CISM Practice Exam 52 — 20 Questions

Question 1

An organization is building its incident response capability and wants to ensure it can effectively detect and respond to incidents. Which TWO of the following are the MOST important foundational elements to establish before an incident occurs? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defined incident classification and severity criteria to prioritize response efforts.. The foundational elements for incident response include a documented plan with roles and communication procedures, and defined classification and severity criteria. These enable consistent, prioritized, and coordinated response. Personal social media monitoring, software license inventories, and encryption bans do not provide the structure or detection capability needed before an incident occurs.

Answer

A complete inventory of every software license purchased by the organization.

Answer

A policy prohibiting any use of encryption within the organization.

Answer

A list of all employees' personal social media accounts for monitoring.

Question 2

During a major incident, the incident response team has contained the threat but recovery is taking longer than expected. The business continuity manager reports that the manual workaround in place will fail within four hours due to capacity limits. Which action should the incident manager take FIRST?

Accepted Answer

Escalate the recovery timeline risk to the crisis management team (CMT) so it can decide on activating the business continuity plan.. Containment success does not end the incident if recovery cannot be completed within the tolerance of interim workarounds. The imminent failure of the manual workaround is a business continuity trigger that exceeds the incident response team's authority. Escalating to the CMT enables executives to authorize continuity plan activation, alternate processing, and stakeholder communications before the workaround collapses.

Answer

Instruct the business continuity manager to extend the manual workaround beyond its documented capacity limits.

Answer

Direct the recovery team to work overtime and compress testing steps to accelerate system restoration.

Answer

Suspend incident communications until the recovery team confirms a new restoration estimate.

Question 3

A financial services firm has just contained a malware outbreak that disabled online banking for six hours. The incident commander confirms systems are restored and monitoring is stable. Executive leadership now wants to know what must happen before the incident can be formally closed. Which activity is MOST important to complete prior to closure?

Accepted Answer

Conduct a lessons-learned review to identify improvements to the incident response plan and controls. Formal incident closure requires more than restored service; it requires capturing what happened and improving from it. The lessons-learned review examines detection, response, and control effectiveness, producing corrective actions that reduce recurrence likelihood and severity. Tool purchases, additional notifications, and blanket reimaging are either premature, situationally dependent, or duplicative of completed recovery work. By institutionalizing findings before closure, the organization ensures the incident yields lasting security value rather than a return to the status quo.

Answer

Notify the regulator a second time to confirm that online banking services have been fully restored

Answer

Purchase additional endpoint detection licenses to cover the remaining unmanaged devices

Answer

Rotate all administrative credentials and reimage every server in the affected data center

Question 4

During a major data breach, the incident response manager needs to determine whether the organization must notify regulators and affected individuals. Which factor is MOST important in making this determination?

Accepted Answer

The type of data compromised and applicable legal and regulatory requirements.. Notification decisions are legal and compliance determinations based on what data was exposed and which laws, regulations, or contracts apply. The incident response manager should engage legal counsel and privacy officers early to map the compromised data types to specific reporting obligations and deadlines. Operational metrics such as system count, dwell time, and response cost inform the investigation but do not by themselves establish a duty to notify.

Answer

The estimated cost of the incident response effort.

Answer

The number of systems affected by the malware.

Answer

The length of time the attacker had access to the environment.

Question 5

An organization's incident response plan delegates authority to the incident commander to make containment decisions during a severe incident. During an active intrusion affecting multiple business units, the incident commander wants to take a system offline that supports a revenue-generating service. Which factor should PRIMARILY guide this containment decision?

Accepted Answer

The potential business impact of the containment action weighed against the risk of continued attacker activity. Containment decisions require weighing the harm of the action against the harm of inaction. Taking a revenue service offline protects the enterprise from further compromise but disrupts business, while leaving it online preserves revenue but risks escalation. The incident commander uses business impact analysis, threat severity, and organizational risk tolerance to strike the right balance. Restoration difficulty, insurance coverage, and stakeholder preference are secondary inputs, not the primary basis for the decision.

Answer

The preference of the business unit leader who owns the revenue-generating service

Answer

Whether the affected system is covered by the organization's cyber insurance policy

Answer

The technical difficulty of restoring the service after it has been taken offline

Question 6

An organization has experienced a data breach involving customer personally identifiable information (PII). The incident response team has completed containment and eradication. Legal counsel advises that the breach may trigger notification requirements under multiple jurisdictions. Which of the following should the security manager do NEXT to ensure compliance?

