CISM Incident Management — 10 Questions

Question 1

Which TWO of the following are required components of an incident response programme according to best practices? (Select two.)

Accepted Answer

Incident response policy. The incident response policy is the foundational document that establishes management's commitment, defines roles and responsibilities, and sets the scope and authority for the incident response programme. Without a formal policy, the programme lacks organizational mandate and cannot enforce compliance with incident handling procedures.

Answer

IR team roster

Answer

Communication templates

Answer

Vendor contacts list

Question 2

A company discovers a credential compromise affecting multiple user accounts. According to best practices, what is the first step the incident response team should take?

Accepted Answer

Disable compromised accounts and reset passwords. When a credential compromise is discovered, the immediate priority is containment to prevent further unauthorized access. Disabling compromised accounts and resetting passwords (Option B) stops the attacker from using the stolen credentials, aligning with the NIST SP 800-61 incident response lifecycle's containment phase. This action directly mitigates the active threat before any forensic analysis or notification occurs.

Answer

Conduct a root cause analysis

Answer

Contact law enforcement

Answer

Notify affected users immediately

Question 3

Which component of the incident response programme provides step-by-step technical instructions for handling a specific type of security incident?

Accepted Answer

Incident response playbook. C is correct because an incident response playbook provides detailed, step-by-step technical instructions for handling a specific type of security incident (e.g., ransomware, DDoS, phishing). Unlike the higher-level incident response plan, a playbook contains precise technical actions, such as commands to isolate a host, indicators of compromise (IOCs) to block, and escalation criteria tailored to a particular threat.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication templates

Question 4

During a forensic investigation, the external forensics firm discovers evidence that may indicate criminal activity. The incident manager wants to ensure attorney-client privilege is maintained. What should be done?

Accepted Answer

Involve legal counsel to manage privilege. Involving legal counsel is essential to establish and preserve attorney-client privilege over the forensic investigation. Legal counsel can direct the scope of the investigation, issue a 'Kovel letter' to engage the external forensics firm as an agent of the attorney, and ensure that all communications and findings are protected under the work-product doctrine. Without this step, any evidence of criminal activity could be deemed discoverable and waive privilege, potentially compromising the organization's legal defense.

Answer

Share evidence directly with law enforcement

Answer

Ignore privilege to speed up investigation

Answer

Publicly disclose the evidence

Question 5

An organization's incident response (IR) policy should be approved by which of the following to ensure authority and accountability?

Accepted Answer

The board of directors or executive management. The IR policy requires senior management approval to demonstrate organizational commitment and allocate necessary resources.

Answer

The incident response manager

Answer

The legal counsel

Answer

The IT director

Question 6

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

Accepted Answer

To preserve attorney-client privilege and avoid creating damaging records. Legal counsel involvement helps protect communications under attorney-client privilege and avoids speculation that could create liability.

Answer

To approve technical containment actions

Answer

To coordinate with external forensics firms

Answer

To ensure compliance with regulatory notification deadlines

Question 7

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is unable to restore operations within the maximum tolerable downtime (MTD). Which action should be taken next?

Accepted Answer

Escalate to activate the business continuity/disaster recovery plan. When an incident cannot be resolved within MTD, it escalates to business continuity/disaster recovery activation to restore operations.

Answer

Notify law enforcement

Answer

Increase the ransom payment

Answer

Engage the forensics firm to preserve evidence

Question 8

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have major business impact and require immediate executive notification and round-the-clock response.

Answer

P2 — High

Answer

P3 — Medium

Answer

P4 — Low

Question 9

Following a data breach, an organization conducts a root cause analysis using the 5 Whys technique. The analysis identifies that a misconfigured firewall allowed unauthorized access. What is the most important next step to prevent recurrence?

Accepted Answer

Implement a change management process to prevent unauthorized configuration changes. Root cause analysis should uncover not just technical causes but also the process and governance failures that allowed the misconfiguration. Addressing the management failure (e.g., inadequate change management) provides a systemic fix.

Answer

Update the firewall rule base immediately

Answer

Conduct a vulnerability scan on all firewalls

Answer

Disconnect the firewall from the network

Question 10

An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?

Accepted Answer

Credential compromise playbook. Credential compromise incidents, such as account takeover via phishing, are handled by the credential compromise playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook