CISM Practice Test 27 — 15 Questions

Question 1

An incident response team is dealing with a persistent threat that uses fileless malware. Which containment strategy is most effective?

Accepted Answer

Isolate affected endpoints from the network while preserving memory. Isolating affected endpoints preserves volatile memory evidence needed to analyze fileless malware.

Answer

Disable user accounts

Answer

Block known malicious IPs

Answer

Reimage all endpoints

Question 2

During the eradication phase of an incident response, which action is MOST critical to ensure the threat is fully removed?

Accepted Answer

Reimage all affected systems from known-good backups.. Option B is correct because reimaging from known-good backups ensures no remnants of malware remain. Option A is not eradication but prevention. Option C may miss hidden malware. Option D is a post-eradication step.

Answer

Delete the malware files from the system.

Answer

Reset passwords for all user accounts.

Answer

Update antivirus signatures.

Question 3

Which THREE of the following are key components of an incident response plan?

Accepted Answer

List of external contacts (law enforcement, legal, etc.).. Options A, B, and E are correct because the plan should include team members, external contacts, and communication templates. Detailed procedures are in playbooks, not the plan itself. Budget is separate.

Answer

Annual budget for cybersecurity tools.

Answer

Detailed step-by-step procedures for each incident type.

Question 4

During an incident, the incident response team is communicating with affected stakeholders. According to best practices, which of the following should be communicated FIRST?

Accepted Answer

A summary of actions taken so far. Initial communication should provide a high-level summary of the situation and immediate actions taken to inform stakeholders without overwhelming them with technical details. Option B is correct.

Answer

Detailed technical analysis

Answer

A timeline of all events

Answer

The root cause of the incident

Question 5

Refer to the exhibit.
Based on the exhibit, what is the security implication of this S3 bucket policy?

Accepted Answer

Allows any user from internal network to read objects, but any user can write objects from anywhere. The policy allows GetObject only from the internal IP range (10.0.0.0/8), but PutObject is allowed from any IP without restriction. This means anyone on the internet can write objects to the bucket. Option B is correct.

Answer

Denies all access except from 10.0.0.0/8

Answer

Allows only users from 10.0.0.0/8 to read and write

Answer

Allows any authenticated user to read and write objects

Question 6

An organization's IR plan is tested annually. After a test, many gaps are identified. What is the best next step?

Accepted Answer

Update the IR plan based on lessons learned and schedule a follow-up test. Updating the plan based on lessons learned and scheduling a follow-up test improves preparedness.

Answer

Train all employees on the plan

Answer

Wait for the next scheduled test in one year

Answer

Purchase additional security tools

Question 7

An organization experiences a DDoS attack that overwhelms their internet connection. Which containment strategy would be MOST effective?

Accepted Answer

Contact the ISP for traffic scrubbing or blackhole routing.. Option D is correct because ISP-level traffic scrubbing mitigates the attack while leaving legitimate traffic intact. Option A blocks all traffic. Option B is the best but we placed it as D. Option C disrupts connectivity. Option D is the right action.

Answer

Shut down all external connectivity.

Answer

Change firewall rules to block all traffic.

Answer

Add more bandwidth to absorb the attack.

Question 8

Which TWO are key indicators of a data breach? (Choose two.)

Accepted Answer

Unusual outbound network traffic. Unusual outbound traffic and unauthorized access to sensitive data are classic indicators of a data breach. Multiple failed logins may indicate brute force, spam relates to phishing, and performance degradation is too vague.

Answer

System performance degradation

Answer

Increased spam emails to the organization

Answer

Multiple failed login attempts from a single user

Question 9

An organization's incident response plan includes a call tree. During an incident, the primary contact is unreachable. What should happen?

Accepted Answer

Move to the next person in the call tree. The call tree should have alternates; proceeding to the next person ensures continuity.

Answer

Escalate to senior management

Answer

Use a different communication method like email

Answer

Wait for the primary to become available

Question 10

Refer to the exhibit. An organization uses these firewall rules. After a breach, the IR team finds that the attacker gained access via SSH from an external IP. Which rule is most likely misconfigured?

Accepted Answer

SSH is allowed from any source instead of only internal. The SSH rule allows access from any source, which is a security risk. It should be restricted to internal IPs.

Answer

MySQL should be blocked entirely

Answer

RDP should not be allowed

Answer

HTTPS should be inspected

Question 11

An incident responder is handling a phishing attack that resulted in credential theft. Which TWO actions should be taken FIRST in the containment phase?

Accepted Answer

Disable the user's account temporarily.. Options A and E are correct because resetting the password and disabling the account immediately cut off attacker access. Option B is a good step but not first priority. Option C is forensic, not containment. Option D is communication, which comes later.

Answer

Notify all users about the phishing campaign.

Answer

Conduct a forensic analysis of the user's machine.

Answer

Block the phishing URL at the proxy.

Question 12

Which THREE are essential steps in incident containment? (Choose three.)

Accepted Answer

Disable compromised accounts. Isolating affected systems, disabling compromised accounts, and preserving forensic evidence are critical containment steps. Root cause analysis is part of investigation, and notifying regulators is a post-containment step.

Answer

Root cause analysis

Answer

Notify external regulators

Question 13

After containing a security incident, the team conducts a root cause analysis. They find the breach originated from a compromised third-party vendor account. What is the most effective long-term mitigation?

Accepted Answer

Implement vendor access reviews and enforce MFA. Implementing vendor access reviews and enforcing MFA addresses the root cause of unauthorized access.

Answer

Increase logging on vendor accounts

Answer

Change all passwords manually

Answer

Terminate the vendor relationship

Question 14

A security analyst receives an alert from the SIEM indicating a high number of failed login attempts from a single external IP address targeting a public-facing web server. The analyst checks the logs and sees that the attempts are using common usernames. What is the MOST appropriate immediate response?

Accepted Answer

Block the IP address at the firewall.. Option A is correct because blocking the IP at the firewall is a quick containment measure to stop the attack. Option B is wrong because ignoring could lead to successful brute-force. Option C is premature as law enforcement is not needed at this stage. Option D is too drastic and would disrupt business.

Answer

Ignore the alert as it is likely a false positive.

Answer

Disable the web server.

Answer

Notify law enforcement.

Question 15

A security team detects lateral movement within the network using PowerShell scripts. Which TWO actions are MOST effective to contain the threat?

Accepted Answer

Disable PowerShell remoting on all systems.. Options B and D are correct because isolating affected systems stops lateral spread, and disabling PowerShell remoting removes the attack vector. Option A is not precise. Option C is eradication. Option E is forensic.

Answer

Conduct memory forensics on affected endpoints.

Answer

Implement network segmentation to isolate affected VLANs.

Answer

Apply the latest security patches to all systems.