CISM Incident Management Practice Test 6 — 15 Questions

Question 1

Which of the following incident types is MOST likely to require activation of the crisis management team (CMT) due to potential regulatory and reputational impact?

Accepted Answer

A P1 data breach involving customer personally identifiable information (PII).. A P1 data breach involving customer PII triggers mandatory breach notification laws (e.g., GDPR Article 33, HIPAA Breach Notification Rule) and often requires immediate CMT activation to manage regulatory filings, legal liability, and public relations. The CMT is designed for high-severity incidents with significant business, legal, or reputational consequences, which a P1 breach directly entails.

Answer

A P2 denial-of-service attack that is quickly mitigated.

Answer

A P4 phishing email reported by a user.

Answer

A P3 insider threat involving an employee accessing unauthorized files.

Question 2

In the incident response team structure, who is typically responsible for coordinating communication with external stakeholders such as customers and the media?

Accepted Answer

Communications lead. The communications lead handles external messaging to ensure consistency and accuracy.

Answer

Legal counsel

Answer

Incident response manager

Answer

Executive sponsor

Question 3

An organization is updating its incident response plan. Which TWO components are essential to include for effective insider threat management? (Select TWO.)

Accepted Answer

Procedures for coordinating with human resources and legal departments.. Option B is correct because insider threat incidents require close coordination with human resources and legal departments to handle employee privacy, employment law, evidence handling, and potential disciplinary or legal action properly. Option D is correct because a dedicated insider threat playbook provides specific, pre-defined procedures for detecting, investigating, and responding to malicious or negligent insider activity, which differs from generic incident response steps. Option A is not essential here because ransomware recovery is a separate threat category and does not specifically address insider threat management. Option C is inappropriate and insecure because storing all employee passwords violates least privilege and credential security best practices. Option E is unrelated because DDoS mitigation contacts address external availability attacks, not insider threats.

Answer

A dedicated ransomware recovery procedure.

Answer

A list of all employee passwords for investigation purposes.

Answer

Contact information for the DDoS mitigation service provider.

Question 4

After a data breach involving customer PII, the incident response team is conducting a root cause analysis. Which THREE factors should be examined according to CISM best practices? (Select THREE.)

Accepted Answer

The management or governance failure that allowed the process failure.. According to CISM best practices, root cause analysis after a data breach should focus on systemic and organizational factors rather than individuals or financial impacts. Option A is correct because governance failures—such as inadequate security policies, missing oversight, or lack of executive accountability—are root causes that enable process and control breakdowns. Option D is correct because identifying the specific technical vulnerability (e.g., an unpatched CVE, misconfigured firewall rule, or weak authentication mechanism) explains how the breach was technically possible. Option E is correct because the process failure (e.g., absent patch management, ineffective change control, or missing vulnerability scanning) is the underlying reason the vulnerability was allowed to persist. Option B is not a root cause factor; cost is a business impact metric used for post-incident evaluation, not causal analysis. Option C is incorrect because blaming a specific employee who clicked a phishing email addresses a symptom, not the systemic root cause, and CISM emphasizes examining control failures rather than individual blame.

Answer

The cost of the breach to the organization.

Answer

The specific employee who clicked the phishing email.

Question 5

An organization is preparing for a potential supply chain incident. According to CISM best practices, which THREE elements should be included in the supply chain incident playbook? (Select THREE.)

Accepted Answer

Procedures for isolating affected systems and networks.. Option B is correct because a supply chain incident playbook must include containment procedures that isolate compromised systems and network segments (e.g., disabling switch ports, applying ACLs, or quarantining VLANs) to prevent lateral movement and further propagation from a compromised vendor. Option D is correct because timely, pre-approved communication templates ensure consistent notification of affected partners and customers, satisfying contractual, regulatory, and reputational obligations during a supply chain breach. Option E is correct because contacting legal counsel is essential for assessing liability, regulatory reporting duties, and breach-notification requirements, and this escalation path must be predefined in the playbook. Option A is not appropriate because CISM best practices never prescribe ransom payment procedures; paying ransoms is discouraged and would not be a standard playbook element. Option C does not belong because a list of approved DDoS mitigation vendors is a procurement/vendor-management artifact, not a core incident response playbook element for a supply chain incident.

Answer

A step-by-step guide for paying ransoms to cybercriminals.

Answer

A list of approved vendors for DDoS mitigation services.

Question 6

An organization has experienced a ransomware attack that encrypted critical servers. The incident has been classified as P1. Which of the following is the FIRST action the incident response team should take according to the IR plan?

Accepted Answer

Contain the incident by isolating affected systems from the network.. According to standard incident response (IR) frameworks such as NIST SP 800-61 and CISM best practices, the first priority after detecting a P1 incident like ransomware is containment. Isolating affected systems from the network prevents the malware from spreading to other critical servers and limits the blast radius. Only after containment should the team proceed with eradication, recovery, and forensic analysis.

Answer

Perform root cause analysis to determine how the ransomware entered.

Answer

Begin forensic imaging of all affected servers for evidence preservation.

Answer

Notify the CEO and activate the crisis management team.