Accepted Answer

Conduct a thorough impact assessment to determine the scope and nature of the data involved.. After containment and eradication, the next critical step in a data breach involving PII is to assess the scope and impact. This assessment identifies which data elements were exposed, how many individuals are affected, and which jurisdictions' laws apply. It provides the factual basis for legal notification decisions and ensures that notifications are accurate, timely, and compliant with varying regulatory requirements.

Answer

Delete all compromised data to prevent further exposure.

Answer

Publicly announce the breach on the company website to demonstrate transparency.

Answer

Immediately send a blanket notification to all customers regardless of jurisdiction.

Question 7

A security manager is drafting the incident response plan and must specify how the organization will communicate with regulators, law enforcement, and the media during a high-severity breach. The chief information security officer (CISO) wants to ensure that all external communications are coordinated, legally defensible, and consistent. Which of the following should the CISO require FIRST to meet this objective?

Accepted Answer

Designate a single, pre-authorized spokesperson and require all external communications to flow through a defined approval chain.. Coordinated external communication during a high-severity breach requires a single pre-authorized spokesperson and a defined approval chain. This ensures messages to regulators, law enforcement, and media are consistent, legally reviewed, and technically accurate. Empowering everyone to speak or relying solely on one department creates confusion, legal exposure, and inconsistent messaging that can worsen the incident's impact.

Answer

Require all external communications to be handled exclusively by the legal department without input from security or communications staff.

Answer

Publish the full incident response plan on the corporate intranet so all employees understand the communication process.

Answer

Grant every member of the incident response team authority to speak with external parties to speed up information sharing.

Question 8

An organization has just experienced a data breach involving customer personal information. The incident manager is determining the appropriate communication strategy. Which action BEST aligns with CISM incident management practices?

Accepted Answer

Coordinate with legal counsel and communications to notify affected parties and regulators as required.. Breach communication should be coordinated with legal counsel and communications to ensure regulatory notifications and customer messaging are timely, accurate, and compliant. Premature public disclosure, indefinite delay, and selective notification all fail to meet CISM expectations for structured, legally sound, and ethical incident communication.

Answer

Notify only the customers who are likely to complain, to minimize business disruption.

Answer

Publicly disclose all technical details of the breach immediately to demonstrate transparency.

Answer

Delay all notifications until the forensic investigation is completely finished, regardless of regulatory deadlines.

Question 9

A security manager is drafting the incident response plan and needs to define how the organization will classify and escalate incidents. Executive leadership wants assurance that high-impact incidents reach the right decision-makers quickly. Which of the following should the security manager do FIRST to establish effective incident classification and escalation?

Accepted Answer

Define severity levels based on business impact criteria and map each level to a defined escalation path and notification timeframe.. Effective incident classification starts with business impact criteria, because severity must reflect consequences to the organization rather than technical indicators alone. Once severity levels are defined, each must be tied to a specific escalation path and notification timeframe so that executives are engaged promptly for high-impact events. This governance-first approach creates a consistent, repeatable basis for triage and escalation before any tooling or operational detail is layered on top.

Answer

Purchase a security information and event management (SIEM) platform with automated alert correlation and threat intelligence feeds.

Answer

Ask each business unit to independently define its own incident severity scale and reporting thresholds.

Answer

Instruct the incident response team to notify the board of directors for every confirmed security event regardless of impact.

Question 10

A security operations centre (SOC) analyst receives an alert that a production database server is transmitting large volumes of customer data to an external IP address. The analyst confirms the traffic is malicious. According to CISM best practices, which of the following should the analyst do FIRST?

Accepted Answer

Isolate the database server from the network to contain the data exfiltration.. Once an analyst validates that malicious exfiltration is occurring, the immediate priority is to stop the loss of business data. Containment, such as isolating the affected server, halts the ongoing damage while preserving the environment for investigation. Notification, deep forensic imaging, and broad log review are all necessary activities, but they follow or accompany containment rather than preceding it, because every minute of delay increases data loss and regulatory exposure.

Answer

Review firewall and proxy logs to determine the full scope of the exfiltration.

Answer

Notify the chief information security officer (CISO) and legal counsel of the suspected breach.

Answer

Capture a full memory image of the database server before taking any other action.

