CISM Incident Management Practice Test 10 — 15 Questions

Question 1

Which THREE of the following are essential elements of a forensic evidence handling procedure to ensure admissibility in court?

Accepted Answer

Placing a legal hold on relevant data. Option A is correct because a legal hold preserves potentially relevant data and prevents routine deletion or alteration, which is essential for demonstrating that evidence was not spoliated before collection. Option B is correct because a documented chain of custody records every transfer, access, and storage event for the evidence, allowing the court to verify its integrity and authenticity. Option E is correct because creating bit-for-bit forensic copies (forensic images) preserves the original media and allows analysis on a verified duplicate, typically validated with hash values such as MD5 or SHA-256. Option C is not correct because performing analysis directly on original systems can alter metadata, timestamps, and other artifacts, undermining admissibility. Option D is not correct because using automated tools without validation fails to establish that the tools produce reliable, repeatable results, which is necessary for forensic soundness.

Answer

Performing analysis directly on original systems

Answer

Using automated tools without validation

Question 2

Which component of the incident response programme provides step-by-step technical instructions for handling a specific type of security incident?

Accepted Answer

Incident response playbook. C is correct because an incident response playbook provides detailed, step-by-step technical instructions for handling a specific type of security incident (e.g., ransomware, DDoS, phishing). Unlike the higher-level incident response plan, a playbook contains precise technical actions, such as commands to isolate a host, indicators of compromise (IOCs) to block, and escalation criteria tailored to a particular threat.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication templates

Question 3

During a P1 (critical) incident involving a ransomware attack that has encrypted critical systems, the incident manager needs to provide updates to executives. What is the recommended frequency for situation reports (sitreps)?

Accepted Answer

Hourly. For P1 incidents, hourly sitreps keep executives informed of rapidly evolving situations.

Answer

Only at milestone events

Answer

Every 4 hours

Answer

Daily

Question 4

A security analyst discovers that an employee's credentials were used to access a sensitive database containing customer PII. The analyst immediately disables the account and begins remediation. Which incident category best describes this scenario?

Accepted Answer

Account compromise. The incident involves unauthorized use of legitimate credentials to access a sensitive database, which is the defining characteristic of an account compromise. The immediate disabling of the account and remediation aligns with standard incident response procedures for credential theft, where the attacker has gained authenticated access without authorization. This is distinct from a data breach, which focuses on the exfiltration or exposure of data, not the method of access.

Answer

Data breach

Answer

Physical security

Answer

Insider threat

Question 5

Following containment of a ransomware incident, the incident response team is conducting a root cause analysis. Which method involves repeatedly asking 'why' to drill down to underlying causes?

Accepted Answer

5 Whys. The 5 Whys technique involves repeatedly asking 'why' to drill down from a symptom to its root cause. It was developed by Sakichi Toyoda and is widely used in incident response and quality management. By asking 'why' five times, teams can uncover underlying process failures rather than stopping at superficial causes.

Answer

Pareto analysis

Answer

SWOT analysis

Answer

Fishbone diagram

Question 6

What is the primary purpose of having a pre-established forensic retainer agreement with an external forensics firm?

Accepted Answer

To reduce time to engage during an incident. The primary purpose of a pre-established forensic retainer agreement is to reduce the time to engage during an incident. By having a contract already in place, the organization can bypass procurement and legal review delays, enabling the forensics firm to begin work immediately when an incident occurs, which is critical for preserving volatile evidence and minimizing damage.

Answer

To ensure chain of custody

Answer

To reduce legal liability

Answer

To guarantee confidentiality

Question 7

During a major incident, the crisis management team (CMT) has been activated. Which of the following is typically NOT a member of the CMT?

Accepted Answer

Security analyst. The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications; a security analyst is part of the incident response team, not the CMT.

Answer

General counsel

Answer

Chief information security officer

Answer

CEO

Question 8

Which document outlines the overall strategy, roles, and responsibilities for incident response across the organization?

Accepted Answer

Incident response plan. The incident response plan (IRP) is the overarching document that defines the organization's strategy, structure, roles, and responsibilities for handling incidents end to end. It establishes who does what across the full lifecycle — preparation, detection, containment, eradication, recovery, and lessons learned. The policy sets intent at a high level, while the plan operationalizes that intent with assigned roles and coordination procedures.

