CISM Incident Management Practice Test 5 — 15 Questions

Question 1

An organization maintains evidence handling procedures for incident response. A forensic investigator needs to collect a hard drive from a compromised server. Which of the following is the MOST critical step to ensure admissibility in court?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Documenting the chain of custody from the moment of collection.. Chain of custody documentation is essential for evidence integrity and admissibility.

Answer

Encrypting the hard drive during transport.

Answer

Creating a forensic image of the hard drive before disconnecting it.

Answer

Ensuring the investigator has the proper certification.

Question 2

An organization is updating its incident response plan. Which TWO components are essential to include for effective insider threat management? (Select TWO.)

Accepted Answer

Procedures for coordinating with human resources and legal departments.. Insider threats require specific playbooks and involvement of HR and legal for proper handling.

Answer

A dedicated ransomware recovery procedure.

Answer

A list of all employee passwords for investigation purposes.

Answer

Contact information for the DDoS mitigation service provider.

Question 3

After a data breach involving customer PII, the incident response team is conducting a root cause analysis. Which THREE factors should be examined according to CISM best practices? (Select THREE.)

Accepted Answer

The management or governance failure that allowed the process failure.. Root cause analysis should identify technical, process, and management failures.

Answer

The cost of the breach to the organization.

Answer

The specific employee who clicked the phishing email.

Question 4

An organization is preparing for a potential supply chain incident. According to CISM best practices, which THREE elements should be included in the supply chain incident playbook? (Select THREE.)

Accepted Answer

Procedures for isolating affected systems and networks.. Supply chain incidents require specific procedures for vendor coordination, technical response, and communication.

Answer

A step-by-step guide for paying ransoms to cybercriminals.

Answer

A list of approved vendors for DDoS mitigation services.

Question 5

An organization has experienced a ransomware attack that encrypted critical servers. The incident has been classified as P1. Which of the following is the FIRST action the incident response team should take according to the IR plan?

Accepted Answer

Contain the incident by isolating affected systems from the network.. For a P1 incident, the IR plan dictates immediate containment to prevent further spread, followed by notification to the executive sponsor and activation of the crisis management team.

Answer

Perform root cause analysis to determine how the ransomware entered.

Answer

Begin forensic imaging of all affected servers for evidence preservation.

Answer

Notify the CEO and activate the crisis management team.

Question 6

Which of the following is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Accepted Answer

To update the incident response plan and playbooks based on findings.. Lessons learned meetings are designed to identify strengths and weaknesses in the incident response process and to implement improvements.

Answer

To assign blame for the incident.

Answer

To determine the financial impact of the incident.

Answer

To document the incident for regulatory reporting.

Question 7

During a major data breach investigation, legal counsel advises the incident response team to preserve attorney-client privilege over communications with external forensic investigators. Which of the following actions BEST supports this objective?

Accepted Answer

Direct the forensic investigators to report to legal counsel and mark all deliverables as privileged.. Directing forensic investigators to report directly to legal counsel and marking all deliverables as privileged establishes a clear legal framework for attorney-client privilege. This ensures that communications and work product are protected from discovery in litigation, as they are created under the direction of legal counsel for the purpose of providing legal advice.

Answer

Have all communications with the forensic firm go through the CISO.

Answer

Avoid documenting any findings related to the breach until after litigation is resolved.

Answer

Ensure the forensic engagement letter includes a clause acknowledging attorney-client privilege.

Question 8

An organization's incident response team is handling a P2 insider threat incident involving unauthorized access to customer data. According to the incident classification, which of the following is the MOST appropriate notification and response timeframe?

Accepted Answer

Notification to management within 24 hours and response during business hours.. P2 incidents are high severity with significant impact, requiring management notification and response during business hours.

Answer

No notification required; handle during scheduled remediation.

Answer

Notification to the communications lead and response within 48 hours.

Answer

Immediate notification to the executive sponsor and 24/7 response.

Question 9

Which of the following is the PRIMARY reason for having a pre-established forensic retainer agreement before an incident occurs?

