CISM Incident Management Practice Test 5 — 15 Questions

Question 1

An organization has experienced a ransomware attack that encrypted critical servers. The incident has been classified as P1. Which of the following is the FIRST action the incident response team should take according to the IR plan?

Accepted Answer

Contain the incident by isolating affected systems from the network.. For a P1 incident, the IR plan dictates immediate containment to prevent further spread, followed by notification to the executive sponsor and activation of the crisis management team.

Answer

Perform root cause analysis to determine how the ransomware entered.

Answer

Begin forensic imaging of all affected servers for evidence preservation.

Answer

Notify the CEO and activate the crisis management team.

Question 2

Which of the following is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Accepted Answer

To update the incident response plan and playbooks based on findings.. Lessons learned meetings are designed to identify strengths and weaknesses in the incident response process and to implement improvements.

Answer

To assign blame for the incident.

Answer

To determine the financial impact of the incident.

Answer

To document the incident for regulatory reporting.

Question 3

During a major data breach investigation, legal counsel advises the incident response team to preserve attorney-client privilege over communications with external forensic investigators. Which of the following actions BEST supports this objective?

Accepted Answer

Direct the forensic investigators to report to legal counsel and mark all deliverables as privileged.. Option D is correct because directing forensic investigators to report directly to legal counsel and marking all deliverables as privileged establishes a clear legal framework for attorney-client privilege. This ensures that communications and work product are protected from discovery in litigation, as they are created under the direction of legal counsel for the purpose of providing legal advice.

Answer

Have all communications with the forensic firm go through the CISO.

Answer

Avoid documenting any findings related to the breach until after litigation is resolved.

Answer

Ensure the forensic engagement letter includes a clause acknowledging attorney-client privilege.

Question 4

An organization's incident response team is handling a P2 insider threat incident involving unauthorized access to customer data. According to the incident classification, which of the following is the MOST appropriate notification and response timeframe?

Accepted Answer

Notification to management within 24 hours and response during business hours.. P2 incidents are high severity with significant impact, requiring management notification and response during business hours.

Answer

No notification required; handle during scheduled remediation.

Answer

Notification to the communications lead and response within 48 hours.

Answer

Immediate notification to the executive sponsor and 24/7 response.

Question 5

Which of the following is the PRIMARY reason for having a pre-established forensic retainer agreement before an incident occurs?

Accepted Answer

To reduce the time needed to bring forensic experts on board during an incident.. The primary reason for a pre-established forensic retainer agreement is to reduce the time needed to bring forensic experts on board during an incident. In incident management, every minute of delay can allow an attacker to exfiltrate data or destroy evidence; a retainer bypasses the procurement and contracting process, enabling immediate deployment of the forensic team to preserve volatile memory and capture network artifacts.

Answer

To ensure the forensic firm is familiar with the organization's environment.

Answer

To lock in a favorable pricing structure.

Answer

To ensure the forensic firm has the necessary certifications.

Question 6

During a P1 incident, the crisis management team (CMT) has been activated. The CEO asks for an hourly sitrep. Which of the following is the MOST appropriate content for the sitrep?

Accepted Answer

Current status of containment, confirmed facts, and actions taken, with legal counsel input.. During a P1 incident, the CEO requires a concise, actionable sitrep focused on containment status, confirmed facts, and actions taken. Legal counsel input is critical to avoid premature attribution or disclosure that could create liability or violate data breach notification laws. This aligns with the CISM incident management principle of providing decision-ready information to executive leadership without technical clutter.

Answer

A detailed technical analysis of the attack vector and exploited vulnerabilities.

Answer

Names of individuals potentially responsible for the incident.

Answer

Estimated financial impact and potential regulatory penalties.

Question 7

An organization has experienced a DDoS attack that is overwhelming its internet-facing services. The incident response team has implemented mitigations, but services remain degraded. The maximum tolerable downtime (MTD) for the affected services is 4 hours, and 3 hours have passed. Which of the following should the incident manager do NEXT?

Accepted Answer

Escalate to the crisis management team to consider activating the disaster recovery plan.. If an incident cannot be resolved within the MTD, it should transition to BC/DR activation. The decision authority (e.g., CISO or CMT) should declare a disaster.

Answer

Continue current mitigation efforts and reassess after another hour.

