CISM Incident Management — 100 Questions

Question 1

Which TWO of the following are required components of an incident response programme according to best practices? (Select two.)

Accepted Answer

Incident response policy. The incident response policy is the foundational document that establishes management's commitment, defines roles and responsibilities, and sets the scope and authority for the incident response programme. Without a formal policy, the programme lacks organizational mandate and cannot enforce compliance with incident handling procedures.

Answer

IR team roster

Answer

Communication templates

Answer

Vendor contacts list

Question 2

A company discovers a credential compromise affecting multiple user accounts. According to best practices, what is the first step the incident response team should take?

Accepted Answer

Disable compromised accounts and reset passwords. When a credential compromise is discovered, the immediate priority is containment to prevent further unauthorized access. Disabling compromised accounts and resetting passwords (Option B) stops the attacker from using the stolen credentials, aligning with the NIST SP 800-61 incident response lifecycle's containment phase. This action directly mitigates the active threat before any forensic analysis or notification occurs.

Answer

Conduct a root cause analysis

Answer

Contact law enforcement

Answer

Notify affected users immediately

Question 3

Which component of the incident response programme provides step-by-step technical instructions for handling a specific type of security incident?

Accepted Answer

Incident response playbook. C is correct because an incident response playbook provides detailed, step-by-step technical instructions for handling a specific type of security incident (e.g., ransomware, DDoS, phishing). Unlike the higher-level incident response plan, a playbook contains precise technical actions, such as commands to isolate a host, indicators of compromise (IOCs) to block, and escalation criteria tailored to a particular threat.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication templates

Question 4

During a forensic investigation, the external forensics firm discovers evidence that may indicate criminal activity. The incident manager wants to ensure attorney-client privilege is maintained. What should be done?

Accepted Answer

Involve legal counsel to manage privilege. Involving legal counsel is essential to establish and preserve attorney-client privilege over the forensic investigation. Legal counsel can direct the scope of the investigation, issue a 'Kovel letter' to engage the external forensics firm as an agent of the attorney, and ensure that all communications and findings are protected under the work-product doctrine. Without this step, any evidence of criminal activity could be deemed discoverable and waive privilege, potentially compromising the organization's legal defense.

Answer

Share evidence directly with law enforcement

Answer

Ignore privilege to speed up investigation

Answer

Publicly disclose the evidence

Question 5

An organization's incident response (IR) policy should be approved by which of the following to ensure authority and accountability?

Accepted Answer

The board of directors or executive management. The IR policy requires senior management approval to demonstrate organizational commitment and allocate necessary resources.

Answer

The incident response manager

Answer

The legal counsel

Answer

The IT director

Question 6

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

Accepted Answer

To preserve attorney-client privilege and avoid creating damaging records. Legal counsel involvement helps protect communications under attorney-client privilege and avoids speculation that could create liability.

Answer

To approve technical containment actions

Answer

To coordinate with external forensics firms

Answer

To ensure compliance with regulatory notification deadlines

Question 7

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is unable to restore operations within the maximum tolerable downtime (MTD). Which action should be taken next?

Accepted Answer

Escalate to activate the business continuity/disaster recovery plan. When an incident cannot be resolved within MTD, it escalates to business continuity/disaster recovery activation to restore operations.

Answer

Notify law enforcement

Answer

Increase the ransom payment

Answer

Engage the forensics firm to preserve evidence

Question 8

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have major business impact and require immediate executive notification and round-the-clock response.

Answer

P2 — High

Answer

P3 — Medium

Answer

P4 — Low

Question 9

Following a data breach, an organization conducts a root cause analysis using the 5 Whys technique. The analysis identifies that a misconfigured firewall allowed unauthorized access. What is the most important next step to prevent recurrence?

Accepted Answer

Implement a change management process to prevent unauthorized configuration changes. Root cause analysis should uncover not just technical causes but also the process and governance failures that allowed the misconfiguration. Addressing the management failure (e.g., inadequate change management) provides a systemic fix.

