CISM Incident Management Practice Test 5 — 15 Questions

Question 1

During a data breach investigation, the incident response team discovers that a backup was encrypted by ransomware. The team needs to determine the sequence of events leading to the encryption. Which of the following documentation is MOST critical to preserve for potential litigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The chain of custody for the backup media. Chain of custody documentation is essential to prove the integrity and admissibility of digital evidence in court.

Answer

The communication logs between team members

Answer

The forensic tools used in the investigation

Answer

The incident response plan version used during the incident

Question 2

Following a major security incident, the lessons learned meeting is scheduled. Which of the following outcomes is MOST important to ensure the effectiveness of future incident response?

Accepted Answer

Updating the incident response plan and playbooks based on findings. The primary outcome of a lessons learned meeting is to identify improvements and update the IR plan, not just document or blame.

Answer

Conducting a new risk assessment

Answer

Creating a detailed report for senior management

Answer

Assigning blame to responsible parties

Question 3

An organization is subject to GDPR and experiences a data breach involving personal data. What is the maximum timeframe to notify the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification within 72 hours of becoming aware of the breach.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 4

An incident response team is conducting an exercise to test its playbook for a ransomware incident. Which of the following is the PRIMARY benefit of such an exercise?

Accepted Answer

Validating the incident response plan and identifying areas for improvement. The primary purpose of a tabletop or simulation exercise is to validate that the incident response plan works in practice and to surface gaps, ambiguities, and missing roles before a real ransomware event occurs. Exercises reveal whether contact lists are current, escalation paths are clear, and playbook steps are executable — findings that directly feed plan improvement.

Answer

Documenting the exercise for future reference

Answer

Complying with regulatory requirements

Answer

Testing the technical skills of the team

Question 5

An organization is updating its incident response plan. Which TWO components should be included to ensure effective evidence handling? (Select TWO.)

Accepted Answer

Evidence handling procedures. Evidence handling procedures (B) are essential because they define the step-by-step methods for identifying, collecting, preserving, and documenting digital evidence so it remains admissible and unaltered, covering actions like write-blocking drives and hashing files. Chain of custody forms (E) are equally required because they create the documented, unbroken record of who handled each piece of evidence, when, and for what purpose, which is critical for proving integrity in legal or disciplinary proceedings. Together, B and E directly address the core of evidence handling in an incident response plan. The other options, while useful in a broader IR plan, do not specifically ensure evidence handling: A (incident notification template) supports communication, C (law enforcement contacts) supports escalation, and D (list of acceptable forensic tools) supports tooling choices but does not itself govern evidence integrity or custody.

Answer

A template for incident notifications

Answer

Contact information for law enforcement

Answer

A list of acceptable forensic tools

Question 6

During a major cybersecurity incident, the crisis management team (CMT) is activated. Which THREE roles are typically part of the CMT? (Select THREE.)

Accepted Answer

Chief executive officer (CEO). The Chief Executive Officer (CEO) (A) is a core CMT member because this role owns ultimate business accountability, authorizes major decisions such as taking systems offline or notifying regulators, and communicates with the board and public during a crisis. The General Counsel (GC) (B) belongs on the CMT to assess legal, regulatory, and contractual obligations, including breach-notification laws, litigation risk, and law-enforcement engagement. The Chief Financial Officer (CFO) (E) is included to manage financial impact, authorize emergency spending, handle cyber-insurance claims, and evaluate materiality for financial disclosures. The Security Analyst (C) is a hands-on technical responder who performs triage, log analysis, and containment tasks rather than strategic crisis-management decisions, so is not typically a CMT member. The Incident Response Manager (D) coordinates the tactical incident-response effort and reports to the CMT, but is not itself a standing CMT role.

Answer

Security analyst

Answer

Incident response manager

Question 7

An incident response team is creating playbooks for different incident types. Which TWO incident types should have a dedicated playbook? (Select TWO.)

Accepted Answer

Ransomware. A dedicated playbook is warranted for ransomware (A) because it requires a specific, time-critical sequence of containment, isolation of encrypted hosts, identification of the ransomware strain, and recovery from known-good backups to avoid paying the ransom. A dedicated playbook is also warranted for a data breach (C) because it triggers distinct legal, regulatory, and forensic obligations such as breach notification timelines, evidence preservation, and coordination with counsel and regulators. Password expiration (B) is a routine, scheduled identity-management task handled by normal operational procedures, not an incident response playbook. Software update failure (D) is a change/problem management issue resolved through rollback or patch remediation rather than incident response. Phishing simulation (E) is a proactive security-awareness exercise, not an actual incident, so it does not require an incident response playbook.

