CISM Incident Management Practice Test 12 — 15 Questions

Question 1

A security manager learns that a production database containing customer records was copied to an unauthorized external drive by a contractor. The incident response team has contained the contractor's access. According to CISM best practices, which action should the security manager take NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Notify the legal department and initiate the evidence preservation and chain-of-custody process.. When an incident may involve criminal conduct or regulatory breach notification, the security manager's immediate priority is to engage legal counsel and preserve evidence. This ensures the organization can support law enforcement, defend against liability, and meet notification requirements. Containment has already occurred, so the next step is protecting the integrity of the investigation rather than taking destructive or premature personnel actions.

Answer

Terminate the contractor's employment contract and demand return of the external drive.

Answer

Send a company-wide email informing all employees about the contractor's misconduct.

Answer

Immediately delete the contractor's user account and all associated files to prevent further data loss.

Question 2

A security operations center (SOC) analyst receives an alert about a possible data exfiltration from a database server. The analyst must determine the incident severity to initiate the appropriate response. Which of the following factors is MOST important in determining the severity level?

Accepted Answer

The potential impact on business operations and regulatory compliance.. Incident severity should be determined by the potential impact on business operations, regulatory compliance, and reputation. CISM stresses that severity classification drives the response level and resource allocation. While data volume, source IP, and detection method are relevant details, they do not define severity. The most important factor is the business impact, as it determines the urgency and scale of the response.

Answer

The volume of data potentially exfiltrated.

Answer

The source IP address of the exfiltration attempt.

Answer

The method used to detect the exfiltration (e.g., SIEM alert vs. user report).

Question 3

An organisation has just completed containment of a significant data breach. The incident response manager is preparing the post-incident review. Which of the following activities BEST ensures that lessons learned translate into lasting improvement of the incident response capability?

Accepted Answer

Assigning each corrective action to an accountable owner with a due date and tracking it to closure. The purpose of a post-incident review is to convert findings into verified improvements. Assigning each corrective action to a named owner with a deadline and tracking it to closure provides the accountability and visibility that turn recommendations into real capability gains, and it produces evidence that management acted on the lessons identified.

Answer

Circulating the final incident report to all staff so everyone is aware of what happened

Answer

Updating the risk register to reflect the incident and then archiving the incident documentation

Answer

Conducting a tabletop exercise on the same scenario within the following week

Question 4

A financial services firm's incident response team has contained a credential-stuffing attack that compromised several customer accounts. The CISO asks the incident manager to determine what should happen next before the team stands down. Which action BEST aligns with CISM incident management practices?

Accepted Answer

Conduct a post-incident review to capture lessons learned and update controls and the response plan.. The post-incident review is a core CISM activity that converts a contained incident into organizational improvement. It examines root cause, response effectiveness, and gaps, then updates the incident response plan and controls. Simply closing the ticket, over-escalating, or blindly reimaging systems skips the analysis needed to prevent recurrence and strengthen the security program.

Answer

Reimage all customer account systems and rotate every credential in the environment without further analysis.

Answer

Escalate the incident to law enforcement and suspend all customer-facing services pending investigation.

Answer

Immediately close the incident ticket and release the response team so normal operations can resume.

Question 5

An organization experiences a data breach involving customer personally identifiable information (PII). The incident response team has contained the breach. Which of the following should be the PRIMARY consideration when deciding whether to notify affected customers?

Accepted Answer

Legal and regulatory requirements for breach notification.. The primary consideration for notifying affected customers after a data breach is compliance with legal and regulatory requirements. These laws dictate the circumstances, timing, and method of notification. Failure to comply can result in significant penalties and legal liability. While cost, PR, and stock price are important, they are secondary to legal obligations and the ethical duty to protect customers.

Answer

The cost of providing credit monitoring services.

Answer

The potential impact on the organization's stock price.

Answer

The organization's public relations strategy.

Question 6

An organization is reviewing its incident response plan after a prolonged outage caused by a coordinated attack. Management wants to improve the organization's ability to communicate effectively during future incidents. Which TWO of the following should be included in the incident communication plan? (Choose two.)

