CISM Incident Management Practice Test 8 — 15 Questions

Question 1

Which TWO of the following are essential components of an incident response programme that should be established before an incident occurs? (Select TWO.)

Accepted Answer

A signed retainer agreement with a forensics firm. Option B is correct because a signed retainer agreement with a forensics firm is a pre-established arrangement that guarantees rapid access to specialized digital forensics and incident handling expertise when an incident occurs, avoiding delays from procurement or negotiation during a crisis. Option E is correct because an incident response team with clearly assigned roles and responsibilities is a foundational element of any incident response programme, ensuring that containment, eradication, recovery, and communication tasks are executed by accountable personnel per the incident response plan. The remaining options are not essential pre-incident components: A (an insurance claim form) is used after an incident to seek reimbursement, C (a list of affected customers) is an output of breach investigation and notification rather than a preparatory component, and D (a root cause analysis report from a previous incident) is a post-incident artifact that may inform lessons learned but is not required to establish the programme.

Answer

An insurance claim form for cyber incidents

Answer

A list of affected customers from the most recent data breach

Answer

A root cause analysis report from a previous incident

Question 2

Which TWO of the following are appropriate criteria for escalating an incident to the crisis management team (CMT)? (Select TWO.)

Accepted Answer

The incident could cause severe reputational damage. Option A is correct because an incident with the potential to cause severe reputational damage meets the threshold for CMT escalation, since crisis management is invoked when business reputation and stakeholder trust are at stake, not merely for technical containment. Option D is correct because potential for major financial loss or regulatory penalties is a classic CMT escalation trigger, as such consequences require executive-level decision-making, legal counsel, and communications coordination beyond the incident response team's scope. Options B, C, and E are not appropriate standalone criteria: novel malware, third-party origin, and multi-vendor coordination are operational or technical factors that the incident response team can typically handle through normal procedures, and they do not by themselves imply the enterprise-wide business impact that defines a crisis warranting CMT involvement.

Answer

The incident involves a new type of malware not seen before

Answer

The incident originated from a third-party supplier

Answer

The incident requires coordination with multiple external vendors

Question 3

Which THREE of the following are key activities during the post-incident phase of incident management? (Select THREE.)

Accepted Answer

Updating incident response plans and playbooks based on lessons learned. Option A is correct because the post-incident phase includes reviewing what happened and feeding lessons learned back into the incident response plan and playbooks so future responses improve. Option C is correct because root cause analysis, often using techniques such as 5 Whys or fishbone diagrams, is a core post-incident activity that identifies the underlying cause rather than just the symptom. Option D is correct because sharing indicators of compromise with relevant Information Sharing and Analysis Centers (ISACs) is a post-incident coordination activity that helps the broader community detect and defend against the same threat. Option B is not correct because activating the disaster recovery site is a response or recovery action, not a post-incident review activity. Option E is not correct because implementing immediate containment measures occurs during the containment phase of incident response, before the post-incident phase begins.

Answer

Activating the disaster recovery site

Answer

Implementing immediate containment measures

Question 4

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident, such as ransomware or data breach?

Accepted Answer

Incident response playbook. Playbooks (or runbooks) provide detailed procedures for specific incident types, while the IR plan is a broader document.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication template

Question 5

Which post-incident activity involves identifying the technical cause, the process failure that allowed it, and the management/governance failure that permitted the process failure?

Accepted Answer

Root cause analysis (RCA). Root cause analysis (RCA) digs into multiple layers to find underlying issues, often using techniques like 5 Whys or fishbone diagrams.

Answer

Lessons learned meeting

Answer

Incident closure report

Answer

Threat intelligence sharing

Question 6

Which incident severity level is characterized by major business impact, requires executive notification, and demands 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have the highest severity and require immediate, around-the-clock response.

Answer

P3 — Medium

Answer

P2 — High

Answer

P4 — Low

Question 7

An organization's incident response team has contained a data breach. Legal counsel has advised that litigation is likely. Which of the following actions should the team take to preserve evidence?

Accepted Answer

Issue a legal hold and create forensic images of affected systems. When litigation is anticipated, a legal hold must be issued to prevent destruction of relevant evidence, and forensic copies should be made before remediation.