Answer

Increase the capacity of the DDoS mitigation service.

Answer

Notify customers of a prolonged outage.

Question 8

Which of the following is the BEST approach for sharing threat intelligence indicators of compromise (IoCs) after an incident?

Accepted Answer

Share IoCs with industry peers via the relevant ISAC.. Sharing IoCs with an ISAC (Information Sharing and Analysis Center) helps the broader community defend against similar attacks, which is a key post-incident activity.

Answer

Report IoCs to law enforcement only.

Answer

Keep IoCs confidential to protect the organization's reputation.

Answer

Publish IoCs on the organization's public website.

Question 9

Which of the following is the PRIMARY reason for including communication templates in the incident response plan?

Accepted Answer

To ensure consistent and timely messaging to stakeholders.. Communication templates ensure that notifications are consistent, accurate, and timely during the stress of an incident, reducing the risk of errors or omissions.

Answer

To reduce the workload on the communications lead.

Answer

To comply with regulatory requirements for breach notification.

Answer

To avoid legal liability by using approved language.

Question 10

An organization is conducting a root cause analysis after a data breach. Which of the following sequences BEST aligns with the 5 Whys approach from a CISM perspective?

Accepted Answer

Technical cause → Process failure → Management failure. The 5 Whys should drill down from technical cause to process failure to management/governance failure, as per the domain content.

Answer

Management failure → Process failure → Technical cause

Answer

Process failure → Technical cause → Management failure

Answer

Technical cause → Management failure → Process failure

Question 11

During a P1 incident involving a ransomware attack, the crisis management team has been activated. The communications lead is drafting an all-staff internal communication. Which of the following should be INCLUDED in this communication?

Accepted Answer

Instructions for employees to avoid connecting to the network until further notice.. Internal communications during an incident should provide clear guidance to employees on actions they need to take, such as not connecting devices, while avoiding speculation or blame.

Answer

Names of individuals suspected of causing the incident.

Answer

Details of the attack vector and affected systems.

Answer

Estimated time to full recovery.

Question 12

Which of the following is the PRIMARY role of the executive sponsor in the incident response team structure?

Accepted Answer

To provide strategic direction, resources, and decision-making authority.. The executive sponsor provides authority, resources, and strategic direction, and ensures the IR team has the support needed to respond effectively.

Answer

To handle all media inquiries and public relations.

Answer

To serve as legal counsel and ensure compliance.

Answer

To manage the technical investigation and forensic analysis.

Question 13

Which of the following incident categories would typically require the involvement of the crisis management team?

Accepted Answer

A P1 critical-severity ransomware attack encrypting critical systems.. A P1 critical-severity ransomware attack encrypting critical systems requires immediate activation of the crisis management team because it poses an existential threat to business operations, often involving legal, PR, executive, and regulatory stakeholders. The crisis management team handles incidents that exceed the capacity of the incident response team, typically those with high business impact, widespread system compromise, or potential for significant financial/reputational damage.

Answer

A P2 high-severity DDoS attack that has been mitigated within a few hours.

Answer

A P3 medium-severity insider threat involving unauthorized access to a non-critical system.

Answer

A P4 low-severity phishing email reported by a user.

Question 14

An organization's incident response plan requires that evidence be preserved for potential litigation. Which of the following actions is MOST critical to ensure the admissibility of digital evidence?

Accepted Answer

Documenting the chain of custody for all evidence collected.. Admissibility of digital evidence in court hinges on demonstrating that the evidence has not been tampered with from the moment of collection to presentation. The chain of custody is the legally mandated documentation that tracks every person who handled the evidence, the time and date of each transfer, and the purpose of each action. Without a complete and verifiable chain of custody, the opposing counsel can successfully argue that the evidence may have been altered, making it inadmissible regardless of how securely it was stored or imaged.

Answer

Storing evidence in a secure, access-controlled location.

Answer

Creating forensic images of all affected systems before remediation.

Answer

Encrypting all evidence files to prevent unauthorized access.

Question 15

After a data breach involving personal data of EU residents, the incident manager must ensure compliance with GDPR notification requirements. Within how many hours must the organization notify the relevant supervisory authority of the breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

96 hours

Answer

24 hours

Answer

48 hours