CISM Incident Management Practice Test 4 — 15 Questions

Question 1

Which of the following is the primary purpose of having a pre-established forensic retainer agreement?

Accepted Answer

To reduce the time required to engage external forensics during an incident. A pre-established retainer reduces the time to engage a forensics firm during an incident, ensuring rapid response.

Answer

To ensure the forensics firm is certified

Answer

To guarantee the lowest price for forensic services

Answer

To comply with regulatory requirements

Question 2

Which TWO of the following are essential components of an incident response programme?

Accepted Answer

Incident response plan. An incident response plan (A) is essential because it defines the documented, step-by-step procedures, roles, communication paths, and escalation criteria that guide the team through detecting, containing, eradicating, and recovering from a security incident. An incident response policy (B) is equally essential because it is the governing document that establishes the organization's mandate, scope, objectives, authority, and management commitment for incident handling, which the plan then implements. Together, the policy provides the 'why and who' while the plan provides the 'how and when,' forming the foundational pair of any incident response programme. By contrast, an annual penetration test (C) and a vulnerability scanning schedule (D) are proactive vulnerability-management activities that feed the programme but are not core structural components of it, and security awareness training (E) is a preventive control that supports the programme rather than constituting an essential incident response component.

Answer

Annual penetration test

Answer

Vulnerability scanning schedule

Answer

Security awareness training

Question 3

Which THREE of the following should be included in an incident communication template?

Accepted Answer

Affected systems or data. Option A (Affected systems or data) is correct because an incident communication template must clearly identify the scope of impact—which systems, services, or data sets are involved—so recipients understand what is at risk and can prioritize their response. Option B (Description of the incident) is correct because the template needs a concise, accurate summary of what happened (e.g., type of incident, time of detection, current status) to give recipients the context required to act appropriately. Option C (Actions to be taken by recipients) is correct because the primary purpose of incident communications is to direct the audience—users, IT staff, or stakeholders—on specific steps such as disconnecting from the network, resetting passwords, or awaiting further instructions. Option D (Technical indicators of compromise) is not included because IoCs such as IP addresses, hashes, and domain names belong in threat intelligence or technical investigation reports, not in a general communication template intended for broad audiences. Option E (Attribution of the attacker) is not included because attribution is typically uncertain, sensitive, and often irrelevant to the immediate protective actions recipients must take, making it inappropriate for a standard incident communication template.

Answer

Technical indicators of compromise (IoCs)

Answer

Attribution of the attacker

Question 4

Which TWO of the following are appropriate actions for preserving evidence during a cybersecurity incident?

Accepted Answer

Create forensic bit-for-bit images of affected systems. Option B is correct because creating a forensic bit-for-bit image preserves an exact, verifiable copy of the affected system's storage, including slack space and deleted-file remnants, so analysis can be performed on the copy without altering the original evidence. Option C is correct because a legal hold formally suspends normal data-retention and deletion practices, ensuring that logs, emails, and other potentially relevant records are not destroyed and remain admissible. Option A is wrong because rebooting destroys volatile memory (RAM, cache, running processes) rather than capturing it; live memory acquisition must be done before any shutdown. Option D is wrong as a blanket evidence-preservation step because pulling the plug can destroy volatile evidence and is a containment action, not a forensic preservation action. Option E is wrong because deleting temporary files spoliates potential evidence and violates the duty to preserve relevant data.

Answer

Reboot systems to capture volatile memory

Answer

Disconnect affected systems from the network immediately

Answer

Delete temporary files to free up space

Question 5

An organization's incident response team has contained a ransomware incident. What is the NEXT step according to the incident management program?

Accepted Answer

Eradicate the malware and restore systems. After containment, the next priority is eradication of the threat to remove all traces of the malware and restore systems securely.

Answer

Perform root cause analysis

Answer

Conduct a lessons learned meeting

Answer

Notify regulatory authorities

Question 6

An organization has just experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of the breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 7

An organization is conducting a root cause analysis after an insider threat incident. Which of the following tools is MOST appropriate for identifying the underlying management governance failure?

Accepted Answer

5 Whys. The 5 Whys technique is a simple but effective method to drill down from technical cause to process failure to management failure.

