CISM Incident Management Practice Test 3 — 15 Questions

Question 1

An organization's incident response team has identified that a data breach involves customer personal information. Which of the following should be done FIRST to preserve evidence for potential litigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Issue a legal hold to preserve relevant data. Legal hold prevents spoliation of evidence; it must be issued before any remediation that could alter data.

Answer

Notify affected customers

Answer

Begin system restoration from backups

Answer

Conduct a root cause analysis

Question 2

Which TWO of the following are essential components of an incident response plan? (Select two.)

Accepted Answer

Communication templates. Essential components include the IR team roster and contact list, and communication templates for consistent messaging.

Answer

Vendor risk assessment reports

Answer

Network architecture diagrams

Answer

Annual security awareness training schedule

Question 3

Which TWO of the following are key roles on the crisis management team (CMT) for a major cybersecurity incident? (Select two.)

Accepted Answer

Chief Information Security Officer (CISO). The CMT typically includes the CEO and CISO, among others, to make strategic decisions.

Answer

Security analyst

Answer

Help desk manager

Answer

Network administrator

Question 4

Which THREE of the following are incident severity levels defined in a typical incident management program? (Select three.)

Accepted Answer

P3 – Medium. Common severity levels include P1 (critical), P2 (high), P3 (medium), and P4 (low). P0 is not standard; P5 is not used.

Answer

P5 – Low

Answer

P0 – Emergency

Question 5

During a P1 incident, the incident response team identifies that the root cause is a misconfigured firewall. According to best practices, which of the following should be the PRIMARY focus of the root cause analysis?

Accepted Answer

Determining why the firewall was misconfigured and why the change management process failed. Root cause analysis should identify not only the technical cause but also the process and management failures that allowed the misconfiguration to occur.

Answer

Patching the firewall immediately

Answer

Conducting a lessons learned meeting immediately

Answer

Restoring the firewall from backup

Question 6

An organization has experienced a ransomware attack that has encrypted critical servers. The incident response team is unable to contain the incident within the maximum tolerable downtime (MTD). Who has the authority to declare a disaster and activate the business continuity plan?

Accepted Answer

The chief executive officer (CEO) or designated crisis management team. The BC/DR plan typically specifies a designated authority, such as the CEO or a crisis management team, to declare a disaster when MTD is breached.

Answer

The incident response manager

Answer

The business continuity manager

Answer

The chief information security officer (CISO)

Question 7

Which of the following is the PRIMARY purpose of having a pre-established contract with a digital forensics firm before an incident occurs?

Accepted Answer

To reduce the time required to engage the firm during an incident. The primary purpose of a pre-established contract with a digital forensics firm is to eliminate procurement delays during an incident. When an incident occurs, time is critical; having a signed contract in place allows the firm to be engaged immediately without waiting for legal or administrative approvals, which directly supports the incident response goal of minimizing damage and preserving evidence.

Answer

To ensure attorney-client privilege is automatically applied

Answer

To ensure the firm is available 24/7

Answer

To guarantee a discounted rate

Question 8

During a data breach investigation, the incident response team discovers that a backup was encrypted by ransomware. The team needs to determine the sequence of events leading to the encryption. Which of the following documentation is MOST critical to preserve for potential litigation?

Accepted Answer

The chain of custody for the backup media. Chain of custody documentation is essential to prove the integrity and admissibility of digital evidence in court.

Answer

The communication logs between team members

Answer

The forensic tools used in the investigation

Answer

The incident response plan version used during the incident

Question 9

An organization's incident response team has identified that a data breach involves customer personal information. Which of the following should be done FIRST to preserve evidence for potential litigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The type of data that was compromised and steps taken to mitigate. Regulatory notifications must include a description of the incident, data involved, and mitigation steps, while avoiding speculation.

Answer

A detailed timeline of the investigation

Answer

An apology from the CEO

Answer

The name of the employee responsible

Question 10

Following a major security incident, the lessons learned meeting is scheduled. Which of the following outcomes is MOST important to ensure the effectiveness of future incident response?

Accepted Answer

Updating the incident response plan and playbooks based on findings. The primary outcome of a lessons learned meeting is to identify improvements and update the IR plan, not just document or blame.

Answer

Conducting a new risk assessment

Answer

Creating a detailed report for senior management

Answer

Assigning blame to responsible parties

Question 11

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 — Critical incidents, such as a complete system outage or data breach, require immediate executive notification and a 24/7 response because they pose an imminent threat to business operations, legal compliance, or data integrity. This severity level triggers the highest escalation path, often involving the CEO, CISO, and legal counsel, with round-the-clock resource allocation to contain and remediate the issue.

Answer

P3 — Medium

Answer

P4 — Low

Answer

P2 — High

Question 12

During a DDoS attack, the incident response team is struggling to mitigate the attack. The team decides to engage the organization's ISP and a DDoS mitigation service. Which of the following should be done FIRST?

Accepted Answer

Refer to the incident response playbook for DDoS attacks. The IR plan should include pre-established contacts and procedures; contacting the ISP and mitigation service should follow the plan's escalation process.

Answer

Activate the crisis management team

Answer

Notify law enforcement

Answer

Initiate legal hold on all relevant logs

Question 13

An organization is subject to GDPR and experiences a data breach involving personal data. What is the maximum timeframe to notify the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification within 72 hours of becoming aware of the breach.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 14

Following a credential compromise incident, the incident response team is conducting root cause analysis using the 5 Whys technique. The first 'why' reveals that the password was weak. The second 'why' reveals that the password policy allowed simple passwords. What should be the focus of the third 'why'?

Accepted Answer

Why the password policy allowed weak passwords. Root cause analysis should continue to identify why the password policy was not enforced or why it was inadequate, which is a process failure.

Answer

Why the intrusion was not detected earlier

Answer

Why the user had access to the compromised system

Answer

Why the user chose a weak password

Question 15

An incident response team is conducting an exercise to test its playbook for a ransomware incident. Which of the following is the PRIMARY benefit of such an exercise?

Accepted Answer

Validating the incident response plan and identifying areas for improvement. Exercises validate the effectiveness of the plan and identify gaps before a real incident.

Answer

Documenting the exercise for future reference

Answer

Complying with regulatory requirements

Answer

Testing the technical skills of the team