CISM Practice Test 25 — 15 Questions

Question 1

What is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Accepted Answer

To update the incident response plan and procedures. Lessons learned aims to improve future response by identifying what worked and what didn't.

Answer

To determine if legal action is needed

Answer

To calculate the financial impact of the incident

Answer

To assign disciplinary actions

Question 2

Following a ransomware incident where data was encrypted and exfiltrated, the root cause analysis reveals that the initial access occurred through a phishing email that bypassed email filters due to a misconfiguration. The misconfiguration was not identified because the security team lacked a formal process to review firewall rule changes. Which of the following is the most appropriate management/governance failure to document in the lessons learned?

Accepted Answer

The security team did not have a change management process for security control configurations.. The technical cause is the phishing email, the process failure is the lack of review of email filter configurations, and the management/governance failure is the absence of a change management process for security controls.

Answer

Employees should have been trained to recognize phishing emails.

Answer

The email filter vendor did not provide adequate support.

Answer

The incident response plan was not followed during the incident.

Question 3

An organization is engaging an external forensics firm to investigate a suspected data breach. Which of the following is the most important step to ensure that evidence remains admissible in legal proceedings?

Accepted Answer

Issuing a legal hold and making forensic copies of affected systems before remediation. Preserving the chain of custody and ensuring forensic copies are made before remediation is critical for evidence admissibility. Legal hold ensures that relevant data is preserved.

Answer

Ensuring the forensics firm has signed a non-disclosure agreement

Answer

Negotiating a fixed price for the investigation

Answer

Requiring the forensics firm to report findings directly to the CEO

Question 4

A security analyst suspects a credential compromise involving an executive's account. The analyst has isolated the system. What should be the NEXT step according to best practices?

Accepted Answer

Create a forensic image of the affected system. Before any remediation, preserving evidence (forensic image) is critical for investigation and potential legal action. Then notify the incident manager to follow the playbook.

Answer

Block the account in Active Directory

Answer

Notify the executive and ask them to change their password

Answer

Reset the executive's password immediately

Question 5

During a major incident, the crisis management team (CMT) has been activated. Which of the following is typically NOT a member of the CMT?

Accepted Answer

Security analyst. The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications; a security analyst is part of the incident response team, not the CMT.

Answer

General counsel

Answer

Chief information security officer

Answer

CEO

Question 6

After a DDoS attack, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). According to best practices, what should happen next?

Accepted Answer

Escalate to the business continuity and disaster recovery teams.. If MTD cannot be met, business continuity or disaster recovery plans should be activated.

Answer

Notify customers and shut down operations.

Answer

Continue current response efforts and hope for the best.

Answer

Declare the incident as a disaster immediately without further analysis.

Question 7

Under the proposed SEC rules for cybersecurity incident disclosure, what is the timeframe for reporting a material cybersecurity incident?

Accepted Answer

Within 4 business days. The proposed SEC rules require reporting within 4 business days for material cybersecurity incidents. GDPR requires 72 hours for personal data breaches.

Answer

Within 7 calendar days

Answer

Within 72 hours

Answer

Within 24 hours

Question 8

An incident response team is creating playbooks for different incident types. Which TWO incident types should have a dedicated playbook? (Select TWO.)

Accepted Answer

Ransomware. Ransomware and data breach are common incident types that require specific procedures.

Answer

Password expiration

Answer

Software update failure

Answer

Phishing simulation

Question 9

Which of the following is the primary purpose of conducting a root cause analysis (RCA) after a security incident?

Accepted Answer

To determine process and governance failures that allowed the incident to occur. RCA aims to identify underlying causes to prevent recurrence. While it may involve understanding the technical cause, the ultimate goal is to improve processes and controls.

Answer

To identify the technical vulnerability that was exploited

Answer

To satisfy regulatory reporting requirements

Answer

To assign blame to responsible individuals

Question 10

Which incident category involves unauthorized access to systems or data by an individual within the organization?

Accepted Answer

Insider threat. Insider threat incidents are caused by employees, contractors, or other trusted insiders.

Answer

DDoS

Answer

Data breach

Answer

Ransomware

Question 11

During a data breach investigation, the incident response team discovers that a backup was encrypted by ransomware. The team needs to determine the sequence of events leading to the encryption. Which of the following documentation is MOST critical to preserve for potential litigation?

Accepted Answer

The chain of custody for the backup media. Chain of custody documentation is essential to prove the integrity and admissibility of digital evidence in court.

Answer

The communication logs between team members

Answer

The forensic tools used in the investigation

Answer

The incident response plan version used during the incident

Question 12

In the incident response team structure, who is typically responsible for coordinating communication with external stakeholders such as customers and the media?

Accepted Answer

Communications lead. The communications lead handles external messaging to ensure consistency and accuracy.

Answer

Legal counsel

Answer

Incident response manager

Answer

Executive sponsor

Question 13

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident?

Accepted Answer

Incident response playbook. Playbooks are specific to incident types (e.g., ransomware) and provide step-by-step guidance, whereas the IR plan is a high-level document and policy sets overall intent.

Answer

Incident response policy

Answer

Incident response plan

Answer

Communication templates

Question 14

During a P1 incident involving a ransomware attack, the crisis management team has been activated. The communications lead is drafting an all-staff internal communication. Which of the following should be INCLUDED in this communication?

Accepted Answer

Instructions for employees to avoid connecting to the network until further notice.. Internal communications during an incident should provide clear guidance to employees on actions they need to take, such as not connecting devices, while avoiding speculation or blame.

Answer

Names of individuals suspected of causing the incident.

Answer

Details of the attack vector and affected systems.

Answer

Estimated time to full recovery.

Question 15

During a P1 (critical) incident involving a ransomware attack that has encrypted critical systems, the incident manager needs to provide updates to executives. What is the recommended frequency for situation reports (sitreps)?

Accepted Answer

Hourly. For P1 incidents, hourly sitreps keep executives informed of rapidly evolving situations.

Answer

Only at milestone events

Answer

Every 4 hours

Answer

Daily