CISM Incident Management Practice Test 14 — 15 Questions

Question 1

During a major data breach, the incident response manager needs to determine whether the organization must notify regulators and affected individuals. Which factor is MOST important in making this determination?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The type of data compromised and applicable legal and regulatory requirements.. Notification decisions are legal and compliance determinations based on what data was exposed and which laws, regulations, or contracts apply. The incident response manager should engage legal counsel and privacy officers early to map the compromised data types to specific reporting obligations and deadlines. Operational metrics such as system count, dwell time, and response cost inform the investigation but do not by themselves establish a duty to notify.

Answer

The estimated cost of the incident response effort.

Answer

The number of systems affected by the malware.

Answer

The length of time the attacker had access to the environment.

Question 2

An organization has just experienced a data breach involving customer personal information. The incident manager is determining the appropriate communication strategy. Which action BEST aligns with CISM incident management practices?

Accepted Answer

Coordinate with legal counsel and communications to notify affected parties and regulators as required.. Breach communication should be coordinated with legal counsel and communications to ensure regulatory notifications and customer messaging are timely, accurate, and compliant. Premature public disclosure, indefinite delay, and selective notification all fail to meet CISM expectations for structured, legally sound, and ethical incident communication.

Answer

Notify only the customers who are likely to complain, to minimize business disruption.

Answer

Publicly disclose all technical details of the breach immediately to demonstrate transparency.

Answer

Delay all notifications until the forensic investigation is completely finished, regardless of regulatory deadlines.

Question 3

An organization has experienced a data breach involving customer personally identifiable information (PII). The incident response team has completed containment and eradication. Legal counsel advises that the breach may trigger notification requirements under multiple jurisdictions. Which of the following should the security manager do NEXT to ensure compliance?

Accepted Answer

Conduct a thorough impact assessment to determine the scope and nature of the data involved.. After containment and eradication, the next critical step in a data breach involving PII is to assess the scope and impact. This assessment identifies which data elements were exposed, how many individuals are affected, and which jurisdictions' laws apply. It provides the factual basis for legal notification decisions and ensures that notifications are accurate, timely, and compliant with varying regulatory requirements.

Answer

Delete all compromised data to prevent further exposure.

Answer

Publicly announce the breach on the company website to demonstrate transparency.

Answer

Immediately send a blanket notification to all customers regardless of jurisdiction.

Question 4

A retail company's security operations center receives an alert that a point-of-sale terminal is communicating with a known malicious command-and-control domain. The analyst confirms the connection is active. According to incident response best practices, which action should the analyst take FIRST?

Accepted Answer

Isolate the affected terminal from the network while preserving evidence for investigation. Once malicious command-and-control activity is confirmed, containment is the immediate priority because an active channel enables exfiltration and further intrusion. Isolating the terminal severs that channel without destroying the volatile and stored evidence investigators require. Powering off, scanning in place, or delaying action for documentation all leave the attacker connected or degrade evidence. The correct sequence is to contain first, then analyze and eradicate, keeping forensic integrity intact throughout.

Answer

Run a full antivirus scan on the terminal and wait for it to complete before taking further action

Answer

Document the alert details and escalate to management before taking any technical action

Answer

Immediately power off the terminal to terminate the malicious connection

Question 5

An information security manager is drafting the incident escalation criteria for the organization's incident response plan. Executive leadership has asked how the team will decide when an incident must be escalated to the crisis management team rather than handled by the technical response team alone. Which of the following is the MOST appropriate basis for defining these escalation thresholds?

Accepted Answer

The potential or actual business impact of the incident on critical services and objectives. Escalation criteria should reflect the consequence to the business, because the crisis management team's purpose is to make strategic decisions and commit resources when critical services, regulatory obligations, or stakeholder trust are at risk. Technical metrics such as system counts, response timing, and attribution describe the incident's mechanics or handling rather than its business significance, so they cannot reliably determine when executive engagement is warranted.

Answer

The number of systems or user accounts confirmed to be affected by the incident

Answer

The classification of the threat actor, such as nation-state, organized crime, or insider

Answer

The elapsed time between initial detection and the first containment action taken by the response team

Question 6

A security manager is drafting the incident response plan and must specify how the organization will communicate with regulators, law enforcement, and the media during a high-severity breach. The chief information security officer (CISO) wants to ensure that all external communications are coordinated, legally defensible, and consistent. Which of the following should the CISO require FIRST to meet this objective?

