CISM Incident Management Practice Test 6 — 15 Questions

Question 1

Which of the following is the PRIMARY role of the executive sponsor in the incident response team structure?

Accepted Answer

To provide strategic direction, resources, and decision-making authority.. The executive sponsor provides authority, resources, and strategic direction, and ensures the IR team has the support needed to respond effectively.

Answer

To handle all media inquiries and public relations.

Answer

To serve as legal counsel and ensure compliance.

Answer

To manage the technical investigation and forensic analysis.

Question 2

Which of the following incident categories would typically require the involvement of the crisis management team?

Accepted Answer

A P1 critical-severity ransomware attack encrypting critical systems.. A P1 critical-severity ransomware attack encrypting critical systems requires immediate activation of the crisis management team because it poses an existential threat to business operations, often involving legal, PR, executive, and regulatory stakeholders. The crisis management team handles incidents that exceed the capacity of the incident response team, typically those with high business impact, widespread system compromise, or potential for significant financial/reputational damage.

Answer

A P2 high-severity DDoS attack that has been mitigated within a few hours.

Answer

A P3 medium-severity insider threat involving unauthorized access to a non-critical system.

Answer

A P4 low-severity phishing email reported by a user.

Question 3

An organization's incident response plan requires that evidence be preserved for potential litigation. Which of the following actions is MOST critical to ensure the admissibility of digital evidence?

Accepted Answer

Documenting the chain of custody for all evidence collected.. Admissibility of digital evidence in court hinges on demonstrating that the evidence has not been tampered with from the moment of collection to presentation. The chain of custody is the legally mandated documentation that tracks every person who handled the evidence, the time and date of each transfer, and the purpose of each action. Without a complete and verifiable chain of custody, the opposing counsel can successfully argue that the evidence may have been altered, making it inadmissible regardless of how securely it was stored or imaged.

Answer

Storing evidence in a secure, access-controlled location.

Answer

Creating forensic images of all affected systems before remediation.

Answer

Encrypting all evidence files to prevent unauthorized access.

Question 4

After a data breach involving personal data of EU residents, the incident manager must ensure compliance with GDPR notification requirements. Within how many hours must the organization notify the relevant supervisory authority of the breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

96 hours

Answer

24 hours

Answer

48 hours

Question 5

Which TWO of the following are essential components of an incident response (IR) plan? (Select TWO)

Accepted Answer

Communication templates. The IR plan includes the IR team roster and contact list, and communication templates. Procedures for specific incident types are typically in separate playbooks.

Answer

Vendor risk assessment reports

Answer

Detailed network architecture diagrams

Answer

Playbook for ransomware incidents

Question 6

Which THREE of the following are typical roles in an incident response team? (Select THREE)

Accepted Answer

IR manager. The IR team typically includes an IR manager, security analysts, forensic investigators, communications lead, legal counsel, and executive sponsor.

Answer

Human resources representative

Answer

Internal audit representative

Question 7

Which TWO of the following are key considerations when managing an external forensics firm during an incident? (Select TWO)

Accepted Answer

Maintaining chain of custody for all evidence. Managing external forensics involves defining scope, ensuring proper evidence handling and chain of custody, maintaining confidentiality, and preserving attorney-client privilege.

Answer

Allowing the firm to make independent decisions on containment

Answer

Having the firm report directly to the media

Answer

Ensuring the firm uses only proprietary tools

Question 8

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident?

Accepted Answer

Incident response playbook. Playbooks are specific to incident types (e.g., ransomware) and provide step-by-step guidance, whereas the IR plan is a high-level document and policy sets overall intent.

Answer

Incident response policy

Answer

Incident response plan

Answer

Communication templates

Question 9

During a P1 (critical) incident, the incident response manager is coordinating response activities. Who is primarily responsible for activating the crisis management team (CMT)?

Accepted Answer

The incident response manager. The crisis management team is typically activated by the incident response manager or a designated authority when an incident has major business impact. The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications lead.

Answer

The communications lead

Answer

The legal counsel

Answer

The CEO of the organization

Question 10

Following a ransomware incident where data was encrypted and exfiltrated, the root cause analysis reveals that the initial access occurred through a phishing email that bypassed email filters due to a misconfiguration. The misconfiguration was not identified because the security team lacked a formal process to review firewall rule changes. Which of the following is the most appropriate management/governance failure to document in the lessons learned?

Accepted Answer

The security team did not have a change management process for security control configurations.. The technical cause is the phishing email, the process failure is the lack of review of email filter configurations, and the management/governance failure is the absence of a change management process for security controls.

Answer

Employees should have been trained to recognize phishing emails.

Answer

The email filter vendor did not provide adequate support.

Answer

The incident response plan was not followed during the incident.

Question 11

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the relevant supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

48 hours

Answer

24 hours

Answer

96 hours

Question 12

Which incident severity level requires executive notification and 24/7 response, and has major business impact?

Accepted Answer

P1 - Critical. P1 (Critical) incidents have major business impact, require executive notification, and demand a 24/7 response effort.

Answer

P3 - Medium

Answer

P2 - High

Answer

P4 - Low

Question 13

During a major incident, the incident response team discovers that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Accepted Answer

Escalate to activate the business continuity and disaster recovery plans. When an incident cannot be resolved within the MTD, it triggers the transition to business continuity and disaster recovery (BC/DR) plans to maintain critical operations.

Answer

Continue incident response efforts until resolution regardless of time

Answer

Declare the incident a disaster and shut down all systems

Answer

Notify the insurance provider immediately

Question 14

An organization is engaging an external forensics firm to investigate a suspected data breach. Which of the following is the most important step to ensure that evidence remains admissible in legal proceedings?

Accepted Answer

Issuing a legal hold and making forensic copies of affected systems before remediation. Preserving the chain of custody and ensuring forensic copies are made before remediation is critical for evidence admissibility. Legal hold ensures that relevant data is preserved.

Answer

Ensuring the forensics firm has signed a non-disclosure agreement

Answer

Negotiating a fixed price for the investigation

Answer

Requiring the forensics firm to report findings directly to the CEO

Question 15

Which role in the incident response team structure is responsible for coordinating all response activities and making decisions about incident severity classification?

Accepted Answer

Incident response manager. The IR manager leads the team, coordinates activities, and classifies incidents based on severity.

Answer

Communications lead

Answer

Security analysts

Answer

Forensic investigators