CISM Incident Management Practice Test 9 — 15 Questions

Question 1

Which THREE of the following are appropriate members of a crisis management team (CMT) for a major cybersecurity incident? (Select three.)

Accepted Answer

General Counsel (GC). The General Counsel (GC) is a correct CMT member because major cybersecurity incidents carry legal, regulatory, contractual, and disclosure obligations, so the GC advises on breach notification laws, litigation risk, and privilege. The Chief Information Security Officer (CISO) is correct because the CISO owns the security program and provides executive-level technical and strategic leadership for incident response decisions. The Chief Executive Officer (CEO) is correct because a major incident can threaten the entire organization, and the CEO holds ultimate authority for business continuity, stakeholder communication, and resource commitment. A security analyst and a forensic investigator are not appropriate CMT members; they are operational/technical responders who perform hands-on triage and evidence analysis and report to the CMT rather than sitting on it.

Answer

Security analyst

Answer

Forensic investigator

Question 2

Which TWO of the following are typical notification deadlines for regulatory reporting of a data breach? (Select two.)

Accepted Answer

4 business days (SEC proposed). Option A (4 business days, SEC proposed) is correct because the U.S. Securities and Exchange Commission's proposed rules for public companies would require disclosure of material cybersecurity incidents on Form 8-K within four business days of determining that the incident is material. Option C (72 hours, GDPR) is correct because Article 33 of the EU General Data Protection Regulation requires controllers to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it. The remaining options do not match these regulatory frameworks: 30 days (B) is not the standard GDPR or SEC notification deadline, 7 days (D) is not specified by either regime, and 24 hours (E) is a shorter window than either the SEC's four-business-day or GDPR's 72-hour requirement.

Answer

30 days

Answer

7 days

Answer

24 hours

Question 3

Which THREE of the following are objectives of a lessons learned meeting after an incident? (Select three.)

Accepted Answer

Determine what worked well and what did not. Option A is correct because a lessons learned (post-incident) meeting evaluates the incident response to determine what worked well and what did not, so successful practices can be reinforced and gaps addressed. Option D is correct because the meeting's output includes recommendations for improvement, such as updating procedures, controls, or training to prevent recurrence or improve future response. Option E is correct because identifying what happened during the incident — reconstructing the timeline, root cause, and scope — is a core objective that grounds the analysis and subsequent recommendations. Option B is not an objective; lessons learned meetings are blameless and focus on process improvement rather than assigning fault. Option C is not an objective of the meeting itself; sharing indicators of compromise with an ISAC is a separate threat-intelligence activity that may occur, but it is not a stated goal of the lessons learned session.

Answer

Assign blame for the incident

Answer

Share indicators of compromise with an ISAC

Question 4

Which component of an incident response program is most likely to include step-by-step technical actions for addressing a specific type of security incident?

Accepted Answer

Incident response playbook. An incident response playbook provides detailed, step-by-step technical procedures for handling specific incident types (e.g., ransomware, DDoS, phishing). Unlike higher-level documents, playbooks contain actionable commands, tool-specific instructions, and decision trees that guide responders through containment, eradication, and recovery. This granularity ensures consistent and efficient execution during an active security event.

Answer

Communication templates

Answer

Incident response policy

Answer

Incident response plan

Question 5

During a P1 (critical) security incident involving a ransomware attack that has encrypted critical servers, which role is primarily responsible for coordinating the overall response and ensuring timely communication to executive leadership?

Accepted Answer

Incident response manager. In a P1 ransomware incident, the incident response manager (IRM) is responsible for orchestrating the overall response, prioritizing containment over eradication, and ensuring that executive leadership receives timely, accurate status updates. Unlike technical roles, the IRM owns the incident command structure, coordinates cross-functional teams, and manages communication escalations to stakeholders, which is critical when encrypted servers demand immediate business continuity decisions.

Answer

Security analyst

Answer

Forensic investigator

Answer

Communications lead

Question 6

During a data breach investigation, the legal counsel advises the incident response team to ensure that communications with external forensic experts are protected by attorney-client privilege. Which action best preserves this privilege?

Accepted Answer

Engaging the forensic firm through legal counsel and ensuring that their work is done at the direction of legal. Attorney-client privilege is preserved when the forensic firm is engaged by and works at the direction of legal counsel, so their communications and work product fall under the privilege umbrella. This structure ensures the forensic investigation is treated as legal work rather than ordinary business consulting. NDAs and reporting lines do not create privilege.

Answer

Using a pre-existing retainer agreement without legal involvement

Answer

Having the forensic firm report directly to the CISO

Answer

Having the forensic firm sign a non-disclosure agreement

Question 7

After a P2 (high) incident is resolved, the incident response team conducts a lessons learned meeting. Which timeframe is most appropriate for holding this meeting?

Accepted Answer

Within 2 weeks of incident resolution. Holding the lessons learned meeting within about two weeks of resolution balances memory freshness with enough time to gather facts and complete preliminary analysis. It is soon enough that details are still accurate but late enough that the team is no longer in firefighting mode. This aligns with common IR frameworks like NIST SP 800-61.