Answer

Update the firewall rule base immediately

Answer

Conduct a vulnerability scan on all firewalls

Answer

Disconnect the firewall from the network

Question 10

An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?

Accepted Answer

Credential compromise playbook. Credential compromise incidents, such as account takeover via phishing, are handled by the credential compromise playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 11

Which of the following is typically a member of the crisis management team (CMT) during a major cybersecurity incident?

Accepted Answer

Chief executive officer (CEO). The CMT includes senior leaders such as the CEO, CFO, CISO, General Counsel, and Communications head to handle strategic decisions and external communications.

Answer

Security operations center (SOC) analyst

Answer

Help desk manager

Answer

External forensics investigator

Question 12

As part of post-incident activities, an organization schedules a lessons learned meeting. When should this meeting ideally take place?

Accepted Answer

Within 2 weeks of incident resolution. Lessons learned meetings should occur within two weeks of incident resolution while details are fresh, to capture accurate feedback and improve the IR plan.

Answer

At the next quarterly board meeting

Answer

Immediately after the incident is detected

Answer

Only after all legal proceedings are concluded

Question 13

During a data breach investigation, legal counsel instructs the forensics team to preserve evidence under attorney-client privilege. Which of the following actions is most critical to maintain that privilege?

Accepted Answer

Limit distribution of forensic reports to individuals with a need-to-know and under legal direction. To preserve attorney-client privilege, communications and work product must be kept confidential and not shared with third parties unless protected by common interest or waiver.

Answer

Use a separate, isolated network for forensic analysis

Answer

Encrypt all forensic images with a strong algorithm

Answer

Destroy all preliminary notes after the final report is issued

Question 14

An organization is updating its incident response playbook after a ransomware attack. Which of the following should be included as a key step in the ransomware playbook?

Accepted Answer

Isolate affected systems from the network. Ransomware playbooks should include isolating infected systems to prevent spread, as containment is a priority.

Answer

Reboot all servers to clear the ransomware

Answer

Immediately pay the ransom demand

Answer

Notify all customers immediately

Question 15

Which of the following is the primary purpose of having a pre-established forensic retainer agreement?

Accepted Answer

To reduce the time required to engage external forensics during an incident. A pre-established retainer reduces the time to engage a forensics firm during an incident, ensuring rapid response.

Answer

To ensure the forensics firm is certified

Answer

To guarantee the lowest price for forensic services

Answer

To comply with regulatory requirements

Question 16

After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?

Accepted Answer

Supply chain. Supply chain incidents involve attacks through third-party vendors or partners, even if the initial vector is credential compromise.

Answer

Insider threat

Answer

Account compromise

Answer

DDoS

Question 17

Which TWO of the following are essential components of an incident response programme?

Accepted Answer

Incident response plan. An IR programme must include a formal policy and a documented plan. Playbooks are also important but the core components are policy and plan.

Answer

Annual penetration test

Answer

Vulnerability scanning schedule

Answer

Security awareness training

Question 18

Which THREE of the following should be included in an incident communication template?

Accepted Answer

Affected systems or data. Communication templates should include the incident description, affected parties, and guidance on actions to take. Technical details and attacker attribution are not typically included in templates.

Answer

Technical indicators of compromise (IoCs)

Answer

Attribution of the attacker

Question 19

Which TWO of the following are appropriate actions for preserving evidence during a cybersecurity incident?

Accepted Answer

Create forensic bit-for-bit images of affected systems. Preserving evidence includes creating forensic images and issuing legal holds to prevent spoliation. Disconnecting systems without imaging and rebooting can destroy evidence.

Answer

Reboot systems to capture volatile memory

Answer

Disconnect affected systems from the network immediately

Answer

Delete temporary files to free up space

Question 20

During a major security incident classified as P1, which of the following is the MOST appropriate communication frequency to the executive team?

Accepted Answer

Hourly situation reports (sitreps). For P1 (critical) incidents, hourly situation reports (sitreps) are expected to keep executives informed of rapidly evolving events.

Answer

Daily summary reports

Answer

Only upon significant changes

Answer

At the end of the incident