CISM Practice Test 7 — 10 Questions

Question 1

Which TWO of the following are indicators of a potential security incident?

Accepted Answer

Multiple unexpected system reboots.. Option B is correct because multiple unexpected system reboots can indicate malicious activity such as a rootkit, bootkit, or attacker-triggered crash/restart to cover tracks or disrupt availability, and repeated reboots are a classic anomaly in incident detection. Option E is correct because unusual outbound network traffic from a server often signals command-and-control (C2) communication, data exfiltration, or malware beaconing, making it a strong indicator of compromise. Option A is not correct because low disk space is typically a capacity/performance issue, not a security incident indicator. Option C is not correct because a vendor releasing a new software version is a normal patch/update event, not an incident. Option D is not correct because a successful login by an authorized user is expected behavior and only becomes suspicious with additional context such as impossible travel or unusual time.

Answer

Low disk space on a file server.

Answer

A new version of a critical software released.

Answer

A successful login by an authorized user.

Question 2

During an incident, the incident response team needs to preserve evidence for legal proceedings. Which of the following is the MOST important action to take?

Accepted Answer

Create a forensic image of affected systems using write-blockers.. Creating a forensic image of affected systems using write-blockers is the most important action because it preserves the original data in a bit-for-bit, unaltered state, ensuring the evidence is admissible in legal proceedings. Write-blockers prevent any write operations to the source drive, maintaining the integrity of the evidence chain of custody. Without a forensically sound image, any subsequent analysis could be challenged as tampered or unreliable.

Answer

Document the incident in a free-form text.

Answer

Take screenshots of system logs.

Answer

Notify law enforcement immediately.

Question 3

Which THREE of the following are key components of an incident response plan? (Select THREE)

Accepted Answer

Communication and escalation matrix. Option C, the communication and escalation matrix, is a core component because it defines who must be notified, in what order, and through which channels (e.g., phone, email, secure messaging) during an incident, ensuring timely escalation to management, legal, and other stakeholders. Option D, incident response procedures, is essential because it provides the documented, repeatable steps for detecting, containing, eradicating, recovering from, and reviewing incidents, typically aligned with frameworks such as NIST SP 800-61. Option E, roles and responsibilities of team members, is required to establish clear ownership and accountability across the incident response team, such as incident commander, communications lead, and forensic analysts, preventing gaps or duplicated effort during an incident. Option A does not belong because a full list of all employees' contact information is not a key component of an incident response plan; only relevant escalation contacts and on-call personnel are needed. Option B does not belong because an annual budget for incident response tools is a financial or management consideration, not a structural component of the incident response plan itself.

Answer

List of all employees' contact information

Answer

Annual budget for incident response tools

Question 4

Refer to the exhibit. An organization uses these firewall rules. After a breach, the IR team finds that the attacker gained access via SSH from an external IP. Which rule is most likely misconfigured?

Accepted Answer

SSH is allowed from any source instead of only internal. The firewall rule allowing SSH from any source (0.0.0.0/0) is misconfigured because it permits external attackers to attempt brute-force or credential-based access via TCP port 22. The principle of least privilege dictates that SSH should be restricted to specific internal IP ranges or management jump hosts, not exposed to the internet. The IR team's finding that the attacker gained access via SSH from an external IP directly confirms this rule as the root cause.

Answer

MySQL should be blocked entirely

Answer

RDP should not be allowed

Answer

HTTPS should be inspected

Question 5

During a data breach investigation, an organization engages an external forensics firm. To preserve attorney-client privilege, which of the following is the BEST practice?

Accepted Answer

Engage the forensics firm under the direction of legal counsel.. Engaging the forensics firm under the direction of legal counsel is the best practice because it extends attorney-client privilege to the investigation. When counsel directs the work, communications and findings are protected as work product, preventing disclosure in litigation. This is a foundational principle in incident response legal strategy.

Answer

Have the forensics firm work independently to maintain objectivity.

Answer

Ensure the forensics firm signs a non-disclosure agreement only.

Answer

Have the forensics firm report directly to the CISO.

Question 6

During a P1 incident, the crisis management team (CMT) is activated and meets within the first hour. Which communication practice is most appropriate for the CMT to follow when providing updates to the board of directors?

Accepted Answer

Send a brief status report every hour, avoiding speculation and including legal counsel review. During a P1 incident, the CMT must provide timely, concise updates to the board to maintain trust and enable strategic decisions. Option A is correct because it balances frequency (hourly) with content discipline (avoiding speculation) and includes legal counsel review, which is critical for compliance and liability management. This aligns with the CISM Incident Management domain's emphasis on clear, non-technical communication to senior leadership.

Answer

Provide detailed technical updates every hour

Answer

Provide speculative root cause analysis to demonstrate competence

Answer

Wait until the incident is fully understood before any communication

Question 7

Which of the following is the PRIMARY reason for having a pre-established forensic retainer agreement before an incident occurs?

Accepted Answer

To reduce the time needed to bring forensic experts on board during an incident.. The primary reason for a pre-established forensic retainer agreement is to reduce the time needed to bring forensic experts on board during an incident. In incident management, every minute of delay can allow an attacker to exfiltrate data or destroy evidence; a retainer bypasses the procurement and contracting process, enabling immediate deployment of the forensic team to preserve volatile memory and capture network artifacts.

Answer

To ensure the forensic firm is familiar with the organization's environment.

Answer

To lock in a favorable pricing structure.

Answer

To ensure the forensic firm has the necessary certifications.

Question 8

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 9

During a data breach investigation, the incident response team discovers that a backup was encrypted by ransomware. The team needs to determine the sequence of events leading to the encryption. Which of the following documentation is MOST critical to preserve for potential litigation?

Accepted Answer

The chain of custody for the backup media. Chain of custody documentation is essential to prove the integrity and admissibility of digital evidence in court.

Answer

The communication logs between team members

Answer

The forensic tools used in the investigation

Answer

The incident response plan version used during the incident

Question 10

During a major incident, the incident response team discovers that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Accepted Answer

Escalate to activate the business continuity and disaster recovery plans. When an incident cannot be resolved within the MTD, it triggers the transition to business continuity and disaster recovery (BC/DR) plans to maintain critical operations.

Answer

Continue incident response efforts until resolution regardless of time

Answer

Declare the incident a disaster and shut down all systems

Answer

Notify the insurance provider immediately