Accepted Answer

To reduce the time needed to bring forensic experts on board during an incident.. The primary reason for a pre-established forensic retainer agreement is to reduce the time needed to bring forensic experts on board during an incident. In incident management, every minute of delay can allow an attacker to exfiltrate data or destroy evidence; a retainer bypasses the procurement and contracting process, enabling immediate deployment of the forensic team to preserve volatile memory and capture network artifacts.

Answer

To ensure the forensic firm is familiar with the organization's environment.

Answer

To lock in a favorable pricing structure.

Answer

To ensure the forensic firm has the necessary certifications.

Question 10

During a P1 incident, the crisis management team (CMT) has been activated. The CEO asks for an hourly sitrep. Which of the following is the MOST appropriate content for the sitrep?

Accepted Answer

Current status of containment, confirmed facts, and actions taken, with legal counsel input.. During a P1 incident, the CEO requires a concise, actionable sitrep focused on containment status, confirmed facts, and actions taken. Legal counsel input is critical to avoid premature attribution or disclosure that could create liability or violate data breach notification laws. This aligns with the CISM incident management principle of providing decision-ready information to executive leadership without technical clutter.

Answer

A detailed technical analysis of the attack vector and exploited vulnerabilities.

Answer

Names of individuals potentially responsible for the incident.

Answer

Estimated financial impact and potential regulatory penalties.

Question 11

An organization has experienced a DDoS attack that is overwhelming its internet-facing services. The incident response team has implemented mitigations, but services remain degraded. The maximum tolerable downtime (MTD) for the affected services is 4 hours, and 3 hours have passed. Which of the following should the incident manager do NEXT?

Accepted Answer

Escalate to the crisis management team to consider activating the disaster recovery plan.. If an incident cannot be resolved within the MTD, it should transition to BC/DR activation. The decision authority (e.g., CISO or CMT) should declare a disaster.

Answer

Continue current mitigation efforts and reassess after another hour.

Answer

Increase the capacity of the DDoS mitigation service.

Answer

Notify customers of a prolonged outage.

Question 12

Which of the following is the BEST approach for sharing threat intelligence indicators of compromise (IoCs) after an incident?

Accepted Answer

Share IoCs with industry peers via the relevant ISAC.. Sharing IoCs with an ISAC (Information Sharing and Analysis Center) helps the broader community defend against similar attacks, which is a key post-incident activity.

Answer

Report IoCs to law enforcement only.

Answer

Keep IoCs confidential to protect the organization's reputation.

Answer

Publish IoCs on the organization's public website.

Question 13

Which of the following is the PRIMARY reason for including communication templates in the incident response plan?

Accepted Answer

To ensure consistent and timely messaging to stakeholders.. Communication templates ensure that notifications are consistent, accurate, and timely during the stress of an incident, reducing the risk of errors or omissions.

Answer

To reduce the workload on the communications lead.

Answer

To comply with regulatory requirements for breach notification.

Answer

To avoid legal liability by using approved language.

Question 14

An organization is conducting a root cause analysis after a data breach. Which of the following sequences BEST aligns with the 5 Whys approach from a CISM perspective?

Accepted Answer

Technical cause → Process failure → Management failure. The 5 Whys should drill down from technical cause to process failure to management/governance failure, as per the domain content.

Answer

Management failure → Process failure → Technical cause

Answer

Process failure → Technical cause → Management failure

Answer

Technical cause → Management failure → Process failure

Question 15

During a P1 incident involving a ransomware attack, the crisis management team has been activated. The communications lead is drafting an all-staff internal communication. Which of the following should be INCLUDED in this communication?

Accepted Answer

Instructions for employees to avoid connecting to the network until further notice.. Internal communications during an incident should provide clear guidance to employees on actions they need to take, such as not connecting devices, while avoiding speculation or blame.

Answer

Names of individuals suspected of causing the incident.

Answer

Details of the attack vector and affected systems.

Answer

Estimated time to full recovery.