CISM Incident Management Practice Test 2 — 15 Questions

Question 1

After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Supply chain. Supply chain incidents involve attacks through third-party vendors or partners, even if the initial vector is credential compromise.

Answer

Insider threat

Answer

Account compromise

Answer

DDoS

Question 2

Which TWO of the following are essential components of an incident response programme?

Accepted Answer

Incident response plan. An IR programme must include a formal policy and a documented plan. Playbooks are also important but the core components are policy and plan.

Answer

Annual penetration test

Answer

Vulnerability scanning schedule

Answer

Security awareness training

Question 3

Which THREE of the following should be included in an incident communication template?

Accepted Answer

Affected systems or data. Communication templates should include the incident description, affected parties, and guidance on actions to take. Technical details and attacker attribution are not typically included in templates.

Answer

Technical indicators of compromise (IoCs)

Answer

Attribution of the attacker

Question 4

Which TWO of the following are appropriate actions for preserving evidence during a cybersecurity incident?

Accepted Answer

Create forensic bit-for-bit images of affected systems. Preserving evidence includes creating forensic images and issuing legal holds to prevent spoliation. Disconnecting systems without imaging and rebooting can destroy evidence.

Answer

Reboot systems to capture volatile memory

Answer

Disconnect affected systems from the network immediately

Answer

Delete temporary files to free up space

Question 5

During a major security incident classified as P1, which of the following is the MOST appropriate communication frequency to the executive team?

Accepted Answer

Hourly situation reports (sitreps). For P1 (critical) incidents, hourly situation reports (sitreps) are expected to keep executives informed of rapidly evolving events.

Answer

Daily summary reports

Answer

Only upon significant changes

Answer

At the end of the incident

Question 6

An organization's incident response team has contained a ransomware incident. What is the NEXT step according to the incident management program?

Accepted Answer

Eradicate the malware and restore systems. After containment, the next priority is eradication of the threat to remove all traces of the malware and restore systems securely.

Answer

Perform root cause analysis

Answer

Conduct a lessons learned meeting

Answer

Notify regulatory authorities

Question 7

An organization has just experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of the breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 8

Which of the following is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a step-by-step guide for responding to incidents. The IR plan provides a structured approach to manage incidents, minimizing impact and ensuring efficient response.

Answer

To document vendor contacts only

Answer

To assign blame for security failures

Answer

To replace the need for incident response training

Question 9

During a DDoS attack classified as P2, what is the EXPECTED response time and notification level?

Accepted Answer

Business hours response; management notification. P2 incidents require management notification and a response during business hours.

Answer

Standard response; team lead notification

Answer

24/7 response; executive notification

Answer

Scheduled remediation; email notification

Question 10

An organization is conducting a root cause analysis after an insider threat incident. Which of the following tools is MOST appropriate for identifying the underlying management governance failure?

Accepted Answer

5 Whys. The 5 Whys technique is a simple but effective method to drill down from technical cause to process failure to management failure.

Answer

Risk assessment

Answer

SWOT analysis

Answer

Gap analysis

Question 11

When should an incident response transition to business continuity and disaster recovery (BC/DR) activation?

Accepted Answer

When the incident cannot be resolved within the maximum tolerable downtime (MTD). BC/DR is activated when the incident cannot be resolved within the maximum tolerable downtime (MTD).

Answer

Immediately upon detection of any incident

Answer

Only after the incident is fully contained

Answer

When the incident exceeds the recovery time objective (RTO) but is still within MTD

Question 12

Which of the following is the FIRST step when engaging an external forensics firm for an incident?

Accepted Answer

Activate the forensic retainer agreement. Having a pre-existing retainer agreement reduces time to engage and ensures terms are already in place.

Answer

Provide evidence to the firm

Answer

Define the scope of work

Answer

Sign a non-disclosure agreement

Question 13

An organization has experienced a credential compromise incident. Which playbook should the incident response team primarily use?

Accepted Answer

Credential compromise playbook. Playbooks are tailored to incident types; credential compromise has its own specific playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 14

During a major incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the communications lead on the CMT?

Accepted Answer

Coordinating all external and internal communications. The communications lead manages external and internal messaging, including media and customer notifications.

Answer

Authorizing financial expenditures for incident response

Answer

Directing technical containment efforts

Answer

Preserving digital evidence for litigation

Question 15

What is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Accepted Answer

To update the incident response plan and procedures. Lessons learned aims to improve future response by identifying what worked and what didn't.

Answer

To determine if legal action is needed

Answer

To calculate the financial impact of the incident

Answer

To assign disciplinary actions