CISM Incident Management Practice Test 7 — 15 Questions

Question 1

Which TWO of the following are essential components of an incident response (IR) plan? (Select TWO)

Accepted Answer

Communication templates. Communication templates (C) are an essential IR plan component because during an incident responders must notify stakeholders, legal, regulators, and customers quickly and consistently, and pre-approved templates prevent delays and wording errors under pressure. The IR team roster and contact list (E) is also essential because the plan must identify who is on the incident response team and how to reach them (including after-hours and escalation contacts) so the team can be assembled immediately. Detailed network architecture diagrams (B) and vendor risk assessment reports (A) are valuable supporting artifacts for preparation and investigation, but they are not core components of the IR plan itself. A ransomware playbook (D) is a useful specialized procedure, yet it is only one scenario-specific playbook rather than a foundational element required in every IR plan.

Answer

Vendor risk assessment reports

Answer

Detailed network architecture diagrams

Answer

Playbook for ransomware incidents

Question 2

Which THREE of the following are typical roles in an incident response team? (Select THREE)

Accepted Answer

IR manager. The IR manager (A) is a core role that coordinates the entire incident response effort, making decisions on escalation, communication, and resource allocation during an incident. Forensic investigators (C) are essential for collecting, preserving, and analyzing evidence such as disk images, memory dumps, and logs to determine the scope and root cause of a breach. Security analysts (D) form the frontline technical role, monitoring SIEM alerts, triaging events, and performing initial containment and eradication actions. Human resources (B) and internal audit (E) may be consulted for employee-related or compliance matters, but they are supporting stakeholders rather than typical standing roles within the incident response team itself.

Answer

Human resources representative

Answer

Internal audit representative

Question 3

Which TWO of the following are key considerations when managing an external forensics firm during an incident? (Select TWO)

Accepted Answer

Maintaining chain of custody for all evidence. Option C is correct because maintaining chain of custody is essential when an external forensics firm handles evidence; documented, unbroken custody records ensure the evidence remains admissible in legal or disciplinary proceedings and prevents tampering or spoliation. Option D is correct because a clear scope of work plus agreed evidence-handling procedures define what the firm will investigate, how it will collect and preserve data, and what deliverables and timelines apply, preventing misunderstandings and unauthorized actions. The unmarked options do not belong: A is wrong because containment decisions should remain with the incident response team or management under the organization's authority, not be delegated independently to the forensics firm; B is wrong because media communications must go through the organization's designated spokesperson or PR/legal team, not the external firm; and E is wrong because requiring only proprietary tools is unnecessary and can hinder analysis, whereas validated, forensically sound tools and documented methods are what matter.

Answer

Allowing the firm to make independent decisions on containment

Answer

Having the firm report directly to the media

Answer

Ensuring the firm uses only proprietary tools

Question 4

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident?

Accepted Answer

Incident response playbook. Playbooks are specific to incident types (e.g., ransomware) and provide step-by-step guidance, whereas the IR plan is a high-level document and policy sets overall intent.

Answer

Incident response policy

Answer

Incident response plan

Answer

Communication templates

Question 5

Following a ransomware incident where data was encrypted and exfiltrated, the root cause analysis reveals that the initial access occurred through a phishing email that bypassed email filters due to a misconfiguration. The misconfiguration was not identified because the security team lacked a formal process to review firewall rule changes. Which of the following is the most appropriate management/governance failure to document in the lessons learned?

Accepted Answer

The security team did not have a change management process for security control configurations.. The technical cause is the phishing email, the process failure is the lack of review of email filter configurations, and the management/governance failure is the absence of a change management process for security controls.

Answer

Employees should have been trained to recognize phishing emails.

Answer

The email filter vendor did not provide adequate support.

Answer

The incident response plan was not followed during the incident.

Question 6

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the relevant supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

48 hours

Answer

24 hours

Answer

96 hours

Question 7

Which incident severity level requires executive notification and 24/7 response, and has major business impact?

Accepted Answer

P1 - Critical. P1 (Critical) incidents have major business impact, require executive notification, and demand a 24/7 response effort.

