incident response lifecycle should be initiated first?

Accepted Answer

Detection and Analysis. Option A is correct because detection and analysis is the first phase after preparation. Option B is wrong because containment follows analysis. Option C is wrong because eradication comes after containment. Option D is wrong because recovery is after eradication.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 4

Which TWO criteria should an organization use to prioritize incidents during triage?

Accepted Answer

Potential business impact. Options B and E are correct: business impact and data sensitivity are key factors. Option A is wrong because the time of detection does not inherently define priority. Option C is wrong because the skill of the analyst is not a triage criterion. Option D is wrong because the number of affected users is a proxy, but business impact is more holistic.

Answer

Number of users affected

Answer

Time of detection

Answer

Skill level of the responding analyst

Question 5

A security operations center receives an alert from an IDS indicating possible command and control traffic. The analyst is unsure if it's a true positive. Which combination of actions should be taken first?

Accepted Answer

Correlate the alert with firewall and proxy logs and review threat intelligence.. Option C is correct because correlating with other logs and threat intelligence helps validate the alert before taking potentially disruptive actions. Blocking prematurely may be a false positive; disabling signatures is dangerous; full forensics is premature.

Answer

Disable the IDS signature to prevent further alerts.

Answer

Immediately block the source IP and escalate to the incident response team.

Answer

Conduct a full forensic analysis of the affected host.

Question 6

A security analyst receives an alert indicating a potential data exfiltration from a server. Which of the following should be the FIRST step in the incident response process?

Accepted Answer

Verify the alert to confirm it is not a false positive.. Option C is correct because the first step in incident response is to verify the alert to avoid unnecessary response to false positives. Option A is wrong because isolation may be premature without verification. Option B is wrong because escalation should occur after confirmation. Option D is wrong because forensic analysis is done after containment.

Answer

Perform a forensic analysis.

Answer

Escalate to senior management.

Answer

Isolate the server from the network.

Question 7

A security analyst detects unusual outbound traffic from a critical server to an unknown external IP address during business hours. Which step should be taken FIRST in the incident response process?

Accepted Answer

Contact the server owner to verify the traffic. The first step is to verify if the traffic is legitimate or malicious. Contacting the server owner helps determine if the traffic is authorized, preventing unnecessary escalation. Immediate containment (C) is premature without verification. Reporting to management (A) or law enforcement (D) occurs after confirmation.

Answer

Notify law enforcement about the potential breach

Answer

Isolate the server from the network immediately

Answer

Report the incident to senior management

Question 8

An organization's incident response team is conducting a lessons learned meeting after a major incident. Which outcome is MOST critical to document?

Accepted Answer

Root cause analysis. Option B is correct because root cause analysis prevents recurrence. Option A is wrong although timeline is useful, root cause is more critical. Option C is wrong because cost is not the primary learning objective. Option D is wrong because tool list is less strategic.

Answer

Detailed timeline of events

Answer

List of tools used

Answer

Total cost of the incident

Question 9

After a phishing attack, an organization's incident response team identifies that the attacker gained access to an email account and sent internal spear-phishing emails. What is the BEST immediate containment action?

Accepted Answer

Disable the compromised account. Option D is correct because disabling the compromised account stops further malicious activity. Option A is wrong because blocking the attacker's IP is ineffective if the attacker is using compromised internal accounts. Option B is wrong because resetting passwords across the domain may cause disruption and does not isolate the immediate threat. Option C is wrong because email filtering may not block internal-to-internal emails.

Answer

Reset all user passwords

Answer

Block the attacker's IP address at the firewall

Answer

Increase email filtering rules

Question 10

A security analyst detects a potential data exfiltration from a critical server. According to incident response best practices, what is the first action the analyst should take?

Accepted Answer

Disconnect the server from the network immediately.. Option A is correct because immediate containment is the priority to stop further data loss. Other actions are important but should follow containment.

Answer

Notify the incident response manager.

Answer

Review firewall logs to confirm the exfiltration.

Answer

Take a forensic image of the server.

Question 11

An incident response plan should include which three key components to ensure effective response? (Choose three.)

Accepted Answer

Communication procedures for internal and external stakeholders.. Options A, C, and E are correct because roles and responsibilities, communication procedures, and evidence handling are fundamental. Detailed technical instructions are impractical, and pre-approved vendors are helpful but not core.

Answer

Detailed step-by-step technical instructions for all possible incidents.

Answer

A list of pre-approved vendors for forensic services.

Question 12

After a ransomware attack, the incident response team successfully restores systems from backups. However, the ransomware encrypts files that were modified after the last backup was taken. Which of the following is the BEST way to minimize future data loss?

Accepted Answer

Use continuous data protection (CDP) with frequent snapshots.. Option C is correct because CDP provides near-real-time backup, minimizing data loss between backups. Option A is wrong because daily backups still have a window of up to 24 hours. Option B is wrong because DLP prevents exfiltration, not data loss. Option D is wrong because network drives also need backup.

Answer

Train users to save files to network drives.

Answer

Perform full backups daily instead of weekly.

Answer

Implement a data loss prevention (DLP) system.

Question 13

A security operations center analyst receives an alert from the SIEM indicating a possible data exfiltration. The analyst is unsure if it is a true positive. What is the MOST appropriate action?

Accepted Answer

Review additional logs to confirm. Before escalating or taking containment actions, the analyst should gather additional evidence to confirm the alert. Option D is correct.

Answer

Escalate to the incident response manager

Answer

Immediately block the source IP

Answer

Quarantine the affected system

Question 14

A company's incident response team uses a SIEM to detect security events. Which SIEM capability is MOST critical for early detection of a potential incident?

Accepted Answer

Correlation rules. Correlation rules analyze multiple log sources to identify patterns indicating an attack, enabling early detection. Real-time alerting (A) is important but relies on correlation. Log retention (B) aids investigation. User behavior analytics (D) is advanced but not the most critical for early detection.

Answer

Real-time alerting

Answer

User and entity behavior analytics (UEBA)

Answer

Long-term log retention

Question 15

Which THREE steps are essential in the post-incident review process?

Accepted Answer

Identify lessons learned and process improvements. Options A, C, and D are correct: identifying improvements, root cause analysis, and updating the IRP are key. Option B is wrong because assigning blame is counterproductive. Option E is wrong because vendor contracts are not necessarily reviewed unless relevant.

Answer

Assign blame for the incident

Answer

Renew vendor contracts

CISM Practice Test 22 — 15 Questions

Exhibit

CISM Practice Test 22 — 15 Questions

Exhibit