CISM Incident Management Practice Test 3 — 15 Questions

Question 1

An incident response team is handling a P2 (high) incident. According to the incident severity classification, which of the following is the expected response timeframe?

Accepted Answer

Business hours response with management notification. A P2 (high) incident requires a response during business hours with management notification, as defined by the incident severity classification. This ensures that the incident is addressed promptly within operational hours while keeping management informed for potential escalation or resource allocation.

Answer

Standard response with no escalation

Answer

Scheduled remediation

Answer

24/7 response with executive notification

Question 2

An organization is required to notify regulators of a material cybersecurity incident within 4 business days. Which regulation imposes this requirement?

Accepted Answer

SEC proposed rules. The SEC's proposed rules (now final) require publicly traded companies to report material cybersecurity incidents on Form 8-K within 4 business days of determining materiality. This is a specific U.S. securities regulation, not a privacy or payment card standard, and it directly mandates the 4-business-day notification window for material incidents.

Answer

California Consumer Privacy Act (CCPA)

Answer

GDPR

Answer

PCI DSS

Question 3

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 – Critical. A P1 – Critical incident is the highest severity level, reserved for incidents that cause severe business impact such as major outages, data breaches, or safety issues. By definition, P1 incidents require immediate 24/7 response and escalation to executive leadership because they threaten the organisation's operations or reputation. This matches the question's requirement exactly.

Answer

P3 – Medium

Answer

P4 – Low

Answer

P2 – High

Question 4

Which TWO of the following are components of an incident response programme?

Accepted Answer

Incident response plan. An incident response programme is built on two foundational governance documents: the incident response policy (E) and the incident response plan (A). The incident response policy (E) is correct because it is the high-level management directive that establishes the organisation's commitment, authority, scope, and objectives for responding to security incidents. The incident response plan (A) is correct because it is the detailed operational document that translates the policy into specific procedures, roles, communication paths, and steps for detecting, containing, eradicating, and recovering from incidents. Vendor contracts (B) are procurement/legal artefacts that may support response (e.g., SLAs or IR retainer agreements) but are not themselves components of the IR programme. Risk assessment (C) and business impact analysis (D) are inputs that inform the programme — helping prioritise assets and define criticality — but they belong to the broader risk management and business continuity disciplines, not to the incident response programme's core components.

Answer

Vendor contracts

Answer

Risk assessment

Answer

Business impact analysis (BIA)

Question 5

Which TWO of the following are incident categories in an incident management programme?

Accepted Answer

Insider threat. Insider threat (A) is a valid incident category because it classifies incidents by the actor/source — a trusted internal person (employee, contractor, or partner) who misuses authorized access, whether maliciously or accidentally — which is a standard way incident management programmes bucket and route incidents. Ransomware (C) is also a valid incident category because it classifies incidents by the type of malicious software/attack — malware that encrypts data and demands payment — and is commonly tracked as its own category due to its distinct response and escalation path. Theft (B) is not a category in this scheme; it is a specific event or loss type rather than a recognized incident classification. Vulnerability (D) is not an incident category because a vulnerability is a weakness that may be exploited, not an incident itself. Phishing (E) is not a category here; it is a specific attack technique/delivery method rather than a top-level incident category.

Answer

Theft

Answer

Vulnerability

Answer

Phishing

Question 6

An organization is reviewing its incident response capabilities after a tabletop exercise exposed gaps in escalation and evidence handling. Which TWO activities should be included in the post-incident lessons learned process to improve future response? (Choose two.)

Accepted Answer

Documenting the incident timeline and the decisions made by responders.. Effective lessons learned processes rely on a documented timeline and decision record plus corrective actions that are assigned, tracked, and verified. Together these convert exercise or incident findings into measurable improvements in escalation, evidence handling, and coordination. Destroying evidence, making uncontrolled public disclosures, or wholesale team replacement are not constructive lessons learned activities and can introduce legal, operational, and continuity risks.

Answer

Replacing the entire incident response team to ensure fresh perspectives.

Answer

Publicly disclosing the full details of the incident to deter future attackers.

Answer

Deleting forensic evidence once the incident is closed to reduce storage costs.

Question 7

An organization's incident response (IR) policy should be approved by which of the following to ensure authority and accountability?

Accepted Answer

The board of directors or executive management. The IR policy requires senior management approval to demonstrate organizational commitment and allocate necessary resources.

Answer

The incident response manager

Answer

The legal counsel

Answer

The IT director

Question 8

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is unable to restore operations within the maximum tolerable downtime (MTD). Which action should be taken next?

Accepted Answer

Escalate to activate the business continuity/disaster recovery plan. When an incident cannot be resolved within MTD, it escalates to business continuity/disaster recovery activation to restore operations.

Answer

Notify law enforcement

Answer

Increase the ransom payment

Answer

Engage the forensics firm to preserve evidence

Question 9

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have major business impact and require immediate executive notification and round-the-clock response.

Answer

P2 — High

Answer

P3 — Medium

Answer

P4 — Low

Question 10

Following a data breach, an organization conducts a root cause analysis using the 5 Whys technique. The analysis identifies that a misconfigured firewall allowed unauthorized access. What is the most important next step to prevent recurrence?

Accepted Answer

Implement a change management process to prevent unauthorized configuration changes. Root cause analysis should uncover not just technical causes but also the process and governance failures that allowed the misconfiguration. Addressing the management failure (e.g., inadequate change management) provides a systemic fix.

Answer

Update the firewall rule base immediately

Answer

Conduct a vulnerability scan on all firewalls

Answer

Disconnect the firewall from the network

Question 11

An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?

Accepted Answer

Credential compromise playbook. Credential compromise incidents, such as account takeover via phishing, are handled by the credential compromise playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 12

Which of the following is typically a member of the crisis management team (CMT) during a major cybersecurity incident?

Accepted Answer

Chief executive officer (CEO). The CMT includes senior leaders such as the CEO, CFO, CISO, General Counsel, and Communications head to handle strategic decisions and external communications.

Answer

Security operations center (SOC) analyst

Answer

Help desk manager

Answer

External forensics investigator

Question 13

As part of post-incident activities, an organization schedules a lessons learned meeting. When should this meeting ideally take place?

Accepted Answer

Within 2 weeks of incident resolution. Lessons learned meetings should occur within two weeks of incident resolution while details are fresh, to capture accurate feedback and improve the IR plan.

Answer

At the next quarterly board meeting

Answer

Immediately after the incident is detected

Answer

Only after all legal proceedings are concluded

Question 14

During a data breach investigation, legal counsel instructs the forensics team to preserve evidence under attorney-client privilege. Which of the following actions is most critical to maintain that privilege?

Accepted Answer

Limit distribution of forensic reports to individuals with a need-to-know and under legal direction. To maintain attorney-client privilege during a data breach investigation, it is critical to limit distribution of forensic reports to individuals with a need-to-know and under legal direction. This preserves confidentiality, which is essential for privilege to apply. Uncontrolled distribution can waive privilege, exposing sensitive information to discovery.

Answer

Use a separate, isolated network for forensic analysis

Answer

Encrypt all forensic images with a strong algorithm

Answer

Destroy all preliminary notes after the final report is issued

Question 15

An organization is updating its incident response playbook after a ransomware attack. Which of the following should be included as a key step in the ransomware playbook?

Accepted Answer

Isolate affected systems from the network. Ransomware playbooks should include isolating infected systems to prevent spread, as containment is a priority.

Answer

Reboot all servers to clear the ransomware

Answer

Immediately pay the ransom demand

Answer

Notify all customers immediately