Answer

P3 - Medium

Answer

P2 - High

Answer

P4 - Low

Question 8

During a major incident, the incident response team discovers that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Accepted Answer

Escalate to activate the business continuity and disaster recovery plans. When an incident cannot be resolved within the MTD, it triggers the transition to business continuity and disaster recovery (BC/DR) plans to maintain critical operations.

Answer

Continue incident response efforts until resolution regardless of time

Answer

Declare the incident a disaster and shut down all systems

Answer

Notify the insurance provider immediately

Question 9

An organization is engaging an external forensics firm to investigate a suspected data breach. Which of the following is the most important step to ensure that evidence remains admissible in legal proceedings?

Accepted Answer

Issuing a legal hold and making forensic copies of affected systems before remediation. Preserving the chain of custody and ensuring forensic copies are made before remediation is critical for evidence admissibility. Legal hold ensures that relevant data is preserved.

Answer

Ensuring the forensics firm has signed a non-disclosure agreement

Answer

Negotiating a fixed price for the investigation

Answer

Requiring the forensics firm to report findings directly to the CEO

Question 10

Which role in the incident response team structure is responsible for coordinating all response activities and making decisions about incident severity classification?

Accepted Answer

Incident response manager. The IR manager leads the team, coordinates activities, and classifies incidents based on severity.

Answer

Communications lead

Answer

Security analysts

Answer

Forensic investigators

Question 11

A security analyst detects a series of failed login attempts followed by a successful login from an unusual geographic location. The account is a standard user account. Which incident category best describes this scenario?

Accepted Answer

Account compromise. The scenario describes an account compromise where credentials are likely stolen and used to gain unauthorized access.

Answer

Data breach

Answer

Supply chain attack

Answer

Insider threat

Question 12

During a P1 incident involving a ransomware attack, the incident response manager needs to communicate with executives. Which of the following is the most appropriate approach for executive communication?

Accepted Answer

Send hourly situation reports (sitreps) focusing on business impact and key actions. For critical incidents, hourly sitreps (situation reports) are recommended to keep executives informed. Avoiding speculation and preserving legal privilege with counsel involvement are also key.

Answer

Include speculative root causes to show thoroughness

Answer

Wait until the incident is fully resolved before communicating

Answer

Provide detailed technical analysis in every update

Question 13

An organization is updating its incident response plan after a lessons learned meeting. Which of the following is the primary purpose of updating the plan based on lessons learned?

Accepted Answer

To incorporate improvements to prevent recurrence and enhance response. The primary purpose of updating an incident response plan after a lessons learned review is to feed identified gaps, control failures, and response inefficiencies back into the plan so future incidents are prevented or handled more effectively. This closes the continuous improvement loop central to frameworks like NIST SP 800-61 and ISO 27035. The update is a corrective and preventive action, not a documentation or blame exercise.

Answer

To assign blame for failures

Answer

To share threat intelligence with ISACs

Answer

To document the incident for regulatory compliance

Question 14

A company experiences a DDoS attack that overwhelms its internet-facing services. The incident response team implements mitigation measures. During which phase of incident response is it most appropriate to collect and preserve evidence for potential legal action?

Accepted Answer

During containment, eradication, and recovery. Evidence collection and preservation must begin the moment an incident is confirmed and continue through containment, eradication, and recovery, because volatile data such as memory, running processes, and network connections can be destroyed by the very actions taken to stop the attack. NIST SP 800-61 explicitly places evidence gathering within these handling phases, not only after the fact. Waiting until post-incident activity risks losing forensic artifacts needed for legal action, root-cause analysis, or law enforcement referral.

Answer

During preparation

Answer

During detection and analysis

Answer

During post-incident activity

Question 15

Which type of incident response exercise involves a facilitated discussion of a hypothetical scenario to review plans and procedures?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based session where participants, guided by a facilitator, walk through a hypothetical incident scenario to evaluate plans, procedures, and decision-making. It does not involve deploying actual resources or simulating live systems; instead, it focuses on reviewing roles, communication, and coordination. This matches the question's description of a facilitated discussion to review plans and procedures. Other exercise types involve more active or technical execution.

Answer

Full-scale exercise

Answer

Simulation

Answer

Drill