Answer

Immediately wipe affected systems to prevent further data loss

Answer

Notify the affected individuals as required by law

Answer

Delete all logs to avoid exposing sensitive information

Question 8

During a major cybersecurity incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the CEO as a member of the CMT?

Accepted Answer

Authorizing external communications and resource allocation. The CEO provides strategic direction and approves major decisions, such as activating business continuity or communicating externally, while the CISO leads the technical response.

Answer

Updating the incident response playbook

Answer

Directing the technical containment efforts

Answer

Conducting forensic analysis of affected systems

Question 9

What is the recommended timeframe for holding a lessons learned meeting after an incident has been resolved?

Accepted Answer

Within 2 weeks. A lessons learned meeting is most effective when held within 2 weeks of incident resolution, while details are still fresh in participants' memories but after immediate recovery pressures have subsided. This window allows time to gather facts, review logs, and prepare meaningful discussion points without losing critical context. CISM best practice emphasizes timely but not rushed post-incident reviews to capture actionable improvements.

Answer

Within 1 month

Answer

Within 3 months

Answer

Within 24 hours

Question 10

Which of the following is a key reason to have a forensic retainer in place before an incident occurs?

Accepted Answer

To reduce the time needed to engage the firm when an incident occurs. Having a pre-negotiated contract reduces the time to engage forensic experts, which is critical during an incident.

Answer

To avoid the need for a chain of custody

Answer

To ensure the firm understands the organization's IT environment

Answer

To guarantee lower costs

Question 11

An incident response team is handling a supply chain compromise that has affected a critical business process. The estimated recovery time exceeds the maximum tolerable downtime (MTD). What should the incident manager do NEXT?

Accepted Answer

Escalate to the BC/DR team and the authority who can declare a disaster. When MTD is exceeded, the incident escalates to business continuity/disaster recovery activation. The BC/DR decision authority should be notified to declare a disaster and activate recovery plans.

Answer

Notify affected customers of the expected delay

Answer

Continue containment efforts and hope for a faster recovery

Answer

Shut down the affected system to prevent further impact

Question 12

Which of the following is a key objective of sharing threat intelligence, such as indicators of compromise (IoCs), with an Information Sharing and Analysis Center (ISAC)?

Accepted Answer

To receive timely threat information and contribute to community defense. The primary objective of sharing IoCs with an ISAC is bidirectional: the organization receives timely, sector-specific threat intelligence from peers and contributes its own observations to strengthen collective defense. ISACs are sector-based (e.g., FS-ISAC for financial services, H-ISAC for healthcare) and enable early warning of emerging threats. This mutual benefit is the core purpose of threat intelligence sharing.

Answer

To document the incident for insurance claims

Answer

To market the organization's security capabilities

Answer

To fulfill regulatory requirements for public disclosure

Question 13

Which incident category involves unauthorized access to systems or data by an individual within the organization?

Accepted Answer

Insider threat. Insider threat incidents are caused by employees, contractors, or other trusted insiders.

Answer

DDoS

Answer

Data breach

Answer

Ransomware

Question 14

Which of the following is the PRIMARY reason to include legal counsel in the incident response team?

Accepted Answer

To advise on legal obligations and protect privilege. Legal counsel ensures that actions taken during an incident preserve attorney-client privilege and comply with legal obligations, such as breach notification and litigation holds.

Answer

To communicate with the media

Answer

To authorize technical containment actions

Answer

To manage technical aspects of the investigation

Question 15

Which TWO of the following are required components of an incident response programme according to best practices? (Select two.)

Accepted Answer

Incident response policy. Option B (Incident response policy) is correct because best-practice frameworks such as NIST SP 800-61 and ISO/IEC 27035 require a formally approved policy that establishes the authority, scope, objectives, and management commitment for the incident response capability. Option C (Incident response plan) is correct because the plan is the documented, actionable set of procedures—roles, phases (preparation, detection and analysis, containment, eradication, recovery, post-incident activity), and escalation paths—that operationalizes the policy. The remaining items are supporting artifacts rather than required programme components: an IR team roster (A), communication templates (D), and a vendor contacts list (E) are useful appendices or resources referenced by the plan, but they are not themselves mandatory components of an incident response programme.

Answer

IR team roster

Answer

Communication templates

Answer

Vendor contacts list