CISM Incident Management Practice Test 8 — 15 Questions

Question 1

An incident response team is handling a supply chain compromise that has affected a critical business process. The estimated recovery time exceeds the maximum tolerable downtime (MTD). What should the incident manager do NEXT?

Accepted Answer

Escalate to the BC/DR team and the authority who can declare a disaster. When MTD is exceeded, the incident escalates to business continuity/disaster recovery activation. The BC/DR decision authority should be notified to declare a disaster and activate recovery plans.

Answer

Notify affected customers of the expected delay

Answer

Continue containment efforts and hope for a faster recovery

Answer

Shut down the affected system to prevent further impact

Question 2

Which of the following is a key objective of sharing threat intelligence, such as indicators of compromise (IoCs), with an Information Sharing and Analysis Center (ISAC)?

Accepted Answer

To receive timely threat information and contribute to community defense. Sharing IoCs helps other organizations detect and defend against similar threats, improving collective security.

Answer

To document the incident for insurance claims

Answer

To market the organization's security capabilities

Answer

To fulfill regulatory requirements for public disclosure

Question 3

Which incident category involves unauthorized access to systems or data by an individual within the organization?

Accepted Answer

Insider threat. Insider threat incidents are caused by employees, contractors, or other trusted insiders.

Answer

DDoS

Answer

Data breach

Answer

Ransomware

Question 4

An organization has experienced a P2 incident. According to standard incident severity definitions, which response timeframe is typically expected?

Accepted Answer

Response during business hours. P2 (high) incidents require a response during business hours, as they have significant but not critical impact.

Answer

Scheduled remediation at the next maintenance window

Answer

Response within 72 hours

Answer

24/7 response until resolved

Question 5

A security analyst suspects a credential compromise involving an executive's account. The analyst has isolated the system. What should be the NEXT step according to best practices?

Accepted Answer

Create a forensic image of the affected system. Before any remediation, preserving evidence (forensic image) is critical for investigation and potential legal action. Then notify the incident manager to follow the playbook.

Answer

Block the account in Active Directory

Answer

Notify the executive and ask them to change their password

Answer

Reset the executive's password immediately

Question 6

Which of the following is the PRIMARY reason to include legal counsel in the incident response team?

Accepted Answer

To advise on legal obligations and protect privilege. Legal counsel ensures that actions taken during an incident preserve attorney-client privilege and comply with legal obligations, such as breach notification and litigation holds.

Answer

To communicate with the media

Answer

To authorize technical containment actions

Answer

To manage technical aspects of the investigation

Question 7

Which TWO of the following are required components of an incident response programme according to best practices? (Select two.)

Accepted Answer

Incident response policy. The incident response policy is the foundational document that establishes management's commitment, defines roles and responsibilities, and sets the scope and authority for the incident response programme. Without a formal policy, the programme lacks organizational mandate and cannot enforce compliance with incident handling procedures.

Answer

IR team roster

Answer

Communication templates

Answer

Vendor contacts list

Question 8

Which THREE of the following are appropriate members of a crisis management team (CMT) for a major cybersecurity incident? (Select three.)

Accepted Answer

General Counsel (GC). The General Counsel (GC) is a critical member of the CMT because a major cybersecurity incident (e.g., a data breach involving PII) triggers legal obligations under regulations like GDPR, HIPAA, or SOX. The GC provides real-time advice on legal hold, breach notification timelines, and attorney-client privilege, ensuring the organization's response does not create additional liability or waive legal protections.

Answer

Security analyst

Answer

Forensic investigator

Question 9

Which TWO of the following are typical notification deadlines for regulatory reporting of a data breach? (Select two.)

Accepted Answer

4 business days (SEC proposed). GDPR requires notification within 72 hours. The SEC proposed rule requires notification within 4 business days for material cybersecurity incidents.

Answer

30 days

Answer

7 days

Answer

24 hours

Question 10

Which THREE of the following are objectives of a lessons learned meeting after an incident? (Select three.)

Accepted Answer

Determine what worked well and what did not. Lessons learned meetings aim to identify what happened, what worked well, and what didn't, and to develop recommendations for improvement. Sharing IoCs with ISACs is a separate activity, not a meeting objective.

Answer

Assign blame for the incident

Answer

Share indicators of compromise with an ISAC

Question 11

Which component of an incident response program is most likely to include step-by-step technical actions for addressing a specific type of security incident?

Accepted Answer

Incident response playbook. An incident response playbook provides detailed, step-by-step technical procedures for handling specific incident types (e.g., ransomware, DDoS, phishing). Unlike higher-level documents, playbooks contain actionable commands, tool-specific instructions, and decision trees that guide responders through containment, eradication, and recovery. This granularity ensures consistent and efficient execution during an active security event.

Answer

Communication templates

Answer

Incident response policy

Answer

Incident response plan

Question 12

During a P1 (critical) security incident involving a ransomware attack that has encrypted critical servers, which role is primarily responsible for coordinating the overall response and ensuring timely communication to executive leadership?

Accepted Answer

Incident response manager. In a P1 ransomware incident, the incident response manager (IRM) is responsible for orchestrating the overall response, prioritizing containment over eradication, and ensuring that executive leadership receives timely, accurate status updates. Unlike technical roles, the IRM owns the incident command structure, coordinates cross-functional teams, and manages communication escalations to stakeholders, which is critical when encrypted servers demand immediate business continuity decisions.

Answer

Security analyst

Answer

Forensic investigator

Answer

Communications lead

Question 13

During a data breach investigation, the legal counsel advises the incident response team to ensure that communications with external forensic experts are protected by attorney-client privilege. Which action best preserves this privilege?

Accepted Answer

Engaging the forensic firm through legal counsel and ensuring that their work is done at the direction of legal. Engaging the forensic firm through legal counsel and having them work under the direction of legal helps protect communications under attorney-client privilege. Direct engagement by the business may waive privilege.

Answer

Using a pre-existing retainer agreement without legal involvement

Answer

Having the forensic firm report directly to the CISO

Answer

Having the forensic firm sign a non-disclosure agreement

Question 14

After a P2 (high) incident is resolved, the incident response team conducts a lessons learned meeting. Which timeframe is most appropriate for holding this meeting?

Accepted Answer

Within 2 weeks of incident resolution. Industry best practices and many frameworks recommend holding a lessons learned meeting within two weeks of incident resolution while details are still fresh.

Answer

Immediately after containment

Answer

Only after the root cause analysis is completed

Answer

Within 30 days of incident resolution

Question 15

When an incident cannot be resolved within the maximum tolerable downtime (MTD), what is the appropriate action regarding business continuity and disaster recovery (BC/DR)?

Accepted Answer

Escalate to the BC/DR team for possible activation of continuity plans. If the MTD is at risk, the incident response team should escalate to BC/DR to activate continuity or recovery plans. This ensures business functions are restored.

Answer

Ignore the MTD and focus solely on incident eradication

Answer

Continue incident response until full recovery

Answer

Declare a disaster immediately without further analysis