CISM Incident Management Practice Test 11 — 15 Questions

Question 1

During a major cybersecurity incident, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Declare a disaster and activate the BC/DR plan. When an incident cannot be resolved within the MTD, the organization has exceeded its tolerance for downtime, which qualifies as a disaster. The next step is to declare a disaster and activate the Business Continuity/Disaster Recovery (BC/DR) plan to restore critical operations through alternate means.

Answer

Conduct a root cause analysis

Answer

Notify the executive sponsor and continue response efforts

Answer

Increase the number of incident responders

Question 2

An organization's security operations center (SOC) confirms that a production database server is actively exfiltrating customer records to an external IP address. The SOC manager must decide whether to immediately isolate the server from the network. Which factor should PRIMARILY guide this decision?

Accepted Answer

The potential business impact of taking the server offline versus the value of preserving evidence of the exfiltration channel.. Containment during active exfiltration requires balancing the harm of continued data loss against the harm of disrupting production services and destroying volatile evidence. CISM frames incident response decisions around business impact and evidence integrity, so the decision to isolate must be grounded in that trade-off rather than in threat intelligence reputation, authentication telemetry, or insurance considerations.

Answer

The number of failed login attempts recorded on the database server in the preceding 24 hours.

Answer

Whether the database server is covered by the organization's cyber insurance policy.

Answer

Whether the external IP address has been previously reported to a threat intelligence sharing platform.

Question 3

During a major incident, the incident response team determines that a compromised server must be rebuilt immediately to restore a critical service. A forensic analyst objects, noting that the server contains evidence relevant to a pending regulatory investigation. How should the incident manager resolve this conflict?

Accepted Answer

Capture a forensic image of the server's storage and volatile memory before rebuilding, then document the evidence handling.. When operational recovery and evidence preservation collide, the incident manager should pursue both by imaging the system before it is rebuilt. A forensic image of storage and memory preserves the artifacts regulators and investigators require while allowing the critical service to be restored. This balanced action aligns with CISM guidance to integrate incident response with legal and regulatory obligations rather than sacrificing one for the other.

Answer

Proceed with the rebuild because restoring the critical service takes priority over any investigative activity.

Answer

Rebuild the server and rely on the SIEM logs to reconstruct the evidence needed for the investigation.

Answer

Delay the rebuild until the regulatory investigation concludes so that the server remains untouched.

Question 4

A financial services firm has activated its crisis management team (CMT) for a significant data breach. The CISO, who is a member of the CMT, is asked to present the technical details of the incident. However, the CMT's primary focus should be on which of the following?

Accepted Answer

Making strategic decisions regarding business continuity and stakeholder communication.. The CMT's primary role during a major incident is to make strategic decisions that affect the entire organization, such as business continuity, resource allocation, and stakeholder communication. While technical input is valuable, the CMT must focus on the broader impact and ensure that the response aligns with business objectives. This separation of strategic and tactical responsibilities is a key CISM principle.

Answer

Coordinating the technical recovery of affected systems.

Answer

Conducting a forensic analysis to determine the root cause.

Answer

Directly managing the incident response team's daily activities.

Question 5

A security manager is developing the incident classification scheme for a multinational retailer. The organization must decide how to categorize an incident involving unauthorized access to a database containing 50,000 customer payment card records, where the breach is confirmed but containment has not yet begun. Which factor is MOST important when assigning the incident severity level?

Accepted Answer

The potential business impact and regulatory notification obligations arising from the exposed records. Severity levels exist to drive escalation, resource allocation, and executive notification. The determinant must be the consequence to the business, including legal and regulatory exposure. With confirmed unauthorized access to payment card data, notification obligations and financial impact are concrete and significant. Technical indicators such as failed logins, malware family, or acknowledgment time inform response but do not define the severity of the incident.