Answer

Password expiration

Answer

Software update failure

Answer

Phishing simulation

Question 8

During a major cybersecurity incident classified as P1, the incident response team has been activated. The crisis management team (CMT) is also convened. Which of the following is the PRIMARY responsibility of the CMT during this incident?

Accepted Answer

Making strategic decisions, managing communications, and allocating resources.. The CMT handles strategic decisions, communication, and resource allocation, while the IR team focuses on technical response.

Answer

Notifying law enforcement and regulatory bodies immediately.

Answer

Directly managing the technical containment and eradication of the threat.

Answer

Performing forensic analysis to identify the root cause of the incident.

Question 9

An organization's incident response plan includes a ransomware playbook. After detecting ransomware on a critical server, which of the following should be the FIRST action according to best practices?

Accepted Answer

Disconnect the server from the network and isolate it.. The immediate priority in ransomware containment is to prevent lateral movement and further encryption of systems. Disconnecting the server from the network (e.g., unplugging the Ethernet cable or disabling the virtual switch port) stops the ransomware from communicating with its command-and-control (C2) server and encrypting additional network shares. This aligns with the NIST SP 800-61 incident response containment strategy, which emphasizes isolation before any other action.

Answer

Notify the CEO and legal counsel before taking any action.

Answer

Pay the ransom immediately to regain access.

Answer

Immediately reboot the server to remove the ransomware.

Question 10

During a post-incident root cause analysis, the team uses the '5 Whys' technique and identifies a technical vulnerability as the cause. According to CISM best practices, what should be the NEXT level of analysis?

Accepted Answer

Determine the process failure that allowed the vulnerability to go unaddressed.. The '5 Whys' should drill deeper to uncover process and management failures that allowed the technical vulnerability to exist.

Answer

Immediately patch the vulnerability and move on.

Answer

Escalate the issue to the vendor for a software fix.

Answer

Identify the specific employee responsible for the vulnerability.

Question 11

In the context of incident management, which of the following is the PRIMARY purpose of conducting lessons learned meetings within two weeks of incident resolution?

Accepted Answer

To update the incident response plan and playbooks based on findings.. The main goal is to improve future incident response by identifying what worked and what didn't.

Answer

To provide a final report to regulators and law enforcement.

Answer

To assign blame for the incident and take disciplinary action.

Answer

To calculate the total financial loss from the incident.

Question 12

During a data breach investigation, an organization engages an external forensics firm. To preserve attorney-client privilege, which of the following is the BEST practice?

Accepted Answer

Engage the forensics firm under the direction of legal counsel.. Engaging the forensics firm under the direction of legal counsel is the best practice because it extends attorney-client privilege to the investigation. When counsel directs the work, communications and findings are protected as work product, preventing disclosure in litigation. This is a foundational principle in incident response legal strategy.

Answer

Have the forensics firm work independently to maintain objectivity.

Answer

Ensure the forensics firm signs a non-disclosure agreement only.

Answer

Have the forensics firm report directly to the CISO.

Question 13

What is the PRIMARY reason for having an incident response team roster and contact list readily available?

Accepted Answer

To enable quick activation of the incident response team.. Rapid activation of the IR team depends on knowing who to contact and their backup.

Answer

To satisfy regulatory compliance requirements.

Answer

To ensure all team members have the necessary training.

Answer

To provide a list for auditors to review.

Question 14

After a DDoS attack, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). According to best practices, what should happen next?

Accepted Answer

Escalate to the business continuity and disaster recovery teams.. If MTD cannot be met, business continuity or disaster recovery plans should be activated.

Answer

Notify customers and shut down operations.

Answer

Continue current response efforts and hope for the best.

Answer

Declare the incident as a disaster immediately without further analysis.

Question 15

An organization is required to report a material cybersecurity incident to the SEC within 4 business days (proposed rule). However, the incident is still under investigation. What is the BEST course of action?

Accepted Answer

File a report with the information available and provide updates as the investigation progresses.. Regulatory deadlines must be met even if information is incomplete; disclose what is known and update later.

Answer

Request an extension from the SEC because the investigation is ongoing.

Answer

Delay reporting until the investigation is complete to ensure accuracy.

Answer

Report the incident only if materiality is confirmed at the end of the investigation.