Answer

Immediately after containment

Answer

Only after the root cause analysis is completed

Answer

Within 30 days of incident resolution

Question 8

When an incident cannot be resolved within the maximum tolerable downtime (MTD), what is the appropriate action regarding business continuity and disaster recovery (BC/DR)?

Accepted Answer

Escalate to the BC/DR team for possible activation of continuity plans. The Maximum Tolerable Downtime (MTD) is the longest time a business process can be unavailable before causing unacceptable impact. When an incident cannot be resolved within the MTD, the appropriate action is to escalate to the BC/DR team so they can decide whether to activate continuity plans (e.g., failover to alternate sites, manual workarounds). Continuing incident response past the MTD without invoking BC/DR risks exceeding the organization's tolerance for downtime.

Answer

Ignore the MTD and focus solely on incident eradication

Answer

Continue incident response until full recovery

Answer

Declare a disaster immediately without further analysis

Question 9

Which incident category typically involves an employee intentionally or accidentally causing harm to the organization's information systems?

Accepted Answer

Insider threat. An insider threat is the correct category because it specifically involves harm caused by individuals within the organization, whether through malicious intent (e.g., data exfiltration, sabotage) or accidental actions (e.g., misconfiguration, phishing click). This aligns with the CISM definition of insider threats as incidents originating from employees, contractors, or trusted partners who have authorized access to information systems.

Answer

Data breach

Answer

DDoS

Answer

Ransomware

Question 10

During a P1 incident, the crisis management team (CMT) is activated and meets within the first hour. Which communication practice is most appropriate for the CMT to follow when providing updates to the board of directors?

Accepted Answer

Send a brief status report every hour, avoiding speculation and including legal counsel review. During a P1 incident, the CMT must provide timely, concise updates to the board to maintain trust and enable strategic decisions. Option A is correct because it balances frequency (hourly) with content discipline (avoiding speculation) and includes legal counsel review, which is critical for compliance and liability management. This aligns with the CISM Incident Management domain's emphasis on clear, non-technical communication to senior leadership.

Answer

Provide detailed technical updates every hour

Answer

Provide speculative root cause analysis to demonstrate competence

Answer

Wait until the incident is fully understood before any communication

Question 11

Which of the following is the primary purpose of conducting a root cause analysis (RCA) after a security incident?

Accepted Answer

To determine process and governance failures that allowed the incident to occur. RCA aims to identify underlying causes to prevent recurrence. While it may involve understanding the technical cause, the ultimate goal is to improve processes and controls.

Answer

To identify the technical vulnerability that was exploited

Answer

To satisfy regulatory reporting requirements

Answer

To assign blame to responsible individuals

Question 12

An organization is updating its incident response plan after a major incident. Which post-incident activity should be performed to ensure the plan reflects lessons learned?

Accepted Answer

Updating the IR plan and playbooks based on lessons learned. Updating the IR plan and playbooks based on lessons learned is the definitive post-incident activity that directly incorporates findings from the after-action review into the operational documentation. This ensures the plan reflects actual gaps or improvements identified during the incident, making it actionable for future events. Without this update, the plan remains static and fails to evolve with the organization's threat landscape.

Answer

Sharing indicators of compromise with an ISAC

Answer

Revising the IR policy

Answer

Conducting a tabletop exercise

Question 13

A company discovers a credential compromise affecting multiple user accounts. According to best practices, what is the first step the incident response team should take?

Accepted Answer

Disable compromised accounts and reset passwords. When a credential compromise is discovered, the immediate priority is containment to prevent further unauthorized access. Disabling compromised accounts and resetting passwords (Option B) stops the attacker from using the stolen credentials, aligning with the NIST SP 800-61 incident response lifecycle's containment phase. This action directly mitigates the active threat before any forensic analysis or notification occurs.

Answer

Conduct a root cause analysis

Answer

Contact law enforcement

Answer

Notify affected users immediately

Question 14

Which of the following is an example of an external stakeholder that should be included in the incident response plan's vendor contacts list?

Accepted Answer

External legal counsel. External legal counsel is an external stakeholder because they are not employees of the organization but are engaged to provide specialized legal advice during incidents. In an incident response plan, vendor contacts must include external parties such as legal counsel, forensic firms, and PR agencies who can be called upon when needed. The CISO, incident response manager, and board of directors are all internal roles and would not be listed as vendor contacts.

Answer

Chief Information Security Officer

Answer

Incident response manager

Answer

Board of directors

Question 15

Which TWO of the following are key responsibilities of the crisis management team (CMT) during a major cybersecurity incident?

Accepted Answer

Approving external communications and public statements. Option B is correct because the crisis management team owns the incident's external-facing messaging, ensuring that all press releases, customer notifications, and regulatory disclosures are reviewed and approved before release to protect the organization's reputation and legal standing. Option E is correct because the CMT is a strategic decision-making body that determines whether to invoke business continuity or disaster recovery plans, weighing operational impact, safety, and financial consequences rather than performing hands-on technical work. Options A, C, and D are incorrect because restoring backups, analyzing logs to find the attack vector, and conducting forensic analysis of compromised systems are tactical, technical tasks performed by incident response handlers, forensic analysts, and system administrators, not by the strategic CMT.

Answer

Restoring backups of affected servers

Answer

Analyzing log files to identify the attack vector

Answer

Conducting technical forensic analysis of compromised systems