CISM Practice Test 27 — 15 Questions

Question 1

During a DDoS attack, the incident response team is struggling to mitigate the attack. The team decides to engage the organization's ISP and a DDoS mitigation service. Which of the following should be done FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Refer to the incident response playbook for DDoS attacks. The IR plan should include pre-established contacts and procedures; contacting the ISP and mitigation service should follow the plan's escalation process.

Answer

Activate the crisis management team

Answer

Notify law enforcement

Answer

Initiate legal hold on all relevant logs

Question 2

Which TWO of the following are appropriate actions for preserving evidence during a cybersecurity incident?

Accepted Answer

Create forensic bit-for-bit images of affected systems. Preserving evidence includes creating forensic images and issuing legal holds to prevent spoliation. Disconnecting systems without imaging and rebooting can destroy evidence.

Answer

Reboot systems to capture volatile memory

Answer

Disconnect affected systems from the network immediately

Answer

Delete temporary files to free up space

Question 3

Which THREE of the following are objectives of a lessons learned meeting after an incident? (Select three.)

Accepted Answer

Determine what worked well and what did not. Lessons learned meetings aim to identify what happened, what worked well, and what didn't, and to develop recommendations for improvement. Sharing IoCs with ISACs is a separate activity, not a meeting objective.

Answer

Assign blame for the incident

Answer

Share indicators of compromise with an ISAC

Question 4

An organization is conducting a root cause analysis after a data breach. Which of the following sequences BEST aligns with the 5 Whys approach from a CISM perspective?

Accepted Answer

Technical cause → Process failure → Management failure. The 5 Whys should drill down from technical cause to process failure to management/governance failure, as per the domain content.

Answer

Management failure → Process failure → Technical cause

Answer

Process failure → Technical cause → Management failure

Answer

Technical cause → Management failure → Process failure

Question 5

Which TWO of the following are essential components of an incident response programme?

Accepted Answer

Incident response plan. An IR programme must include a formal policy and a documented plan. Playbooks are also important but the core components are policy and plan.

Answer

Annual penetration test

Answer

Vulnerability scanning schedule

Answer

Security awareness training

Question 6

During a major incident, the incident response team discovers that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Accepted Answer

Escalate to activate the business continuity and disaster recovery plans. When an incident cannot be resolved within the MTD, it triggers the transition to business continuity and disaster recovery (BC/DR) plans to maintain critical operations.

Answer

Continue incident response efforts until resolution regardless of time

Answer

Declare the incident a disaster and shut down all systems

Answer

Notify the insurance provider immediately

Question 7

After a major incident, the lessons learned meeting is scheduled. According to best practices, when should this meeting typically be held after incident resolution?

Accepted Answer

Within two weeks. Best practices recommend holding the lessons learned meeting within two weeks of incident resolution to capture details while they are fresh.

Answer

Within one month

Answer

Within 24 hours

Answer

Within one week

Question 8

Which of the following is the PRIMARY reason to include legal counsel in the incident response team?

Accepted Answer

To advise on legal obligations and protect privilege. Legal counsel ensures that actions taken during an incident preserve attorney-client privilege and comply with legal obligations, such as breach notification and litigation holds.

Answer

To communicate with the media

Answer

To authorize technical containment actions

Answer

To manage technical aspects of the investigation

Question 9

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the relevant supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

48 hours

Answer

24 hours

Answer

96 hours

Question 10

During a P1 incident involving a ransomware attack, the incident response manager needs to communicate with executives. Which of the following is the most appropriate approach for executive communication?

Accepted Answer

Send hourly situation reports (sitreps) focusing on business impact and key actions. For critical incidents, hourly sitreps (situation reports) are recommended to keep executives informed. Avoiding speculation and preserving legal privilege with counsel involvement are also key.

Answer

Include speculative root causes to show thoroughness

Answer

Wait until the incident is fully resolved before communicating

Answer

Provide detailed technical analysis in every update

Question 11

Which TWO of the following are essential components of an incident response (IR) plan? (Select TWO)

Accepted Answer

Communication templates. The IR plan includes the IR team roster and contact list, and communication templates. Procedures for specific incident types are typically in separate playbooks.

Answer

Vendor risk assessment reports

Answer

Detailed network architecture diagrams

Answer

Playbook for ransomware incidents

Question 12

During a post-incident root cause analysis, the team uses the '5 Whys' technique and identifies a technical vulnerability as the cause. According to CISM best practices, what should be the NEXT level of analysis?

Accepted Answer

Determine the process failure that allowed the vulnerability to go unaddressed.. The '5 Whys' should drill deeper to uncover process and management failures that allowed the technical vulnerability to exist.

Answer

Immediately patch the vulnerability and move on.

Answer

Escalate the issue to the vendor for a software fix.

Answer

Identify the specific employee responsible for the vulnerability.

Question 13

Which of the following is the BEST approach for sharing threat intelligence indicators of compromise (IoCs) after an incident?

Accepted Answer

Share IoCs with industry peers via the relevant ISAC.. Sharing IoCs with an ISAC (Information Sharing and Analysis Center) helps the broader community defend against similar attacks, which is a key post-incident activity.

Answer

Report IoCs to law enforcement only.

Answer

Keep IoCs confidential to protect the organization's reputation.

Answer

Publish IoCs on the organization's public website.

Question 14

Which of the following is typically a member of the crisis management team (CMT) during a major cybersecurity incident?

Accepted Answer

Chief executive officer (CEO). The CMT includes senior leaders such as the CEO, CFO, CISO, General Counsel, and Communications head to handle strategic decisions and external communications.

Answer

Security operations center (SOC) analyst

Answer

Help desk manager

Answer

External forensics investigator

Question 15

Which THREE of the following are typical roles in an incident response team? (Select THREE)

Accepted Answer

IR manager. The IR team typically includes an IR manager, security analysts, forensic investigators, communications lead, legal counsel, and executive sponsor.

Answer

Human resources representative

Answer

Internal audit representative