CISM Incident Management Practice Test 7 — 15 Questions

Question 1

A security analyst detects a series of failed login attempts followed by a successful login from an unusual geographic location. The account is a standard user account. Which incident category best describes this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Account compromise. The scenario describes an account compromise where credentials are likely stolen and used to gain unauthorized access.

Answer

Data breach

Answer

Supply chain attack

Answer

Insider threat

Question 2

After a major incident, the lessons learned meeting is scheduled. According to best practices, when should this meeting typically be held after incident resolution?

Accepted Answer

Within two weeks. Best practices recommend holding the lessons learned meeting within two weeks of incident resolution to capture details while they are fresh.

Answer

Within one month

Answer

Within 24 hours

Answer

Within one week

Question 3

During a P1 incident involving a ransomware attack, the incident response manager needs to communicate with executives. Which of the following is the most appropriate approach for executive communication?

Accepted Answer

Send hourly situation reports (sitreps) focusing on business impact and key actions. For critical incidents, hourly sitreps (situation reports) are recommended to keep executives informed. Avoiding speculation and preserving legal privilege with counsel involvement are also key.

Answer

Include speculative root causes to show thoroughness

Answer

Wait until the incident is fully resolved before communicating

Answer

Provide detailed technical analysis in every update

Question 4

An organization is updating its incident response plan after a lessons learned meeting. Which of the following is the primary purpose of updating the plan based on lessons learned?

Accepted Answer

To incorporate improvements to prevent recurrence and enhance response. The primary purpose is to incorporate improvements to prevent recurrence and improve response effectiveness.

Answer

To assign blame for failures

Answer

To share threat intelligence with ISACs

Answer

To document the incident for regulatory compliance

Question 5

A company experiences a DDoS attack that overwhelms its internet-facing services. The incident response team implements mitigation measures. During which phase of incident response is it most appropriate to collect and preserve evidence for potential legal action?

Accepted Answer

During containment, eradication, and recovery. Evidence collection should occur during containment, eradication, and recovery, but ideally before remediation to preserve forensic data. In a DDoS, logs and traffic captures should be preserved early.

Answer

During preparation

Answer

During detection and analysis

Answer

During post-incident activity

Question 6

Which type of incident response exercise involves a facilitated discussion of a hypothetical scenario to review plans and procedures?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based exercise where team members walk through a scenario to identify strengths and gaps.

Answer

Full-scale exercise

Answer

Simulation

Answer

Drill

Question 7

An organization has a policy to share indicators of compromise (IoCs) with an Information Sharing and Analysis Center (ISAC). This activity is most closely associated with which phase of incident management?

Accepted Answer

Post-incident activity. Sharing IoCs with ISACs is a post-incident activity aimed at improving collective defense and preventing future incidents.

Answer

Preparation

Answer

Containment, eradication, and recovery

Answer

Detection and analysis

Question 8

Which TWO of the following are essential components of an incident response programme that should be established before an incident occurs? (Select TWO.)

Accepted Answer

A signed retainer agreement with a forensics firm. An IR team with defined roles and a signed retainer with a forensics firm are critical preparatory elements. The IR plan is also prepared, but the question asks for components established before an incident.

Answer

An insurance claim form for cyber incidents

Answer

A list of affected customers from the most recent data breach

Answer

A root cause analysis report from a previous incident

Question 9

Which TWO of the following are appropriate criteria for escalating an incident to the crisis management team (CMT)? (Select TWO.)

Accepted Answer

The incident could cause severe reputational damage. Potential for major financial loss or regulatory penalties and severe reputational damage are key triggers for CMT activation. Technical complexity alone is not sufficient.

Answer

The incident involves a new type of malware not seen before

Answer

The incident originated from a third-party supplier

Answer

The incident requires coordination with multiple external vendors

Question 10

Which THREE of the following are key activities during the post-incident phase of incident management? (Select THREE.)

Accepted Answer

Updating incident response plans and playbooks based on lessons learned. Root cause analysis, updating the IR plan/playbooks, and sharing IoCs with ISACs are all post-incident activities. Activating the DR site occurs during the response, not post-incident.

Answer

Activating the disaster recovery site

Answer

Implementing immediate containment measures

Question 11

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident, such as ransomware or data breach?

Accepted Answer

Incident response playbook. Playbooks (or runbooks) provide detailed procedures for specific incident types, while the IR plan is a broader document.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication template

Question 12

During a P1 (critical) security incident, which of the following is the MOST appropriate frequency for providing executive status updates?

Accepted Answer

Hourly situation reports (sitreps). For critical incidents, regular and frequent communication is required to keep executives informed.

Answer

At the end of the incident

Answer

Daily briefings

Answer

Only upon significant changes

Question 13

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is working on containment. Which communication should the incident manager prioritize FIRST?

Accepted Answer

Notify the executive sponsor, legal counsel, and communications lead. Immediate containment and notification of key internal stakeholders (executive sponsor, legal, communications) is the first priority to coordinate response and manage legal/regulatory obligations.

Answer

Contact the organization's cyber insurance provider

Answer

Notify law enforcement

Answer

Issue a press release

Question 14

Which post-incident activity involves identifying the technical cause, the process failure that allowed it, and the management/governance failure that permitted the process failure?

Accepted Answer

Root cause analysis (RCA). Root cause analysis (RCA) digs into multiple layers to find underlying issues, often using techniques like 5 Whys or fishbone diagrams.

Answer

Lessons learned meeting

Answer

Incident closure report

Answer

Threat intelligence sharing

Question 15

Which incident severity level is characterized by major business impact, requires executive notification, and demands 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have the highest severity and require immediate, around-the-clock response.

Answer

P3 — Medium

Answer

P2 — High

Answer

P4 — Low