Answer

Communication plan

Answer

Incident response policy

Answer

Incident response playbook

Question 9

After a data breach incident, the incident response team must preserve evidence for potential litigation. Which of the following actions should be taken FIRST?

Accepted Answer

Issue a legal hold. Issuing a legal hold is the first action because it triggers the duty to preserve evidence and suspends normal data retention or deletion policies, ensuring that logs, disk images, and other artifacts are not destroyed. Under FRCP and similar rules, once litigation is reasonably anticipated, spoliation of evidence can lead to sanctions, so the legal hold must precede any remediation or notification. This step also formally directs custodians and IT staff to retain relevant records, creating a defensible chain of custody.

Answer

Update the IR plan

Answer

Begin remediation

Answer

Notify law enforcement

Question 10

During a DDoS attack, the incident response team determines that the attack cannot be mitigated within the maximum tolerable downtime (MTD). What should happen next?

Accepted Answer

Activate business continuity and disaster recovery plans. When a DDoS attack cannot be mitigated within the Maximum Tolerable Downtime (MTD), the organization has exhausted its incident response capability and the outage will exceed the threshold the business can absorb. At that point, the correct action is to transition from incident response to business continuity and disaster recovery (BC/DR) — activating alternate processing sites, failover systems, or manual workarounds to keep critical business functions running. This is the standard escalation path defined in the Business Impact Analysis (BIA) and BC/DR plans.

Answer

Notify the board of directors

Answer

Continue current mitigation efforts

Answer

Declare a disaster immediately

Question 11

Which of the following is the primary reason for conducting a lessons learned meeting after an incident?

Accepted Answer

To update the IR plan and playbooks. The lessons learned meeting aims to identify improvements to the incident response process.

Answer

To document the incident for insurance

Answer

To satisfy regulatory requirements

Answer

To assign blame

Question 12

An organization has just experienced a P1 incident. Which of the following communication steps should occur FIRST?

Accepted Answer

Notify executive leadership. For a P1 (highest severity) incident, the first communication step is to notify executive leadership so they can authorize resources, make business decisions, and activate the crisis management structure. Executives own the risk and must be informed before any external messaging occurs. Customer, legal, and media communications follow only after leadership is briefed and the facts are established.

Answer

Inform customers

Answer

Notify law enforcement

Answer

Issue a media statement

Question 13

During a forensic investigation, the external forensics firm discovers evidence that may indicate criminal activity. The incident manager wants to ensure attorney-client privilege is maintained. What should be done?

Accepted Answer

Involve legal counsel to manage privilege. Involving legal counsel is essential to establish and preserve attorney-client privilege over the forensic investigation. Legal counsel can direct the scope of the investigation, issue a 'Kovel letter' to engage the external forensics firm as an agent of the attorney, and ensure that all communications and findings are protected under the work-product doctrine. Without this step, any evidence of criminal activity could be deemed discoverable and waive privilege, potentially compromising the organization's legal defense.

Answer

Share evidence directly with law enforcement

Answer

Ignore privilege to speed up investigation

Answer

Publicly disclose the evidence

Question 14

Which THREE of the following are typical roles in an incident response team?

Accepted Answer

Security analyst. Security analyst (B) is a core incident response role, responsible for monitoring alerts, triaging events, and performing initial containment and eradication actions. Forensic investigator (D) is also typical, handling evidence acquisition and analysis using tools like memory and disk imaging while preserving chain of custody. Legal counsel (E) is a standard member because incidents often trigger breach-notification laws, regulatory reporting, and liability concerns that must be managed during response. Human resources manager (A) and CEO (C) may be consulted or informed, but they are not typical hands-on incident response team roles, so they are not correct here.

Answer

Human resources manager

Answer

Chief executive officer (CEO)

Question 15

An organization has experienced a ransomware attack that has encrypted critical servers and is causing major business disruption. According to incident severity levels, which priority should this incident be assigned?

Accepted Answer

P1 — Critical. A ransomware attack that encrypts critical servers and causes major business disruption is a critical incident, warranting a P1 priority. P1 incidents are reserved for those with severe impact on business operations, requiring immediate response and escalation. The encryption of critical servers directly threatens the organization's ability to operate, making P1 the appropriate severity level.

Answer

P2 — High

Answer

P4 — Low

Answer

P3 — Medium