CISM Incident Management Practice Test 8 — 15 Questions

Question 1

An organization's incident response team has contained a data breach. Legal counsel has advised that litigation is likely. Which of the following actions should the team take to preserve evidence?

Accepted Answer

Issue a legal hold and create forensic images of affected systems. When litigation is anticipated, a legal hold must be issued to prevent destruction of relevant evidence, and forensic copies should be made before remediation.

Answer

Immediately wipe affected systems to prevent further data loss

Answer

Notify the affected individuals as required by law

Answer

Delete all logs to avoid exposing sensitive information

Question 2

During a major cybersecurity incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the CEO as a member of the CMT?

Accepted Answer

Authorizing external communications and resource allocation. The CEO provides strategic direction and approves major decisions, such as activating business continuity or communicating externally, while the CISO leads the technical response.

Answer

Updating the incident response playbook

Answer

Directing the technical containment efforts

Answer

Conducting forensic analysis of affected systems

Question 3

What is the recommended timeframe for holding a lessons learned meeting after an incident has been resolved?

Accepted Answer

Within 2 weeks. Conducting the meeting within two weeks ensures details are fresh and improvements can be implemented quickly.

Answer

Within 1 month

Answer

Within 3 months

Answer

Within 24 hours

Question 4

Which of the following is a key reason to have a forensic retainer in place before an incident occurs?

Accepted Answer

To reduce the time needed to engage the firm when an incident occurs. Having a pre-negotiated contract reduces the time to engage forensic experts, which is critical during an incident.

Answer

To avoid the need for a chain of custody

Answer

To ensure the firm understands the organization's IT environment

Answer

To guarantee lower costs

Question 5

An incident response team is handling a supply chain compromise that has affected a critical business process. The estimated recovery time exceeds the maximum tolerable downtime (MTD). What should the incident manager do NEXT?

Accepted Answer

Escalate to the BC/DR team and the authority who can declare a disaster. When MTD is exceeded, the incident escalates to business continuity/disaster recovery activation. The BC/DR decision authority should be notified to declare a disaster and activate recovery plans.

Answer

Notify affected customers of the expected delay

Answer

Continue containment efforts and hope for a faster recovery

Answer

Shut down the affected system to prevent further impact

Question 6

Which of the following is a key objective of sharing threat intelligence, such as indicators of compromise (IoCs), with an Information Sharing and Analysis Center (ISAC)?

Accepted Answer

To receive timely threat information and contribute to community defense. Sharing IoCs helps other organizations detect and defend against similar threats, improving collective security.

Answer

To document the incident for insurance claims

Answer

To market the organization's security capabilities

Answer

To fulfill regulatory requirements for public disclosure

Question 7

Which incident category involves unauthorized access to systems or data by an individual within the organization?

Accepted Answer

Insider threat. Insider threat incidents are caused by employees, contractors, or other trusted insiders.

Answer

DDoS

Answer

Data breach

Answer

Ransomware

Question 8

An organization has experienced a P2 incident. According to standard incident severity definitions, which response timeframe is typically expected?

Accepted Answer

Response during business hours. P2 (high) incidents require a response during business hours, as they have significant but not critical impact.

Answer

Scheduled remediation at the next maintenance window

Answer

Response within 72 hours

Answer

24/7 response until resolved

Question 9

A security analyst suspects a credential compromise involving an executive's account. The analyst has isolated the system. What should be the NEXT step according to best practices?

Accepted Answer

Create a forensic image of the affected system. Before any remediation, preserving evidence (forensic image) is critical for investigation and potential legal action. Then notify the incident manager to follow the playbook.

Answer

Block the account in Active Directory

Answer

Notify the executive and ask them to change their password

Answer

Reset the executive's password immediately

Question 10

Which of the following is the PRIMARY reason to include legal counsel in the incident response team?

Accepted Answer

To advise on legal obligations and protect privilege. Legal counsel ensures that actions taken during an incident preserve attorney-client privilege and comply with legal obligations, such as breach notification and litigation holds.

Answer

To communicate with the media

Answer

To authorize technical containment actions

Answer

To manage technical aspects of the investigation

Question 11

Which THREE of the following are appropriate members of a crisis management team (CMT) for a major cybersecurity incident? (Select three.)

Accepted Answer

General Counsel (GC). The General Counsel (GC) is a critical member of the CMT because a major cybersecurity incident (e.g., a data breach involving PII) triggers legal obligations under regulations like GDPR, HIPAA, or SOX. The GC provides real-time advice on legal hold, breach notification timelines, and attorney-client privilege, ensuring the organization's response does not create additional liability or waive legal protections.

Answer

Security analyst

Answer

Forensic investigator

Question 12

Which TWO of the following are typical notification deadlines for regulatory reporting of a data breach? (Select two.)

Accepted Answer

4 business days (SEC proposed). GDPR requires notification within 72 hours. The SEC proposed rule requires notification within 4 business days for material cybersecurity incidents.

Answer

30 days

Answer

7 days

Answer

24 hours

Question 13

Which THREE of the following are objectives of a lessons learned meeting after an incident? (Select three.)

Accepted Answer

Determine what worked well and what did not. Lessons learned meetings aim to identify what happened, what worked well, and what didn't, and to develop recommendations for improvement. Sharing IoCs with ISACs is a separate activity, not a meeting objective.

Answer

Assign blame for the incident

Answer

Share indicators of compromise with an ISAC

Question 14

Which component of an incident response program is most likely to include step-by-step technical actions for addressing a specific type of security incident?

Accepted Answer

Incident response playbook. An incident response playbook provides detailed, step-by-step technical procedures for handling specific incident types (e.g., ransomware, DDoS, phishing). Unlike higher-level documents, playbooks contain actionable commands, tool-specific instructions, and decision trees that guide responders through containment, eradication, and recovery. This granularity ensures consistent and efficient execution during an active security event.

Answer

Communication templates

Answer

Incident response policy

Answer

Incident response plan

Question 15

During a P1 (critical) security incident involving a ransomware attack that has encrypted critical servers, which role is primarily responsible for coordinating the overall response and ensuring timely communication to executive leadership?

Accepted Answer

Incident response manager. In a P1 ransomware incident, the incident response manager (IRM) is responsible for orchestrating the overall response, prioritizing containment over eradication, and ensuring that executive leadership receives timely, accurate status updates. Unlike technical roles, the IRM owns the incident command structure, coordinates cross-functional teams, and manages communication escalations to stakeholders, which is critical when encrypted servers demand immediate business continuity decisions.

Answer

Security analyst

Answer

Forensic investigator

Answer

Communications lead