CISM Incident Management Practice Test 3 — 15 Questions

Question 1

During a P1 incident, the incident response team identifies that the root cause is a misconfigured firewall. According to best practices, which of the following should be the PRIMARY focus of the root cause analysis?

Accepted Answer

Determining why the firewall was misconfigured and why the change management process failed. Root cause analysis should identify not only the technical cause but also the process and management failures that allowed the misconfiguration to occur.

Answer

Patching the firewall immediately

Answer

Conducting a lessons learned meeting immediately

Answer

Restoring the firewall from backup

Question 2

An organization has experienced a ransomware attack that has encrypted critical servers. The incident response team is unable to contain the incident within the maximum tolerable downtime (MTD). Who has the authority to declare a disaster and activate the business continuity plan?

Accepted Answer

The chief executive officer (CEO) or designated crisis management team. The BC/DR plan typically specifies a designated authority, such as the CEO or a crisis management team, to declare a disaster when MTD is breached.

Answer

The incident response manager

Answer

The business continuity manager

Answer

The chief information security officer (CISO)

Question 3

Which of the following is the PRIMARY purpose of having a pre-established contract with a digital forensics firm before an incident occurs?

Accepted Answer

To reduce the time required to engage the firm during an incident. The primary purpose of a pre-established contract with a digital forensics firm is to eliminate procurement delays during an incident. When an incident occurs, time is critical; having a signed contract in place allows the firm to be engaged immediately without waiting for legal or administrative approvals, which directly supports the incident response goal of minimizing damage and preserving evidence.

Answer

To ensure attorney-client privilege is automatically applied

Answer

To ensure the firm is available 24/7

Answer

To guarantee a discounted rate

Question 4

During a data breach investigation, the incident response team discovers that a backup was encrypted by ransomware. The team needs to determine the sequence of events leading to the encryption. Which of the following documentation is MOST critical to preserve for potential litigation?

Accepted Answer

The chain of custody for the backup media. Chain of custody documentation is essential to prove the integrity and admissibility of digital evidence in court.

Answer

The communication logs between team members

Answer

The forensic tools used in the investigation

Answer

The incident response plan version used during the incident

Question 5

An organization's incident response team is handling a P2 incident involving an insider threat. The team has identified the employee responsible. The communications lead is preparing a notification to affected parties. Which of the following should be included in the notification?

Accepted Answer

The type of data that was compromised and steps taken to mitigate. Regulatory notifications must include a description of the incident, data involved, and mitigation steps, while avoiding speculation.

Answer

A detailed timeline of the investigation

Answer

An apology from the CEO

Answer

The name of the employee responsible

Question 6

Following a major security incident, the lessons learned meeting is scheduled. Which of the following outcomes is MOST important to ensure the effectiveness of future incident response?

Accepted Answer

Updating the incident response plan and playbooks based on findings. The primary outcome of a lessons learned meeting is to identify improvements and update the IR plan, not just document or blame.

Answer

Conducting a new risk assessment

Answer

Creating a detailed report for senior management

Answer

Assigning blame to responsible parties

Question 7

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 — Critical incidents, such as a complete system outage or data breach, require immediate executive notification and a 24/7 response because they pose an imminent threat to business operations, legal compliance, or data integrity. This severity level triggers the highest escalation path, often involving the CEO, CISO, and legal counsel, with round-the-clock resource allocation to contain and remediate the issue.

Answer

P3 — Medium

Answer

P4 — Low

Answer

P2 — High

Question 8

During a DDoS attack, the incident response team is struggling to mitigate the attack. The team decides to engage the organization's ISP and a DDoS mitigation service. Which of the following should be done FIRST?

Accepted Answer

Refer to the incident response playbook for DDoS attacks. The IR plan should include pre-established contacts and procedures; contacting the ISP and mitigation service should follow the plan's escalation process.

Answer

Activate the crisis management team

Answer

Notify law enforcement

Answer

Initiate legal hold on all relevant logs

Question 9

An organization is subject to GDPR and experiences a data breach involving personal data. What is the maximum timeframe to notify the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification within 72 hours of becoming aware of the breach.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 10

Following a credential compromise incident, the incident response team is conducting root cause analysis using the 5 Whys technique. The first 'why' reveals that the password was weak. The second 'why' reveals that the password policy allowed simple passwords. What should be the focus of the third 'why'?

Accepted Answer

Why the password policy allowed weak passwords. Root cause analysis should continue to identify why the password policy was not enforced or why it was inadequate, which is a process failure.

Answer

Why the intrusion was not detected earlier

Answer

Why the user had access to the compromised system

Answer

Why the user chose a weak password

Question 11

An incident response team is conducting an exercise to test its playbook for a ransomware incident. Which of the following is the PRIMARY benefit of such an exercise?

Accepted Answer

Validating the incident response plan and identifying areas for improvement. Exercises validate the effectiveness of the plan and identify gaps before a real incident.

Answer

Documenting the exercise for future reference

Answer

Complying with regulatory requirements

Answer

Testing the technical skills of the team

Question 12

During a P1 incident, the incident response manager is preparing an executive sitrep. Which of the following should be included to preserve legal privilege?

Accepted Answer

A statement that the sitrep is prepared under the direction of legal counsel. Involving legal counsel in communications can help preserve attorney-client privilege. The sitrep should avoid speculation and include legal counsel input.

Answer

An estimated financial impact

Answer

A detailed technical analysis of the attack vector

Answer

Names of the individuals involved in the response

Question 13

An organization is updating its incident response plan. Which TWO components should be included to ensure effective evidence handling? (Select TWO.)

Accepted Answer

Evidence handling procedures. Evidence handling procedures and chain of custody documentation are essential for preserving evidence integrity.

Answer

A template for incident notifications

Answer

Contact information for law enforcement

Answer

A list of acceptable forensic tools

Question 14

During a major cybersecurity incident, the crisis management team (CMT) is activated. Which THREE roles are typically part of the CMT? (Select THREE.)

Accepted Answer

Chief executive officer (CEO). The CEO is correct because as the highest-ranking executive, they provide strategic direction, authorize critical decisions (e.g., public disclosure, resource allocation), and serve as the primary liaison to the board of directors during a major incident. The GC is correct because they manage legal risks, ensure compliance with breach notification laws (e.g., GDPR, CCPA), and oversee communications with regulators and law enforcement. The CFO is correct because they assess financial impacts, approve emergency budgets, and coordinate with insurance carriers for cyber liability claims.

Answer

Security analyst

Answer

Incident response manager

Question 15

An incident response team is creating playbooks for different incident types. Which TWO incident types should have a dedicated playbook? (Select TWO.)

Accepted Answer

Ransomware. Ransomware and data breach are common incident types that require specific procedures.

Answer

Password expiration

Answer

Software update failure

Answer

Phishing simulation