CISM Practice Test 26 — 15 Questions

Question 1

An organization is required to report a material cybersecurity incident to the SEC within 4 business days (proposed rule). However, the incident is still under investigation. What is the BEST course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

File a report with the information available and provide updates as the investigation progresses.. Regulatory deadlines must be met even if information is incomplete; disclose what is known and update later.

Answer

Request an extension from the SEC because the investigation is ongoing.

Answer

Delay reporting until the investigation is complete to ensure accuracy.

Answer

Report the incident only if materiality is confirmed at the end of the investigation.

Question 2

An organization's incident response team has contained a ransomware incident. What is the NEXT step according to the incident management program?

Accepted Answer

Eradicate the malware and restore systems. After containment, the next priority is eradication of the threat to remove all traces of the malware and restore systems securely.

Answer

Perform root cause analysis

Answer

Conduct a lessons learned meeting

Answer

Notify regulatory authorities

Question 3

In the context of incident management, which of the following is the PRIMARY purpose of conducting lessons learned meetings within two weeks of incident resolution?

Accepted Answer

To update the incident response plan and playbooks based on findings.. The main goal is to improve future incident response by identifying what worked and what didn't.

Answer

To provide a final report to regulators and law enforcement.

Answer

To assign blame for the incident and take disciplinary action.

Answer

To calculate the total financial loss from the incident.

Question 4

When should an incident response transition to business continuity and disaster recovery (BC/DR) activation?

Accepted Answer

When the incident cannot be resolved within the maximum tolerable downtime (MTD). BC/DR is activated when the incident cannot be resolved within the maximum tolerable downtime (MTD).

Answer

Immediately upon detection of any incident

Answer

Only after the incident is fully contained

Answer

When the incident exceeds the recovery time objective (RTO) but is still within MTD

Question 5

After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?

Accepted Answer

Supply chain. Supply chain incidents involve attacks through third-party vendors or partners, even if the initial vector is credential compromise.

Answer

Insider threat

Answer

Account compromise

Answer

DDoS

Question 6

Which TWO of the following are key considerations when managing an external forensics firm during an incident? (Select TWO)

Accepted Answer

Maintaining chain of custody for all evidence. Managing external forensics involves defining scope, ensuring proper evidence handling and chain of custody, maintaining confidentiality, and preserving attorney-client privilege.

Answer

Allowing the firm to make independent decisions on containment

Answer

Having the firm report directly to the media

Answer

Ensuring the firm uses only proprietary tools

Question 7

An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?

Accepted Answer

Credential compromise playbook. Credential compromise incidents, such as account takeover via phishing, are handled by the credential compromise playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 8

Which TWO of the following are key roles on the crisis management team (CMT) for a major cybersecurity incident? (Select two.)

Accepted Answer

Chief Information Security Officer (CISO). The CMT typically includes the CEO and CISO, among others, to make strategic decisions.

Answer

Security analyst

Answer

Help desk manager

Answer

Network administrator

Question 9

Which of the following is the FIRST step when engaging an external forensics firm for an incident?

Accepted Answer

Activate the forensic retainer agreement. Having a pre-existing retainer agreement reduces time to engage and ensures terms are already in place.

Answer

Provide evidence to the firm

Answer

Define the scope of work

Answer

Sign a non-disclosure agreement

Question 10

Following a credential compromise incident, the incident response team is conducting root cause analysis using the 5 Whys technique. The first 'why' reveals that the password was weak. The second 'why' reveals that the password policy allowed simple passwords. What should be the focus of the third 'why'?

Accepted Answer

Why the password policy allowed weak passwords. Root cause analysis should continue to identify why the password policy was not enforced or why it was inadequate, which is a process failure.

Answer

Why the intrusion was not detected earlier

Answer

Why the user had access to the compromised system

Answer

Why the user chose a weak password

Question 11

During a P1 (critical) incident, the incident response manager is coordinating response activities. Who is primarily responsible for activating the crisis management team (CMT)?

Accepted Answer

The incident response manager. The crisis management team is typically activated by the incident response manager or a designated authority when an incident has major business impact. The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications lead.

Answer

The communications lead

Answer

The legal counsel

Answer

The CEO of the organization

Question 12

Which of the following is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Accepted Answer

To update the incident response plan and playbooks based on findings.. Lessons learned meetings are designed to identify strengths and weaknesses in the incident response process and to implement improvements.

Answer

To assign blame for the incident.

Answer

To determine the financial impact of the incident.

Answer

To document the incident for regulatory reporting.

Question 13

An organization's incident response team is handling a P2 incident involving an insider threat. The team has identified the employee responsible. The communications lead is preparing a notification to affected parties. Which of the following should be included in the notification?

Accepted Answer

The type of data that was compromised and steps taken to mitigate. Regulatory notifications must include a description of the incident, data involved, and mitigation steps, while avoiding speculation.

Answer

A detailed timeline of the investigation

Answer

An apology from the CEO

Answer

The name of the employee responsible

Question 14

After a data breach involving customer PII, the incident response team is conducting a root cause analysis. Which THREE factors should be examined according to CISM best practices? (Select THREE.)

Accepted Answer

The management or governance failure that allowed the process failure.. Root cause analysis should identify technical, process, and management failures.

Answer

The cost of the breach to the organization.

Answer

The specific employee who clicked the phishing email.

Question 15

During a DDoS attack classified as P2, what is the EXPECTED response time and notification level?

Accepted Answer

Business hours response; management notification. P2 incidents require management notification and a response during business hours.

Answer

Standard response; team lead notification

Answer

24/7 response; executive notification

Answer

Scheduled remediation; email notification