CISM Incident Management Practice Test 4 — 15 Questions

Question 1

During a P1 incident, the incident response manager is preparing an executive sitrep. Which of the following should be included to preserve legal privilege?

Accepted Answer

A statement that the sitrep is prepared under the direction of legal counsel. Involving legal counsel in communications can help preserve attorney-client privilege. The sitrep should avoid speculation and include legal counsel input.

Answer

An estimated financial impact

Answer

A detailed technical analysis of the attack vector

Answer

Names of the individuals involved in the response

Question 2

An organization is updating its incident response plan. Which TWO components should be included to ensure effective evidence handling? (Select TWO.)

Accepted Answer

Evidence handling procedures. Evidence handling procedures and chain of custody documentation are essential for preserving evidence integrity.

Answer

A template for incident notifications

Answer

Contact information for law enforcement

Answer

A list of acceptable forensic tools

Question 3

During a major cybersecurity incident, the crisis management team (CMT) is activated. Which THREE roles are typically part of the CMT? (Select THREE.)

Accepted Answer

Chief executive officer (CEO). The CEO is correct because as the highest-ranking executive, they provide strategic direction, authorize critical decisions (e.g., public disclosure, resource allocation), and serve as the primary liaison to the board of directors during a major incident. The GC is correct because they manage legal risks, ensure compliance with breach notification laws (e.g., GDPR, CCPA), and oversee communications with regulators and law enforcement. The CFO is correct because they assess financial impacts, approve emergency budgets, and coordinate with insurance carriers for cyber liability claims.

Answer

Security analyst

Answer

Incident response manager

Question 4

An incident response team is creating playbooks for different incident types. Which TWO incident types should have a dedicated playbook? (Select TWO.)

Accepted Answer

Ransomware. Ransomware and data breach are common incident types that require specific procedures.

Answer

Password expiration

Answer

Software update failure

Answer

Phishing simulation

Question 5

During a major cybersecurity incident classified as P1, the incident response team has been activated. The crisis management team (CMT) is also convened. Which of the following is the PRIMARY responsibility of the CMT during this incident?

Accepted Answer

Making strategic decisions, managing communications, and allocating resources.. The CMT handles strategic decisions, communication, and resource allocation, while the IR team focuses on technical response.

Answer

Notifying law enforcement and regulatory bodies immediately.

Answer

Directly managing the technical containment and eradication of the threat.

Answer

Performing forensic analysis to identify the root cause of the incident.

Question 6

An organization's incident response plan includes a ransomware playbook. After detecting ransomware on a critical server, which of the following should be the FIRST action according to best practices?

Accepted Answer

Disconnect the server from the network and isolate it.. The immediate priority in ransomware containment is to prevent lateral movement and further encryption of systems. Disconnecting the server from the network (e.g., unplugging the Ethernet cable or disabling the virtual switch port) stops the ransomware from communicating with its command-and-control (C2) server and encrypting additional network shares. This aligns with the NIST SP 800-61 incident response containment strategy, which emphasizes isolation before any other action.

Answer

Notify the CEO and legal counsel before taking any action.

Answer

Pay the ransom immediately to regain access.

Answer

Immediately reboot the server to remove the ransomware.

Question 7

During a post-incident root cause analysis, the team uses the '5 Whys' technique and identifies a technical vulnerability as the cause. According to CISM best practices, what should be the NEXT level of analysis?

Accepted Answer

Determine the process failure that allowed the vulnerability to go unaddressed.. The '5 Whys' should drill deeper to uncover process and management failures that allowed the technical vulnerability to exist.

Answer

Immediately patch the vulnerability and move on.

Answer

Escalate the issue to the vendor for a software fix.

Answer

Identify the specific employee responsible for the vulnerability.

Question 8

An incident has been declared as P2 (high severity). According to the incident classification, what is the expected response timeframe and notification requirement?

Accepted Answer

Management notification and response during business hours.. P2 incidents require management notification and response during business hours.

Answer

Scheduled remediation with minimal notification.

Answer

Standard response with no specific notification.

Answer

Executive notification and 24/7 response.

Question 9

In the context of incident management, which of the following is the PRIMARY purpose of conducting lessons learned meetings within two weeks of incident resolution?

Accepted Answer

To update the incident response plan and playbooks based on findings.. The main goal is to improve future incident response by identifying what worked and what didn't.

Answer

To provide a final report to regulators and law enforcement.

Answer

To assign blame for the incident and take disciplinary action.

Answer

To calculate the total financial loss from the incident.

Question 10

During a data breach investigation, an organization engages an external forensics firm. To preserve attorney-client privilege, which of the following is the BEST practice?

Accepted Answer

Engage the forensics firm under the direction of legal counsel.. Engaging the forensics firm under the direction of legal counsel is the best practice because it extends attorney-client privilege to the investigation. When counsel directs the work, communications and findings are protected as work product, preventing disclosure in litigation. This is a foundational principle in incident response legal strategy.

Answer

Have the forensics firm work independently to maintain objectivity.

Answer

Ensure the forensics firm signs a non-disclosure agreement only.

Answer

Have the forensics firm report directly to the CISO.

Question 11

What is the PRIMARY reason for having an incident response team roster and contact list readily available?

Accepted Answer

To enable quick activation of the incident response team.. Rapid activation of the IR team depends on knowing who to contact and their backup.

Answer

To satisfy regulatory compliance requirements.

Answer

To ensure all team members have the necessary training.

Answer

To provide a list for auditors to review.

Question 12

After a DDoS attack, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). According to best practices, what should happen next?

Accepted Answer

Escalate to the business continuity and disaster recovery teams.. If MTD cannot be met, business continuity or disaster recovery plans should be activated.

Answer

Notify customers and shut down operations.

Answer

Continue current response efforts and hope for the best.

Answer

Declare the incident as a disaster immediately without further analysis.

Question 13

An organization is required to report a material cybersecurity incident to the SEC within 4 business days (proposed rule). However, the incident is still under investigation. What is the BEST course of action?

Accepted Answer

File a report with the information available and provide updates as the investigation progresses.. Regulatory deadlines must be met even if information is incomplete; disclose what is known and update later.

Answer

Request an extension from the SEC because the investigation is ongoing.

Answer

Delay reporting until the investigation is complete to ensure accuracy.

Answer

Report the incident only if materiality is confirmed at the end of the investigation.

Question 14

Which of the following incident types is MOST likely to require activation of the crisis management team (CMT) due to potential regulatory and reputational impact?

Accepted Answer

A P1 data breach involving customer personally identifiable information (PII).. A P1 data breach involving customer PII triggers mandatory breach notification laws (e.g., GDPR Article 33, HIPAA Breach Notification Rule) and often requires immediate CMT activation to manage regulatory filings, legal liability, and public relations. The CMT is designed for high-severity incidents with significant business, legal, or reputational consequences, which a P1 breach directly entails.

Answer

A P2 denial-of-service attack that is quickly mitigated.

Answer

A P4 phishing email reported by a user.

Answer

A P3 insider threat involving an employee accessing unauthorized files.

Question 15

In the incident response team structure, who is typically responsible for coordinating communication with external stakeholders such as customers and the media?

Accepted Answer

Communications lead. The communications lead handles external messaging to ensure consistency and accuracy.

Answer

Legal counsel

Answer

Incident response manager

Answer

Executive sponsor