Accepted Answer

Predefined communication templates for different stakeholder groups and incident types. An effective incident communication plan includes prepared templates for different audiences and incidents, plus designated spokespersons with clear approval workflows. Templates speed response and ensure consistency, while spokesperson designation and approval controls prevent unauthorized or harmful statements. Collecting personal contact data, mandating real-time technical disclosure, or centralizing all communication in one executive do not constitute sound communication planning and can introduce privacy, security, or operational problems.

Answer

A requirement that all technical details of the incident be shared publicly in real time

Answer

A list of all employees' personal mobile numbers for emergency mass texting

Answer

A policy that only the CEO may speak to any stakeholder during an incident

Question 7

During a major ransomware incident, the chief information security officer (CISO) must decide whether to pay the ransom to restore encrypted clinical trial data at a pharmaceutical company. The attackers have threatened to publish the data if not paid within 48 hours. Which of the following is the MOST important factor for the CISO to consider when making this business decision?

Accepted Answer

Whether the organization has a validated, tested backup and recovery capability that can restore the data without paying.. A validated and tested backup and recovery capability is the most important factor because it determines whether the organization can restore operations without paying and without trusting the attacker. It directly supports business continuity and reduces the organization's dependence on criminal actors. Insurance, sample decryptors, and attacker reputation are secondary or unreliable considerations that do not resolve the core recovery and risk question.

Answer

Whether the attackers have provided a decryption tool that works on a sample file.

Answer

Whether the attackers have a reputation for honoring their promises in previous incidents.

Answer

Whether the organization has a cyber insurance policy that will reimburse the ransom payment.

Question 8

A security manager is defining the incident classification scheme for a multinational retailer. Executive leadership wants to know which incidents will trigger a formal crisis management team (CMT) activation. Which criterion should PRIMARILY determine whether an incident is classified as a crisis-level event?

Accepted Answer

The incident has the potential to cause significant harm to the organization's brand, finances, or regulatory standing.. Crisis-level classification hinges on the potential for enterprise-wide harm to reputation, finances, operations, or regulatory compliance. This impact-based threshold ensures the CMT is convened only when executive authority, cross-functional coordination, and external stakeholder management are genuinely required. Detection source, staffing needs, and asset criticality labels are useful inputs but cannot by themselves indicate that an incident has crossed the crisis threshold.

Answer

The incident requires more than one analyst to investigate and remediate within the standard service-level agreement.

Answer

The incident was detected by the security operations center (SOC) outside of normal business hours.

Answer

The incident affects a system that is listed in the configuration management database (CMDB) as business-critical.

Question 9

During a major incident, the incident response manager must decide whether to declare a crisis and activate the crisis management team (CMT). Which factor is MOST important in making that decision?

Accepted Answer

The potential impact on critical business functions and the need for executive-level coordination.. CISM ties crisis declaration to significant business impact and the need for executive-level coordination. The CMT exists to provide strategic direction, resource prioritization, and stakeholder management during severe incidents. Alert volume, detection source, and shift staffing are operational details that do not by themselves determine whether a crisis should be declared.

Answer

The availability of the on-call incident responder during the current shift.

Answer

Whether the incident was detected by an external party rather than internal monitoring.

Answer

The number of alerts generated by the SIEM in the last hour.

Question 10

A multinational organisation suffers a breach affecting customers in several jurisdictions. The incident response manager must coordinate notification obligations while the investigation is still ongoing and facts are incomplete. Which of the following is the MOST appropriate approach?

Accepted Answer

Engage legal counsel to map jurisdictional notification requirements and issue notices as facts are confirmed, meeting each deadline. Cross-border breaches trigger overlapping notification regimes with different thresholds, recipients, and deadlines. Legal counsel must map those obligations, and notices should be issued progressively as facts are confirmed so each jurisdiction's deadline is met without publishing inaccurate information. This balances compliance with the reality of an incomplete investigation.

Answer

Delegate all notification decisions to the public relations team to ensure consistent messaging across markets

Answer

Notify every customer in all markets immediately, regardless of whether their data was affected

Answer

Wait until the investigation is fully complete so that a single, comprehensive notification can be issued to all affected parties

Question 11

During a major incident, the incident response team discovers that the attacker is still active in the environment and is moving laterally. The incident response manager must decide on the immediate course of action. Which of the following should be the PRIMARY consideration when determining whether to isolate affected network segments?