Question 11

An information security manager is drafting the incident escalation criteria for the organization's incident response plan. Executive leadership has asked how the team will decide when an incident must be escalated to the crisis management team rather than handled by the technical response team alone. Which of the following is the MOST appropriate basis for defining these escalation thresholds?

Accepted Answer

The potential or actual business impact of the incident on critical services and objectives. Escalation criteria should reflect the consequence to the business, because the crisis management team's purpose is to make strategic decisions and commit resources when critical services, regulatory obligations, or stakeholder trust are at risk. Technical metrics such as system counts, response timing, and attribution describe the incident's mechanics or handling rather than its business significance, so they cannot reliably determine when executive engagement is warranted.

Answer

The number of systems or user accounts confirmed to be affected by the incident

Answer

The classification of the threat actor, such as nation-state, organized crime, or insider

Answer

The elapsed time between initial detection and the first containment action taken by the response team

Question 12

During a suspected intrusion, the incident response team identifies a compromised server that is actively communicating with an external command-and-control address. The security manager must decide the immediate next action while preserving the ability to perform a thorough investigation. Which of the following actions BEST balances containment with evidence preservation?

Accepted Answer

Isolate the server from the network at the switch or host firewall level while keeping it powered on for volatile data collection. The best balance is to contain the system without destroying volatile evidence. Network isolation stops malicious communication and lateral movement while leaving memory, running processes, and active connections intact for collection. Powering off, prolonged passive monitoring, or immediate rebuild each sacrifice either containment or investigative capability, so they fail to meet both requirements simultaneously.

Answer

Immediately power off the server to stop all malicious activity and prevent further data loss

Answer

Rebuild the server from a known-good image immediately to restore service and remove any attacker foothold

Answer

Leave the server online and continue monitoring the command-and-control traffic to gather more intelligence on the attacker

Question 13

A healthcare organization is developing its information security program. The CISO wants to ensure that the program includes appropriate governance components to meet regulatory requirements and manage risk effectively. Which TWO of the following are essential governance components for an information security program? (Choose two.)

Accepted Answer

A documented information security strategy and supporting policies.. The correct answers are a security steering committee with business unit leaders and a documented information security strategy and supporting policies. These elements provide direction, oversight, and alignment with business goals, which are core to governance. They ensure that security is managed strategically and that accountability is established. Operational capabilities like a SOC or pen testing are important but do not constitute governance.

Answer

An annual penetration test conducted by an external vendor.

Answer

A disaster recovery plan that is tested annually.

Answer

A real-time security operations center (SOC) with 24/7 monitoring.

Question 14

A retail company's security operations center receives an alert that a point-of-sale terminal is communicating with a known malicious command-and-control domain. The analyst confirms the connection is active. According to incident response best practices, which action should the analyst take FIRST?

Accepted Answer

Isolate the affected terminal from the network while preserving evidence for investigation. Once malicious command-and-control activity is confirmed, containment is the immediate priority because an active channel enables exfiltration and further intrusion. Isolating the terminal severs that channel without destroying the volatile and stored evidence investigators require. Powering off, scanning in place, or delaying action for documentation all leave the attacker connected or degrade evidence. The correct sequence is to contain first, then analyze and eradicate, keeping forensic integrity intact throughout.

Answer

Run a full antivirus scan on the terminal and wait for it to complete before taking further action

Answer

Document the alert details and escalate to management before taking any technical action

Answer

Immediately power off the terminal to terminate the malicious connection

Question 15

An organization has completed its response to a data breach and is conducting a post-incident review. Management wants assurance that lessons learned will actually improve future response capability. Which outcome BEST demonstrates that the post-incident review achieved this objective?

Accepted Answer

The incident response plan is updated with assigned corrective actions, owners, and due dates tracked to closure.. Post-incident reviews only improve capability when findings become tracked corrective actions with named owners and deadlines. This converts analysis into verified changes to plans, controls, and training, and provides management with evidence that gaps have been addressed. Distributing timelines, giving briefings, or archiving reports may support the process but do not by themselves change future response outcomes.

Answer

A detailed timeline of the incident is distributed to all employees as a training awareness bulletin.

Answer

The final incident report is archived in the document management system for future reference.

Answer

The incident response team receives a summary presentation highlighting the attacker's tactics and techniques.

Question 16

During a major incident, the incident response manager is coordinating containment while the crisis management team (CMT) handles business continuity decisions. A responder proposes immediately wiping and rebuilding an affected server to restore service quickly, but the server contains evidence relevant to a potential legal action. Which of the following is the MOST appropriate action for the incident response manager to take?