Accepted Answer

Designate a single, pre-authorized spokesperson and require all external communications to flow through a defined approval chain.. Coordinated external communication during a high-severity breach requires a single pre-authorized spokesperson and a defined approval chain. This ensures messages to regulators, law enforcement, and media are consistent, legally reviewed, and technically accurate. Empowering everyone to speak or relying solely on one department creates confusion, legal exposure, and inconsistent messaging that can worsen the incident's impact.

Answer

Require all external communications to be handled exclusively by the legal department without input from security or communications staff.

Answer

Publish the full incident response plan on the corporate intranet so all employees understand the communication process.

Answer

Grant every member of the incident response team authority to speak with external parties to speed up information sharing.

Question 7

An organization has completed its response to a data breach and is conducting a post-incident review. Management wants assurance that lessons learned will actually improve future response capability. Which outcome BEST demonstrates that the post-incident review achieved this objective?

Accepted Answer

The incident response plan is updated with assigned corrective actions, owners, and due dates tracked to closure.. Post-incident reviews only improve capability when findings become tracked corrective actions with named owners and deadlines. This converts analysis into verified changes to plans, controls, and training, and provides management with evidence that gaps have been addressed. Distributing timelines, giving briefings, or archiving reports may support the process but do not by themselves change future response outcomes.

Answer

A detailed timeline of the incident is distributed to all employees as a training awareness bulletin.

Answer

The final incident report is archived in the document management system for future reference.

Answer

The incident response team receives a summary presentation highlighting the attacker's tactics and techniques.

Question 8

During a major incident, the incident response manager is coordinating containment while the crisis management team (CMT) handles business continuity decisions. A responder proposes immediately wiping and rebuilding an affected server to restore service quickly, but the server contains evidence relevant to a potential legal action. Which of the following is the MOST appropriate action for the incident response manager to take?

Accepted Answer

Consult legal counsel to determine preservation obligations, then choose a containment or recovery approach that preserves evidence while restoring service.. When legal action is anticipated, evidence preservation becomes a formal obligation that must be balanced against service restoration. The incident response manager should engage legal counsel to confirm preservation requirements, then select a containment or recovery method that keeps evidence intact, such as imaging the server or rebuilding on alternate infrastructure. This coordinated approach protects both operational continuity and the organization's legal position, avoiding the extremes of reckless destruction or unnecessary service outage.

Answer

Delegate the decision entirely to the forensic investigator and proceed based on their technical recommendation alone.

Answer

Refuse to restore service until the forensic investigation is fully complete, regardless of business impact.

Answer

Authorize the rebuild immediately because restoring service takes precedence over evidence preservation in all incidents.

Question 9

During a major incident, the incident response team determines that the attacker used compromised credentials of a privileged administrator. The team wants to prevent the attacker from re-entering while keeping the business running. Which of the following is the MOST appropriate containment action?

Accepted Answer

Disable the compromised administrator account and rotate all credentials for privileged accounts.. The most effective containment against credential-based intrusion is to remove the compromised access and invalidate related secrets. Disabling the known compromised administrator account stops the confirmed entry path, while rotating all privileged credentials closes the likely other paths the attacker obtained. This approach contains the threat without unnecessarily halting business operations, which reflects CISM's balance between security response and business continuity. Blanket shutdowns and passive monitoring fail to remove the adversary's access.

Answer

Enable full packet capture on the network and continue monitoring for attacker activity.

Answer

Reset the password on the compromised administrator account only and force a change at next logon.

Answer

Shut down all servers that the administrator account could access until the investigation is complete.

Question 10

An organization's incident response team has contained a malware outbreak, but the attacker's initial access vector remains unknown. Which activity should be performed to reduce the likelihood of recurrence?

Accepted Answer

Perform a root cause analysis to identify and remediate the initial access vector.. When the initial access vector is unknown, the highest priority is a structured root cause analysis to determine how the attacker entered and to eliminate that pathway. This prevents recurrence and feeds lessons learned into control improvements, monitoring enhancements, and plan updates. Recovery, signature updates, and awareness communications are useful supporting activities, but none of them replaces identifying and closing the actual entry point.