Question 7

Which of the following is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Accepted Answer

To update the incident response plan and playbooks based on findings.. Lessons learned meetings are designed to identify strengths and weaknesses in the incident response process and to implement improvements.

Answer

To assign blame for the incident.

Answer

To determine the financial impact of the incident.

Answer

To document the incident for regulatory reporting.

Question 8

During a major data breach investigation, legal counsel advises the incident response team to preserve attorney-client privilege over communications with external forensic investigators. Which of the following actions BEST supports this objective?

Accepted Answer

Direct the forensic investigators to report to legal counsel and mark all deliverables as privileged.. Directing forensic investigators to report directly to legal counsel and marking all deliverables as privileged establishes a clear legal framework for attorney-client privilege. This ensures that communications and work product are protected from discovery in litigation, as they are created under the direction of legal counsel for the purpose of providing legal advice.

Answer

Have all communications with the forensic firm go through the CISO.

Answer

Avoid documenting any findings related to the breach until after litigation is resolved.

Answer

Ensure the forensic engagement letter includes a clause acknowledging attorney-client privilege.

Question 9

Which of the following is the PRIMARY reason for having a pre-established forensic retainer agreement before an incident occurs?

Accepted Answer

To reduce the time needed to bring forensic experts on board during an incident.. The primary reason for a pre-established forensic retainer agreement is to reduce the time needed to bring forensic experts on board during an incident. In incident management, every minute of delay can allow an attacker to exfiltrate data or destroy evidence; a retainer bypasses the procurement and contracting process, enabling immediate deployment of the forensic team to preserve volatile memory and capture network artifacts.

Answer

To ensure the forensic firm is familiar with the organization's environment.

Answer

To lock in a favorable pricing structure.

Answer

To ensure the forensic firm has the necessary certifications.

Question 10

Which of the following is the BEST approach for sharing threat intelligence indicators of compromise (IoCs) after an incident?

Accepted Answer

Share IoCs with industry peers via the relevant ISAC.. Sharing IoCs with an ISAC (Information Sharing and Analysis Center) helps the broader community defend against similar attacks, which is a key post-incident activity.

Answer

Report IoCs to law enforcement only.

Answer

Keep IoCs confidential to protect the organization's reputation.

Answer

Publish IoCs on the organization's public website.

Question 11

Which of the following is the PRIMARY reason for including communication templates in the incident response plan?

Accepted Answer

To ensure consistent and timely messaging to stakeholders.. Communication templates ensure that notifications are consistent, accurate, and timely during the stress of an incident, reducing the risk of errors or omissions.

Answer

To reduce the workload on the communications lead.

Answer

To comply with regulatory requirements for breach notification.

Answer

To avoid legal liability by using approved language.

Question 12

Which of the following is the PRIMARY role of the executive sponsor in the incident response team structure?

Accepted Answer

To provide strategic direction, resources, and decision-making authority.. The executive sponsor provides authority, resources, and strategic direction, and ensures the IR team has the support needed to respond effectively.

Answer

To handle all media inquiries and public relations.

Answer

To serve as legal counsel and ensure compliance.

Answer

To manage the technical investigation and forensic analysis.

Question 13

Which of the following incident categories would typically require the involvement of the crisis management team?

Accepted Answer

A P1 critical-severity ransomware attack encrypting critical systems.. A P1 critical-severity ransomware attack encrypting critical systems requires immediate activation of the crisis management team because it poses an existential threat to business operations, often involving legal, PR, executive, and regulatory stakeholders. The crisis management team handles incidents that exceed the capacity of the incident response team, typically those with high business impact, widespread system compromise, or potential for significant financial/reputational damage.

Answer

A P2 high-severity DDoS attack that has been mitigated within a few hours.

Answer

A P3 medium-severity insider threat involving unauthorized access to a non-critical system.

Answer

A P4 low-severity phishing email reported by a user.

Question 14

An organization's incident response plan requires that evidence be preserved for potential litigation. Which of the following actions is MOST critical to ensure the admissibility of digital evidence?

Accepted Answer

Documenting the chain of custody for all evidence collected.. Admissibility of digital evidence in court hinges on demonstrating that the evidence has not been tampered with from the moment of collection to presentation. The chain of custody is the legally mandated documentation that tracks every person who handled the evidence, the time and date of each transfer, and the purpose of each action. Without a complete and verifiable chain of custody, the opposing counsel can successfully argue that the evidence may have been altered, making it inadmissible regardless of how securely it was stored or imaged.

Answer

Storing evidence in a secure, access-controlled location.

Answer

Creating forensic images of all affected systems before remediation.

Answer

Encrypting all evidence files to prevent unauthorized access.

Question 15

After a data breach involving personal data of EU residents, the incident manager must ensure compliance with GDPR notification requirements. Within how many hours must the organization notify the relevant supervisory authority of the breach?

Accepted Answer

72 hours. GDPR Article 33 requires that, in the event of a personal data breach, the controller must notify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The 72-hour clock is a hard regulatory deadline, and failure to meet it can trigger significant fines under Article 83. This is why 72 hours is the correct answer for breach notification to the supervisory authority.

Answer

96 hours

Answer

24 hours

Answer

48 hours