CISM Practice Test 24 — 15 Questions

Question 1

Which role in the incident response team structure is responsible for coordinating all response activities and making decisions about incident severity classification?

Accepted Answer

Incident response manager. The IR manager leads the team, coordinates activities, and classifies incidents based on severity.

Answer

Communications lead

Answer

Security analysts

Answer

Forensic investigators

Question 2

An organization's incident response team has contained a data breach. Legal counsel has advised that litigation is likely. Which of the following actions should the team take to preserve evidence?

Accepted Answer

Issue a legal hold and create forensic images of affected systems. When litigation is anticipated, a legal hold must be issued to prevent destruction of relevant evidence, and forensic copies should be made before remediation.

Answer

Immediately wipe affected systems to prevent further data loss

Answer

Notify the affected individuals as required by law

Answer

Delete all logs to avoid exposing sensitive information

Question 3

An incident response team is handling a supply chain compromise that has affected a critical business process. The estimated recovery time exceeds the maximum tolerable downtime (MTD). What should the incident manager do NEXT?

Accepted Answer

Escalate to the BC/DR team and the authority who can declare a disaster. When MTD is exceeded, the incident escalates to business continuity/disaster recovery activation. The BC/DR decision authority should be notified to declare a disaster and activate recovery plans.

Answer

Notify affected customers of the expected delay

Answer

Continue containment efforts and hope for a faster recovery

Answer

Shut down the affected system to prevent further impact

Question 4

Which TWO of the following are essential components of an incident response programme that should be established before an incident occurs? (Select TWO.)

Accepted Answer

A signed retainer agreement with a forensics firm. An IR team with defined roles and a signed retainer with a forensics firm are critical preparatory elements. The IR plan is also prepared, but the question asks for components established before an incident.

Answer

An insurance claim form for cyber incidents

Answer

A list of affected customers from the most recent data breach

Answer

A root cause analysis report from a previous incident

Question 5

A security analyst detects a series of failed login attempts followed by a successful login from an unusual geographic location. The account is a standard user account. Which incident category best describes this scenario?

Accepted Answer

Account compromise. The scenario describes an account compromise where credentials are likely stolen and used to gain unauthorized access.

Answer

Data breach

Answer

Supply chain attack

Answer

Insider threat

Question 6

During a P1 (critical) security incident, which of the following is the MOST appropriate frequency for providing executive status updates?

Accepted Answer

Hourly situation reports (sitreps). For critical incidents, regular and frequent communication is required to keep executives informed.

Answer

At the end of the incident

Answer

Daily briefings

Answer

Only upon significant changes

Question 7

What is the PRIMARY reason for having an incident response team roster and contact list readily available?

Accepted Answer

To enable quick activation of the incident response team.. Rapid activation of the IR team depends on knowing who to contact and their backup.

Answer

To satisfy regulatory compliance requirements.

Answer

To ensure all team members have the necessary training.

Answer

To provide a list for auditors to review.

Question 8

Which TWO of the following are typical notification deadlines for regulatory reporting of a data breach? (Select two.)

Accepted Answer

4 business days (SEC proposed). GDPR requires notification within 72 hours. The SEC proposed rule requires notification within 4 business days for material cybersecurity incidents.

Answer

30 days

Answer

7 days

Answer

24 hours

Question 9

An organization has just experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of the breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 10

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

Accepted Answer

To preserve attorney-client privilege and avoid creating damaging records. Legal counsel involvement helps protect communications under attorney-client privilege and avoids speculation that could create liability.

Answer

To approve technical containment actions

Answer

To coordinate with external forensics firms

Answer

To ensure compliance with regulatory notification deadlines

Question 11

Which incident severity level requires executive notification and 24/7 response, and has major business impact?

Accepted Answer

P1 - Critical. P1 (Critical) incidents have major business impact, require executive notification, and demand a 24/7 response effort.

Answer

P3 - Medium

Answer

P2 - High

Answer

P4 - Low

Question 12

Which incident severity level is characterized by major business impact, requires executive notification, and demands 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have the highest severity and require immediate, around-the-clock response.

Answer

P3 — Medium

Answer

P2 — High

Answer

P4 — Low

Question 13

Which of the following is the primary reason for conducting a lessons learned meeting after an incident?

Accepted Answer

To update the IR plan and playbooks. The lessons learned meeting aims to identify improvements to the incident response process.

Answer

To document the incident for insurance

Answer

To satisfy regulatory requirements

Answer

To assign blame

Question 14

Which of the following is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a step-by-step guide for responding to incidents. The IR plan provides a structured approach to manage incidents, minimizing impact and ensuring efficient response.

Answer

To document vendor contacts only

Answer

To assign blame for security failures

Answer

To replace the need for incident response training

Question 15

Which THREE of the following are key activities during the post-incident phase of incident management? (Select THREE.)

Accepted Answer

Updating incident response plans and playbooks based on lessons learned. Root cause analysis, updating the IR plan/playbooks, and sharing IoCs with ISACs are all post-incident activities. Activating the DR site occurs during the response, not post-incident.

Answer

Activating the disaster recovery site

Answer

Implementing immediate containment measures