Answer

Notify all employees about the incident and remind them of security policies.

Answer

Increase the frequency of antivirus signature updates on all endpoints.

Answer

Close the incident and restore affected systems from backups.

Question 11

An organization's incident response plan delegates authority to the incident commander to make containment decisions during a severe incident. During an active intrusion affecting multiple business units, the incident commander wants to take a system offline that supports a revenue-generating service. Which factor should PRIMARILY guide this containment decision?

Accepted Answer

The potential business impact of the containment action weighed against the risk of continued attacker activity. Containment decisions require weighing the harm of the action against the harm of inaction. Taking a revenue service offline protects the enterprise from further compromise but disrupts business, while leaving it online preserves revenue but risks escalation. The incident commander uses business impact analysis, threat severity, and organizational risk tolerance to strike the right balance. Restoration difficulty, insurance coverage, and stakeholder preference are secondary inputs, not the primary basis for the decision.

Answer

The preference of the business unit leader who owns the revenue-generating service

Answer

Whether the affected system is covered by the organization's cyber insurance policy

Answer

The technical difficulty of restoring the service after it has been taken offline

Question 12

A security manager is drafting the incident classification section of the incident response plan. Executives want a documented, repeatable way to rank incidents so that notification and escalation paths are triggered consistently. Which of the following should be the PRIMARY basis for assigning an incident severity level?

Accepted Answer

The assessed business impact and the criticality of the affected information assets.. Severity classification must translate technical events into business consequences so that escalation, notification, and resource allocation are consistent and defensible. Basing severity on business impact and asset criticality ensures identical event types can be triaged differently according to what is at stake, and it gives management a repeatable trigger for its involvement.

Answer

The number of security alerts generated by the detection tooling during the event.

Answer

The elapsed time between the first log entry and the moment the analyst opens the ticket.

Answer

The technical sophistication of the attacker's tools and malware used in the intrusion.

Question 13

During a suspected insider data theft investigation, the incident response team discovers that the suspect's laptop is still powered on and logged in. Legal counsel advises that evidence must be preserved for potential litigation. Which of the following actions should the team take FIRST?

Accepted Answer

Capture volatile data such as memory and network connections, then isolate the system from the network.. Forensic best practice is to capture volatile data before isolating or powering down a live system. Memory, active network connections, and encryption keys can vanish on shutdown or network disconnection, and they may be crucial to proving insider theft. After volatile data is secured, isolating the system prevents remote tampering and further exfiltration while preserving the remaining evidence for legal use.

Answer

Immediately shut down the laptop to prevent the suspect from deleting evidence remotely.

Answer

Disconnect the laptop from the network immediately and begin imaging the hard drive.

Answer

Ask the suspect to remain logged in while the team interviews them about the alleged activity.

Question 14

An organization is defining the composition of its incident response team. Which role is PRIMARILY responsible for coordinating communication with the media and the public during a high-profile incident?

Accepted Answer

The public relations or communications lead.. External communication during a high-profile incident belongs to a designated communications or public relations lead who can align messaging with legal requirements and executive direction. This separation keeps technical responders focused on containment and recovery while ensuring the organization speaks with one consistent voice. Legal counsel reviews for risk, and the incident response manager supplies accurate technical context, but neither owns the media and public communication role.

Answer

The legal counsel.

Answer

The IT operations director.

Answer

The incident response manager.

Question 15

During a suspected intrusion, the incident response team identifies a compromised server that is actively communicating with an external command-and-control address. The security manager must decide the immediate next action while preserving the ability to perform a thorough investigation. Which of the following actions BEST balances containment with evidence preservation?

Accepted Answer

Isolate the server from the network at the switch or host firewall level while keeping it powered on for volatile data collection. The best balance is to contain the system without destroying volatile evidence. Network isolation stops malicious communication and lateral movement while leaving memory, running processes, and active connections intact for collection. Powering off, prolonged passive monitoring, or immediate rebuild each sacrifice either containment or investigative capability, so they fail to meet both requirements simultaneously.

Answer

Immediately power off the server to stop all malicious activity and prevent further data loss

Answer

Rebuild the server from a known-good image immediately to restore service and remove any attacker foothold

Answer

Leave the server online and continue monitoring the command-and-control traffic to gather more intelligence on the attacker