CISM Incident Management Practice Test 4 — 15 Questions

Question 1

During a major cybersecurity incident classified as P1, the incident response team has been activated. The crisis management team (CMT) is also convened. Which of the following is the PRIMARY responsibility of the CMT during this incident?

Accepted Answer

Making strategic decisions, managing communications, and allocating resources.. The CMT handles strategic decisions, communication, and resource allocation, while the IR team focuses on technical response.

Answer

Notifying law enforcement and regulatory bodies immediately.

Answer

Directly managing the technical containment and eradication of the threat.

Answer

Performing forensic analysis to identify the root cause of the incident.

Question 2

An organization's incident response plan includes a ransomware playbook. After detecting ransomware on a critical server, which of the following should be the FIRST action according to best practices?

Accepted Answer

Disconnect the server from the network and isolate it.. Option B is correct because the immediate priority in ransomware containment is to prevent lateral movement and further encryption of systems. Disconnecting the server from the network (e.g., unplugging the Ethernet cable or disabling the virtual switch port) stops the ransomware from communicating with its command-and-control (C2) server and encrypting additional network shares. This aligns with the NIST SP 800-61 incident response containment strategy, which emphasizes isolation before any other action.

Answer

Notify the CEO and legal counsel before taking any action.

Answer

Pay the ransom immediately to regain access.

Answer

Immediately reboot the server to remove the ransomware.

Question 3

During a post-incident root cause analysis, the team uses the '5 Whys' technique and identifies a technical vulnerability as the cause. According to CISM best practices, what should be the NEXT level of analysis?

Accepted Answer

Determine the process failure that allowed the vulnerability to go unaddressed.. The '5 Whys' should drill deeper to uncover process and management failures that allowed the technical vulnerability to exist.

Answer

Immediately patch the vulnerability and move on.

Answer

Escalate the issue to the vendor for a software fix.

Answer

Identify the specific employee responsible for the vulnerability.

Question 4

An incident has been declared as P2 (high severity). According to the incident classification, what is the expected response timeframe and notification requirement?

Accepted Answer

Management notification and response during business hours.. P2 incidents require management notification and response during business hours.

Answer

Scheduled remediation with minimal notification.

Answer

Standard response with no specific notification.

Answer

Executive notification and 24/7 response.

Question 5

In the context of incident management, which of the following is the PRIMARY purpose of conducting lessons learned meetings within two weeks of incident resolution?

Accepted Answer

To update the incident response plan and playbooks based on findings.. The main goal is to improve future incident response by identifying what worked and what didn't.

Answer

To provide a final report to regulators and law enforcement.

Answer

To assign blame for the incident and take disciplinary action.

Answer

To calculate the total financial loss from the incident.

Question 6

During a data breach investigation, an organization engages an external forensics firm. To preserve attorney-client privilege, which of the following is the BEST practice?

Accepted Answer

Engage the forensics firm under the direction of legal counsel.. Engaging the forensics firm under the direction of legal counsel is the best practice because it extends attorney-client privilege to the investigation. When counsel directs the work, communications and findings are protected as work product, preventing disclosure in litigation. This is a foundational principle in incident response legal strategy.

Answer

Have the forensics firm work independently to maintain objectivity.

Answer

Ensure the forensics firm signs a non-disclosure agreement only.

Answer

Have the forensics firm report directly to the CISO.

Question 7

What is the PRIMARY reason for having an incident response team roster and contact list readily available?

Accepted Answer

To enable quick activation of the incident response team.. Rapid activation of the IR team depends on knowing who to contact and their backup.

Answer

To satisfy regulatory compliance requirements.

Answer

To ensure all team members have the necessary training.

Answer

To provide a list for auditors to review.

Question 8

After a DDoS attack, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). According to best practices, what should happen next?

Accepted Answer

Escalate to the business continuity and disaster recovery teams.. If MTD cannot be met, business continuity or disaster recovery plans should be activated.

Answer

Notify customers and shut down operations.

Answer

Continue current response efforts and hope for the best.

Answer

Declare the incident as a disaster immediately without further analysis.

Question 9

An organization is required to report a material cybersecurity incident to the SEC within 4 business days (proposed rule). However, the incident is still under investigation. What is the BEST course of action?

Accepted Answer

File a report with the information available and provide updates as the investigation progresses.. Regulatory deadlines must be met even if information is incomplete; disclose what is known and update later.

Answer

Request an extension from the SEC because the investigation is ongoing.

Answer

Delay reporting until the investigation is complete to ensure accuracy.

Answer

Report the incident only if materiality is confirmed at the end of the investigation.

Question 10

Which of the following incident types is MOST likely to require activation of the crisis management team (CMT) due to potential regulatory and reputational impact?

Accepted Answer

A P1 data breach involving customer personally identifiable information (PII).. A P1 data breach involving customer PII triggers mandatory breach notification laws (e.g., GDPR Article 33, HIPAA Breach Notification Rule) and often requires immediate CMT activation to manage regulatory filings, legal liability, and public relations. The CMT is designed for high-severity incidents with significant business, legal, or reputational consequences, which a P1 breach directly entails.

Answer

A P2 denial-of-service attack that is quickly mitigated.

Answer

A P4 phishing email reported by a user.

Answer

A P3 insider threat involving an employee accessing unauthorized files.

Question 11

In the incident response team structure, who is typically responsible for coordinating communication with external stakeholders such as customers and the media?

Accepted Answer

Communications lead. The communications lead handles external messaging to ensure consistency and accuracy.

Answer

Legal counsel

Answer

Incident response manager

Answer

Executive sponsor

Question 12

An organization maintains evidence handling procedures for incident response. A forensic investigator needs to collect a hard drive from a compromised server. Which of the following is the MOST critical step to ensure admissibility in court?

Accepted Answer

Documenting the chain of custody from the moment of collection.. Chain of custody documentation is essential for evidence integrity and admissibility.

Answer

Encrypting the hard drive during transport.

Answer

Creating a forensic image of the hard drive before disconnecting it.

Answer

Ensuring the investigator has the proper certification.

Question 13

An organization is updating its incident response plan. Which TWO components are essential to include for effective insider threat management? (Select TWO.)

Accepted Answer

Procedures for coordinating with human resources and legal departments.. Insider threats require specific playbooks and involvement of HR and legal for proper handling.

Answer

A dedicated ransomware recovery procedure.

Answer

A list of all employee passwords for investigation purposes.

Answer

Contact information for the DDoS mitigation service provider.

Question 14

After a data breach involving customer PII, the incident response team is conducting a root cause analysis. Which THREE factors should be examined according to CISM best practices? (Select THREE.)

Accepted Answer

The management or governance failure that allowed the process failure.. Root cause analysis should identify technical, process, and management failures.

Answer

The cost of the breach to the organization.

Answer

The specific employee who clicked the phishing email.

Question 15

An organization is preparing for a potential supply chain incident. According to CISM best practices, which THREE elements should be included in the supply chain incident playbook? (Select THREE.)

Accepted Answer

Procedures for isolating affected systems and networks.. Supply chain incidents require specific procedures for vendor coordination, technical response, and communication.

Answer

A step-by-step guide for paying ransoms to cybercriminals.

Answer

A list of approved vendors for DDoS mitigation services.