CISM › Incident Management

Incident Management Practice Questions

CISM Domain 3 (Incident Management) covers preparing for, detecting, responding to, and recovering from security incidents while preserving evidence and coordinating business continuity. Questions test judgment on incident classification, escalation to crisis management, forensic evidence handling, root cause analysis, and post-incident review. Expect scenario-based items asking you to select the BEST or FIRST action, often distinguishing technical response from management and governance responsibilities.