Accepted Answer

Consult legal counsel to determine preservation obligations, then choose a containment or recovery approach that preserves evidence while restoring service.. When legal action is anticipated, evidence preservation becomes a formal obligation that must be balanced against service restoration. The incident response manager should engage legal counsel to confirm preservation requirements, then select a containment or recovery method that keeps evidence intact, such as imaging the server or rebuilding on alternate infrastructure. This coordinated approach protects both operational continuity and the organization's legal position, avoiding the extremes of reckless destruction or unnecessary service outage.

Answer

Delegate the decision entirely to the forensic investigator and proceed based on their technical recommendation alone.

Answer

Refuse to restore service until the forensic investigation is fully complete, regardless of business impact.

Answer

Authorize the rebuild immediately because restoring service takes precedence over evidence preservation in all incidents.

Question 17

A retail company is developing its information security program and needs to establish a process for identifying and managing risks associated with its e-commerce platform. The CISO has been asked to recommend a risk management approach that aligns with the organization's goal of maintaining customer trust and complying with PCI DSS. Which of the following should be the FIRST step in the risk management process?

Accepted Answer

Conducting a risk assessment to identify and prioritize risks.. The correct answer is conducting a risk assessment to identify and prioritize risks. Risk management begins with understanding the risks to the organization's assets and objectives. This assessment informs all subsequent decisions, including which controls to implement, what risks to transfer, and how to plan for recovery. It ensures that efforts are targeted and effective.

Answer

Implementing security controls to mitigate identified risks.

Answer

Purchasing cyber insurance to transfer risk.

Answer

Developing a disaster recovery plan for the e-commerce platform.

Question 18

A global retailer's CISO has just completed a security strategy refresh. The board has approved the strategy but asks how they will know whether the programme is delivering the intended risk reduction between annual reviews. Which action should the CISO take FIRST to address the board's request?

Accepted Answer

Define a set of programme performance metrics with targets and reporting frequency that map to the strategy's risk-reduction objectives.. The board approved a strategy and now wants assurance that it is producing the intended risk reduction between annual reviews. That requires a defined measurement framework linking programme performance to the strategy's objectives, with baselines, targets and a reporting cadence. Technical testing, budget requests and raw incident counts do not provide that ongoing, objective view of strategy delivery.

Answer

Commission an external penetration test of the organisation's Internet-facing estate and report the findings to the board.

Answer

Request a budget increase for the next financial year so that additional controls can be deployed across the estate.

Answer

Schedule quarterly presentations to the board summarising the number of security incidents detected by the security operations centre.

Question 19

An organisation has just completed recovery from a significant cybersecurity incident. The CISO wants to ensure the lessons learned are captured and used to improve future response. Which of the following should be performed as part of the post-incident activity?

Accepted Answer

Conduct a post-incident review with key stakeholders to identify root cause and improvement actions.. Post-incident activity in CISM is about converting experience into improvement. A structured review with key stakeholders identifies root cause, evaluates the effectiveness of the response, and generates corrective actions that update plans, controls, and training. Closing the ticket, waiting for a fine, or issuing a press release do not build organisational capability. The review ensures the incident response programme evolves and that lessons are documented for future reference and audit.

Answer

Publish a press release describing the incident and the organisation's response.

Answer

Immediately close the incident ticket and return the team to normal duties.

Answer

Update the risk register only if the incident resulted in a regulatory fine.

Question 20

A multinational company experiences a ransomware attack that encrypts critical servers in its European and North American data centers. The incident response team has contained the spread, but restoration will take several days. Executive leadership asks the CISO what should be done to manage the business impact while recovery proceeds. Which of the following is the MOST appropriate immediate action?

Accepted Answer

Activate the business continuity and disaster recovery plans to maintain critical business functions.. When a ransomware attack causes a multi-day outage, the priority is to maintain critical business functions through business continuity and disaster recovery plans. Containment has already been achieved, so the focus shifts to minimizing business impact while restoring systems. Continuity activation supports customers, partners, and revenue streams, and it integrates with incident response to manage the overall event.

Answer

Shut down all remaining systems to prevent any further encryption, even those not yet affected.

Answer

Pay the ransom immediately to shorten the recovery time and reduce business disruption.

Answer

Wait until all servers are fully restored before informing customers or business partners.