CISM Incident Management Practice Test 7 — 15 Questions

Question 1

A company experiences a DDoS attack that overwhelms its internet-facing services. The incident response team implements mitigation measures. During which phase of incident response is it most appropriate to collect and preserve evidence for potential legal action?

Accepted Answer

During containment, eradication, and recovery. Evidence collection should occur during containment, eradication, and recovery, but ideally before remediation to preserve forensic data. In a DDoS, logs and traffic captures should be preserved early.

Answer

During preparation

Answer

During detection and analysis

Answer

During post-incident activity

Question 2

Which type of incident response exercise involves a facilitated discussion of a hypothetical scenario to review plans and procedures?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based exercise where team members walk through a scenario to identify strengths and gaps.

Answer

Full-scale exercise

Answer

Simulation

Answer

Drill

Question 3

An organization has a policy to share indicators of compromise (IoCs) with an Information Sharing and Analysis Center (ISAC). This activity is most closely associated with which phase of incident management?

Accepted Answer

Post-incident activity. Sharing IoCs with ISACs is a post-incident activity aimed at improving collective defense and preventing future incidents.

Answer

Preparation

Answer

Containment, eradication, and recovery

Answer

Detection and analysis

Question 4

Which TWO of the following are essential components of an incident response programme that should be established before an incident occurs? (Select TWO.)

Accepted Answer

A signed retainer agreement with a forensics firm. An IR team with defined roles and a signed retainer with a forensics firm are critical preparatory elements. The IR plan is also prepared, but the question asks for components established before an incident.

Answer

An insurance claim form for cyber incidents

Answer

A list of affected customers from the most recent data breach

Answer

A root cause analysis report from a previous incident

Question 5

Which TWO of the following are appropriate criteria for escalating an incident to the crisis management team (CMT)? (Select TWO.)

Accepted Answer

The incident could cause severe reputational damage. Potential for major financial loss or regulatory penalties and severe reputational damage are key triggers for CMT activation. Technical complexity alone is not sufficient.

Answer

The incident involves a new type of malware not seen before

Answer

The incident originated from a third-party supplier

Answer

The incident requires coordination with multiple external vendors

Question 6

Which THREE of the following are key activities during the post-incident phase of incident management? (Select THREE.)

Accepted Answer

Updating incident response plans and playbooks based on lessons learned. Root cause analysis, updating the IR plan/playbooks, and sharing IoCs with ISACs are all post-incident activities. Activating the DR site occurs during the response, not post-incident.

Answer

Activating the disaster recovery site

Answer

Implementing immediate containment measures

Question 7

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident, such as ransomware or data breach?

Accepted Answer

Incident response playbook. Playbooks (or runbooks) provide detailed procedures for specific incident types, while the IR plan is a broader document.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication template

Question 8

During a P1 (critical) security incident, which of the following is the MOST appropriate frequency for providing executive status updates?

Accepted Answer

Hourly situation reports (sitreps). For critical incidents, regular and frequent communication is required to keep executives informed.

Answer

At the end of the incident

Answer

Daily briefings

Answer

Only upon significant changes

Question 9

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is working on containment. Which communication should the incident manager prioritize FIRST?

Accepted Answer

Notify the executive sponsor, legal counsel, and communications lead. Immediate containment and notification of key internal stakeholders (executive sponsor, legal, communications) is the first priority to coordinate response and manage legal/regulatory obligations.

Answer

Contact the organization's cyber insurance provider

Answer

Notify law enforcement

Answer

Issue a press release

Question 10

Which post-incident activity involves identifying the technical cause, the process failure that allowed it, and the management/governance failure that permitted the process failure?

Accepted Answer

Root cause analysis (RCA). Root cause analysis (RCA) digs into multiple layers to find underlying issues, often using techniques like 5 Whys or fishbone diagrams.

Answer

Lessons learned meeting

Answer

Incident closure report

Answer

Threat intelligence sharing

Question 11

Which incident severity level is characterized by major business impact, requires executive notification, and demands 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have the highest severity and require immediate, around-the-clock response.

Answer

P3 — Medium

Answer

P2 — High

Answer

P4 — Low

Question 12

An organization's incident response team has contained a data breach. Legal counsel has advised that litigation is likely. Which of the following actions should the team take to preserve evidence?

Accepted Answer

Issue a legal hold and create forensic images of affected systems. When litigation is anticipated, a legal hold must be issued to prevent destruction of relevant evidence, and forensic copies should be made before remediation.

Answer

Immediately wipe affected systems to prevent further data loss

Answer

Notify the affected individuals as required by law

Answer

Delete all logs to avoid exposing sensitive information

Question 13

During a major cybersecurity incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the CEO as a member of the CMT?

Accepted Answer

Authorizing external communications and resource allocation. The CEO provides strategic direction and approves major decisions, such as activating business continuity or communicating externally, while the CISO leads the technical response.

Answer

Updating the incident response playbook

Answer

Directing the technical containment efforts

Answer

Conducting forensic analysis of affected systems

Question 14

What is the recommended timeframe for holding a lessons learned meeting after an incident has been resolved?

Accepted Answer

Within 2 weeks. Conducting the meeting within two weeks ensures details are fresh and improvements can be implemented quickly.

Answer

Within 1 month

Answer

Within 3 months

Answer

Within 24 hours

Question 15

Which of the following is a key reason to have a forensic retainer in place before an incident occurs?

Accepted Answer

To reduce the time needed to engage the firm when an incident occurs. Having a pre-negotiated contract reduces the time to engage forensic experts, which is critical during an incident.

Answer

To avoid the need for a chain of custody

Answer

To ensure the firm understands the organization's IT environment

Answer

To guarantee lower costs