Accepted Answer

The potential impact on business operations and critical services.. In an active incident with lateral movement, the incident response manager must balance containment against business continuity. The primary consideration is the impact on business operations and critical services, because isolation can disrupt essential functions. This reflects CISM's emphasis on aligning incident response decisions with organizational risk management and business priorities, rather than purely technical or financial factors.

Answer

The attacker's presumed skill level and tools.

Answer

The cost of replacing the affected network hardware.

Answer

The number of security staff available to monitor the isolated segments.

Question 12

A CISO at a healthcare payer is revising the incident response plan after a tabletop exercise exposed confusion about who may commit the organization to public statements and remediation costs during a major breach. The board wants clarity on governance-level decision rights that must exist before the next incident. Which TWO activities should be assigned to the crisis management team rather than to the tactical incident response team? (Choose two.)

Accepted Answer

Authorizing external legal counsel engagement and regulatory disclosure strategy. The crisis management team exists to make strategic, enterprise-wide decisions that tactical responders lack the authority to make. Authorizing legal counsel and disclosure strategy commits the organization externally, while approving continuity activation and recovery prioritization allocates business resources across functions. Both require executive judgment about legal exposure, reputation, and operational trade-offs. Host forensics, SIEM tuning, and ticket logging are operational execution tasks that remain with the tactical incident response and security operations teams.

Answer

Isolating affected network segments and collecting volatile memory from compromised hosts

Answer

Tuning SIEM correlation rules to reduce false positives from the newly deployed endpoint agent

Answer

Updating the incident ticketing system with containment timestamps for each affected host

Question 13

An organization is reviewing its incident response plan after a tabletop exercise revealed confusion about roles during a major incident. The CISO wants to clarify which activities belong to the incident response team versus the crisis management team. Which TWO of the following activities are PRIMARY responsibilities of the crisis management team during a major incident? (Choose two.)

Accepted Answer

Authorizing the expenditure of emergency funds to engage external counsel and forensic vendors.. The crisis management team owns strategic decisions such as approving external communications and authorizing emergency spending for legal and forensic support. These activities require executive authority and affect the entire enterprise. Forensic imaging, malware analysis, and firewall changes are tactical tasks belonging to the incident response team and should remain with technical responders to keep the CMT focused on governance and business impact.

Answer

Performing forensic imaging of compromised servers to preserve evidence.

Answer

Analyzing malware samples to determine the attacker's command-and-control infrastructure.

Answer

Configuring firewall rules to block identified malicious IP addresses.

Question 14

An organization is developing its incident response plan. The CISO wants to ensure that the plan includes provisions for communicating with external parties during and after an incident. Which of the following should be the PRIMARY consideration when defining external communication procedures?

Accepted Answer

Aligning communication procedures with legal, regulatory, and contractual requirements.. External communication procedures must first ensure compliance with legal, regulatory, and contractual requirements. These obligations dictate who to notify, when, and what information to share. CISM emphasizes that incident response is not just technical but also legal and business-oriented. While legal approval, a single point of contact, and social media are elements, they are secondary to the primary need to meet compliance obligations and protect the organization.

Answer

Ensuring that all external communications are approved by the legal department.

Answer

Using social media to quickly inform the public about the incident.

Answer

Establishing a single point of contact for all external communications.

Question 15

A financial services firm has just contained a breach in which an attacker exfiltrated customer records from a database server. Legal counsel advises the incident manager that the matter will likely result in litigation and regulatory inquiry. Which TWO actions should the incident manager take to preserve the evidentiary value of the affected server? (Choose two.)

Accepted Answer

Capture a forensic image of the server's volatile memory and disk before any remediation or reboot occurs.. Preserving evidence in a matter destined for litigation and regulatory scrutiny requires capturing volatile and non-volatile data before any remediation and maintaining rigorous chain-of-custody records. These two actions protect admissibility and demonstrate due diligence. Rebuilding the server, deleting malware, or resuming backups would overwrite or destroy artifacts, weakening both the legal case and the organization's regulatory defensibility.

Answer

Allow the database administrator to resume normal backups on the server to maintain recovery capability.

Answer

Delete the attacker's malware binaries to prevent accidental execution during the investigation.

Answer

Rebuild the server from a known-good image immediately to restore service and eliminate attacker persistence.