Answer

The specific malware family or attacker tooling identified during initial triage

Answer

The number of failed login attempts recorded before the successful breach

Answer

The elapsed time between the first alert and the analyst's acknowledgment of the ticket

Question 6

A security manager is reviewing the incident response plan and notices that the plan does not specify how to handle a situation where the incident response team cannot reach the primary incident response manager. What should be done to address this gap?

Accepted Answer

Designate an alternate incident response manager and include contact information in the plan.. The most effective way to address the lack of a backup for the incident response manager is to designate an alternate and include their contact details in the plan. This ensures that leadership is maintained even if the primary manager is unavailable. It is a simple, cost-effective, and standard practice in incident response planning, aligning with CISM's emphasis on preparedness and resilience.

Answer

Outsource incident response management to a third-party provider.

Answer

Implement a policy that the incident response manager must always be available.

Answer

Require all incident response team members to report to the CISO in the absence of the manager.

Question 7

A financial services firm has activated its incident response team for a suspected insider data theft. The legal department advises that the matter may become a criminal case. The security manager must decide how to handle the forensic images and analyst notes. Which action BEST supports both the investigation and potential legal proceedings?

Accepted Answer

Maintain a documented chain of custody with hash values and restricted access to the evidence repository. When an incident may become a criminal or civil legal matter, evidence must be handled so that it remains admissible and defensible. Chain of custody documentation, cryptographic hashing, and strict access controls are the core requirements. These practices demonstrate that evidence has not been altered and that only authorized personnel handled it. Other options either contaminate evidence, expose it to unauthorized parties, or destroy potentially discoverable material.

Answer

Delete analyst working notes after the final report is issued to reduce discoverable material

Answer

Store all evidence on the same file server used for routine IT backups to ensure redundancy

Answer

Allow the suspect's manager to review the forensic images to confirm whether the data was sensitive

Question 8

An organization is developing its incident response capabilities and wants to ensure that it can effectively detect and respond to security incidents. Which TWO of the following are essential components of an incident response programme that should be established before an incident occurs? (Choose two.)

Accepted Answer

Incident response policy and procedures.. The essential components of an incident response programme include an incident response policy and procedures, which provide the framework and steps for handling incidents, and a communication plan, which ensures effective information sharing with stakeholders. These are directly related to the response process and are necessary for a coordinated and effective response.

Answer

A disaster recovery plan.

Answer

A list of all IT assets and their locations.

Answer

A vulnerability management programme.

Question 9

A security manager is drafting the incident classification criteria for a new incident response plan. Executive leadership has asked how the team will decide, in the first few minutes of an event, whether to invoke the crisis management team. Which of the following is the MOST appropriate basis for that initial escalation decision?

Accepted Answer

The predefined severity level assigned to the incident type and its assessed business impact. Incident classification must be anchored to predefined severity levels that map directly to business impact, so responders can escalate consistently and quickly. This lets the organisation activate the crisis management team at the right threshold without debate, and it aligns response effort with the value at risk rather than with incidental signals such as alert counts or reporter rank.

Answer

The seniority of the person who first reported the event to the service desk

Answer

The number of alerts the SIEM generated for the affected host in the last 24 hours

Answer

Whether the affected system is covered by the current cyber insurance policy

Question 10

An organization has just completed containment of a malware outbreak. The incident manager is preparing to transition the incident to the eradication and recovery phase. Which activity should occur FIRST during this transition?

Accepted Answer

Identify and remove the root cause and all remnants of the malware from affected systems. The incident response lifecycle moves from preparation to detection and analysis, containment, eradication, recovery, and post-incident activity. Once containment is achieved, the next phase is eradication, which removes the root cause and residual threat. Recovery, regulatory notification, and lessons learned come later. Performing eradication before recovery prevents reinfection and ensures that restored systems are not compromised again by the same vector.

