CISM Incident Management Practice Test 10 — 15 Questions

Question 1

What is the primary purpose of having a pre-established forensic retainer agreement with an external forensics firm?

Accepted Answer

To reduce time to engage during an incident. The primary purpose of a pre-established forensic retainer agreement is to reduce the time to engage during an incident. By having a contract already in place, the organization can bypass procurement and legal review delays, enabling the forensics firm to begin work immediately when an incident occurs, which is critical for preserving volatile evidence and minimizing damage.

Answer

To ensure chain of custody

Answer

To reduce legal liability

Answer

To guarantee confidentiality

Question 2

During a major incident, the crisis management team (CMT) has been activated. Which of the following is typically NOT a member of the CMT?

Accepted Answer

Security analyst. The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications; a security analyst is part of the incident response team, not the CMT.

Answer

General counsel

Answer

Chief information security officer

Answer

CEO

Question 3

An incident response team is handling a P2 (high) incident. According to the incident severity classification, which of the following is the expected response timeframe?

Accepted Answer

Business hours response with management notification. A P2 (high) incident requires a response during business hours with management notification, as defined by the incident severity classification. This ensures that the incident is addressed promptly within operational hours while keeping management informed for potential escalation or resource allocation.

Answer

Standard response with no escalation

Answer

Scheduled remediation

Answer

24/7 response with executive notification

Question 4

Which document outlines the overall strategy, roles, and responsibilities for incident response across the organization?

Accepted Answer

Incident response plan. The incident response plan provides the high-level strategy and coordination framework.

Answer

Communication plan

Answer

Incident response policy

Answer

Incident response playbook

Question 5

After a data breach incident, the incident response team must preserve evidence for potential litigation. Which of the following actions should be taken FIRST?

Accepted Answer

Issue a legal hold. Issuing a legal hold ensures that all relevant data is preserved and not deleted, which is the first step in evidence preservation.

Answer

Update the IR plan

Answer

Begin remediation

Answer

Notify law enforcement

Question 6

An organization is required to notify regulators of a material cybersecurity incident within 4 business days. Which regulation imposes this requirement?

Accepted Answer

SEC proposed rules. The SEC's proposed rules (now final) require publicly traded companies to report material cybersecurity incidents on Form 8-K within 4 business days of determining materiality. This is a specific U.S. securities regulation, not a privacy or payment card standard, and it directly mandates the 4-business-day notification window for material incidents.

Answer

California Consumer Privacy Act (CCPA)

Answer

GDPR

Answer

PCI DSS

Question 7

During a DDoS attack, the incident response team determines that the attack cannot be mitigated within the maximum tolerable downtime (MTD). What should happen next?

Accepted Answer

Activate business continuity and disaster recovery plans. When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation.

Answer

Notify the board of directors

Answer

Continue current mitigation efforts

Answer

Declare a disaster immediately

Question 8

Which of the following is the primary reason for conducting a lessons learned meeting after an incident?

Accepted Answer

To update the IR plan and playbooks. The lessons learned meeting aims to identify improvements to the incident response process.

Answer

To document the incident for insurance

Answer

To satisfy regulatory requirements

Answer

To assign blame

Question 9

An organization has just experienced a P1 incident. Which of the following communication steps should occur FIRST?

Accepted Answer

Notify executive leadership. Internal communication, especially to executives, is typically the first priority to ensure leadership is informed.

Answer

Inform customers

Answer

Notify law enforcement

Answer

Issue a media statement

Question 10

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 – Critical. P1 (critical) incidents have major business impact and require executive notification and around-the-clock response.

Answer

P3 – Medium

Answer

P4 – Low

Answer

P2 – High

Question 11

Which TWO of the following are components of an incident response programme?

Accepted Answer

Incident response plan. IR policy and IR plan are core components; vendor contacts are part of the plan, and BIA is not a direct IR component.

Answer

Vendor contracts

Answer

Risk assessment

Answer

Business impact analysis (BIA)

Question 12

Which TWO of the following are incident categories in an incident management programme?

Accepted Answer

Insider threat. Ransomware and insider threat are defined incident categories; phishing is a technique, not a category; vulnerability is a condition; theft is too broad.

Answer

Theft

Answer

Vulnerability

Answer

Phishing

Question 13

Which THREE of the following are typical roles in an incident response team?

Accepted Answer

Security analyst. The IR team includes security analysts, forensic investigators, and legal counsel; the CMT includes executives like CEO; HR is not a standard IR role.

Answer

Human resources manager

Answer

Chief executive officer (CEO)

Question 14

An organization has experienced a ransomware attack that has encrypted critical servers and is causing major business disruption. According to incident severity levels, which priority should this incident be assigned?

Accepted Answer

P1 — Critical. A ransomware attack with major business impact is a critical incident (P1), requiring executive notification and 24/7 response.

Answer

P2 — High

Answer

P4 — Low

Answer

P3 — Medium

Question 15

During a major cybersecurity incident, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Accepted Answer

Declare a disaster and activate the BC/DR plan. When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation to restore operations.

Answer

Conduct a root cause analysis

Answer

Notify the executive sponsor and continue response efforts

Answer

Increase the number of incident responders