Answer

Risk assessment

Answer

SWOT analysis

Answer

Gap analysis

Question 8

An organization has experienced a credential compromise incident. Which playbook should the incident response team primarily use?

Accepted Answer

Credential compromise playbook. Playbooks are tailored to incident types; credential compromise has its own specific playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 9

During a major incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the communications lead on the CMT?

Accepted Answer

Coordinating all external and internal communications. The communications lead on a Crisis Management Team (CMT) is specifically designated to own the communications function during an incident — both internal (employees, executives, board) and external (customers, media, regulators, law enforcement). This role ensures a single, consistent, approved message is delivered to all stakeholders, preventing conflicting or premature disclosures that could escalate reputational and legal exposure.

Answer

Authorizing financial expenditures for incident response

Answer

Directing technical containment efforts

Answer

Preserving digital evidence for litigation

Question 10

What is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Accepted Answer

To update the incident response plan and procedures. Lessons learned aims to improve future response by identifying what worked and what didn't.

Answer

To determine if legal action is needed

Answer

To calculate the financial impact of the incident

Answer

To assign disciplinary actions

Question 11

An organization's incident response team has identified that a data breach involves customer personal information. Which of the following should be done FIRST to preserve evidence for potential litigation?

Accepted Answer

Issue a legal hold to preserve relevant data. Legal hold prevents spoliation of evidence; it must be issued before any remediation that could alter data.

Answer

Notify affected customers

Answer

Begin system restoration from backups

Answer

Conduct a root cause analysis

Question 12

Which TWO of the following are essential components of an incident response plan? (Select two.)

Accepted Answer

Communication templates. Option A (Communication templates) is correct because an incident response plan must include pre-approved notification templates for internal stakeholders, customers, regulators, and media so that accurate, consistent messaging can be delivered quickly during a live incident without drafting communications under pressure. Option C (IR team roster and contact list) is correct because the plan must identify who is on the incident response team, their roles (e.g., incident commander, forensics lead, communications lead), and up-to-date 24/7 contact details so the team can be assembled immediately when an incident is declared. The remaining options are supporting or program-level artifacts rather than essential plan components: vendor risk assessment reports (B) belong to third-party risk management, network architecture diagrams (D) are useful reference documentation but not a required element of the plan itself, and an annual security awareness training schedule (E) is part of the broader security awareness program, not the incident response plan.

Answer

Vendor risk assessment reports

Answer

Network architecture diagrams

Answer

Annual security awareness training schedule

Question 13

During a P1 incident, the incident response team identifies that the root cause is a misconfigured firewall. According to best practices, which of the following should be the PRIMARY focus of the root cause analysis?

Accepted Answer

Determining why the firewall was misconfigured and why the change management process failed. Root cause analysis should identify not only the technical cause but also the process and management failures that allowed the misconfiguration to occur.

Answer

Patching the firewall immediately

Answer

Conducting a lessons learned meeting immediately

Answer

Restoring the firewall from backup

Question 14

An organization has experienced a ransomware attack that has encrypted critical servers. The incident response team is unable to contain the incident within the maximum tolerable downtime (MTD). Who has the authority to declare a disaster and activate the business continuity plan?

Accepted Answer

The chief executive officer (CEO) or designated crisis management team. The CEO or designated crisis management team holds the authority to declare a disaster and activate the BCP because this decision has enterprise-wide impact, requiring executive-level accountability and resource allocation. The CEO is ultimately responsible for business survival, and the crisis management team is typically pre-authorized to make this call when MTD is exceeded. This aligns with CISM's governance principle that business continuity is a business decision, not an IT or security decision.

Answer

The incident response manager

Answer

The business continuity manager

Answer

The chief information security officer (CISO)

Question 15

Which of the following is the PRIMARY purpose of having a pre-established contract with a digital forensics firm before an incident occurs?

Accepted Answer

To reduce the time required to engage the firm during an incident. The primary purpose of a pre-established contract with a digital forensics firm is to eliminate procurement delays during an incident. When an incident occurs, time is critical; having a signed contract in place allows the firm to be engaged immediately without waiting for legal or administrative approvals, which directly supports the incident response goal of minimizing damage and preserving evidence.

Answer

To ensure attorney-client privilege is automatically applied

Answer

To ensure the firm is available 24/7

Answer

To guarantee a discounted rate