Answer

Notify external regulators of the incident in accordance with legal requirements

Answer

Restore all affected systems from the most recent backups and return them to production

Answer

Conduct a lessons-learned meeting with all incident responders

Question 11

An organization's incident response plan defines containment, eradication, and recovery phases. During a major incident involving a compromised application server, the incident response manager must decide whether to take the server offline immediately or keep it running to observe attacker behavior. Which of the following is the MOST important factor in making this decision?

Accepted Answer

The potential business impact of taking the server offline versus the risk of allowing the attacker to persist.. The containment decision during an incident must balance the risk of continued attacker presence against the business impact of taking systems offline. CISM emphasizes aligning incident response with business objectives, so the incident response manager should prioritize business impact and risk. Forensic preservation, threat intelligence, and past experience are supporting considerations but not the primary factor.

Answer

The attacker's known tactics, techniques, and procedures (TTPs) from threat intelligence.

Answer

The incident response team's previous experience with similar incidents.

Answer

The availability of forensic tools to capture volatile memory before shutting down the server.

Question 12

During a security incident, the incident response team needs to preserve volatile evidence. Which of the following should be collected first?

Accepted Answer

Contents of RAM.. The order of volatility dictates that the most volatile evidence, such as RAM contents, should be collected first because it is lost when the system is powered off or rebooted. Hard drives, logs, and backups are less volatile and can be collected later. This principle ensures that critical evidence is preserved for forensic analysis.

Answer

Files on the hard drive.

Answer

Network traffic logs.

Answer

Backup tapes.

Question 13

During containment of a confirmed intrusion, the incident response manager must decide whether to immediately rebuild the compromised server or first acquire volatile data. Legal counsel has signalled that litigation is likely. Which of the following is the BEST course of action?

Accepted Answer

Capture volatile data in order of volatility, then rebuild the server from a known-good image. Forensic soundness requires capturing the most volatile data first because memory and connection state are lost on shutdown or rebuild. Once that evidence is preserved, the server can be rebuilt from a known-good image to restore service. This sequence respects the litigation hold implied by legal counsel while still meeting the organisation's recovery objectives.

Answer

Rebuild the server immediately to restore service, then document what was observed before the rebuild

Answer

Leave the server running untouched until the external forensic firm arrives several days later

Answer

Shut down the server immediately to preserve its current state for investigators

Question 14

A multinational retailer's security operations center (SOC) identifies that an attacker has compromised a point-of-sale (POS) system in a European store and is moving laterally toward the payment card processing environment. The incident response manager needs to decide the FIRST action to limit business impact while preserving the ability to investigate. Which action should be taken FIRST?

Accepted Answer

Isolate the affected POS system from the network using the endpoint detection and response (EDR) tool while keeping it powered on.. Isolating the endpoint through EDR keeps the system powered on, which preserves volatile evidence while stopping the attacker's ability to move laterally or maintain command and control. This approach satisfies the CISM priority of limiting business impact without compromising the investigation. Notifying external parties or deleting files before containment can let the attack spread and destroy evidence needed for scoping and root cause analysis.

Answer

Notify the payment card brands and law enforcement before taking any technical action.

Answer

Immediately power off the compromised POS system and remove it from the network.

Answer

Delete the malware files from the POS system to stop the attack immediately.

Question 15

A security manager is reviewing the organization's incident response capabilities. During a tabletop exercise, participants struggled to determine who has authority to shut down a critical production system during a suspected incident. Which action BEST addresses this gap?

Accepted Answer

Document and communicate clear decision-making authority and escalation paths in the incident response plan. The tabletop exercise revealed that the organization lacks clarity on decision-making authority during incidents. The most effective remedy is to define and communicate who can make high-impact decisions, such as shutting down production, and under what conditions. Documenting escalation paths ensures that responders know when and to whom to escalate. Technical controls and additional certifications do not resolve governance ambiguity, which is the root cause of the observed struggle.

Answer

Require all incident responders to obtain a forensic certification before the next exercise

Answer

Increase the frequency of technical vulnerability scans on the critical production system

Answer

Implement an automated tool that shuts down production systems when malware is detected