CISM Incident Management Practice Test 9 — 15 Questions

Question 1

During a data breach investigation, the legal counsel advises the incident response team to ensure that communications with external forensic experts are protected by attorney-client privilege. Which action best preserves this privilege?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Engaging the forensic firm through legal counsel and ensuring that their work is done at the direction of legal. Engaging the forensic firm through legal counsel and having them work under the direction of legal helps protect communications under attorney-client privilege. Direct engagement by the business may waive privilege.

Answer

Using a pre-existing retainer agreement without legal involvement

Answer

Having the forensic firm report directly to the CISO

Answer

Having the forensic firm sign a non-disclosure agreement

Question 2

After a P2 (high) incident is resolved, the incident response team conducts a lessons learned meeting. Which timeframe is most appropriate for holding this meeting?

Accepted Answer

Within 2 weeks of incident resolution. Industry best practices and many frameworks recommend holding a lessons learned meeting within two weeks of incident resolution while details are still fresh.

Answer

Immediately after containment

Answer

Only after the root cause analysis is completed

Answer

Within 30 days of incident resolution

Question 3

When an incident cannot be resolved within the maximum tolerable downtime (MTD), what is the appropriate action regarding business continuity and disaster recovery (BC/DR)?

Accepted Answer

Escalate to the BC/DR team for possible activation of continuity plans. If the MTD is at risk, the incident response team should escalate to BC/DR to activate continuity or recovery plans. This ensures business functions are restored.

Answer

Ignore the MTD and focus solely on incident eradication

Answer

Continue incident response until full recovery

Answer

Declare a disaster immediately without further analysis

Question 4

Which incident category typically involves an employee intentionally or accidentally causing harm to the organization's information systems?

Accepted Answer

Insider threat. An insider threat is the correct category because it specifically involves harm caused by individuals within the organization, whether through malicious intent (e.g., data exfiltration, sabotage) or accidental actions (e.g., misconfiguration, phishing click). This aligns with the CISM definition of insider threats as incidents originating from employees, contractors, or trusted partners who have authorized access to information systems.

Answer

Data breach

Answer

DDoS

Answer

Ransomware

Question 5

During a P1 incident, the crisis management team (CMT) is activated and meets within the first hour. Which communication practice is most appropriate for the CMT to follow when providing updates to the board of directors?

Accepted Answer

Send a brief status report every hour, avoiding speculation and including legal counsel review. During a P1 incident, the CMT must provide timely, concise updates to the board to maintain trust and enable strategic decisions. Option A is correct because it balances frequency (hourly) with content discipline (avoiding speculation) and includes legal counsel review, which is critical for compliance and liability management. This aligns with the CISM Incident Management domain's emphasis on clear, non-technical communication to senior leadership.

Answer

Provide detailed technical updates every hour

Answer

Provide speculative root cause analysis to demonstrate competence

Answer

Wait until the incident is fully understood before any communication

Question 6

Which of the following is the primary purpose of conducting a root cause analysis (RCA) after a security incident?

Accepted Answer

To determine process and governance failures that allowed the incident to occur. RCA aims to identify underlying causes to prevent recurrence. While it may involve understanding the technical cause, the ultimate goal is to improve processes and controls.

Answer

To identify the technical vulnerability that was exploited

Answer

To satisfy regulatory reporting requirements

Answer

To assign blame to responsible individuals

Question 7

In the context of incident severity classification, which of the following best describes a P3 (medium) incident?

Accepted Answer

Limited impact with standard response and no immediate escalation. A P3 (medium) incident is defined as having limited impact on business operations, allowing for a standard response during normal business hours without requiring immediate escalation. This classification typically applies to incidents that do not affect critical systems or sensitive data, and can be resolved through normal change management processes without urgent intervention.

Answer

Significant impact requiring management notification and business hours response

Answer

Minimal impact with scheduled remediation

Answer

Critical business impact requiring 24/7 response and executive notification

Question 8

An organization is updating its incident response plan after a major incident. Which post-incident activity should be performed to ensure the plan reflects lessons learned?

Accepted Answer

Updating the IR plan and playbooks based on lessons learned. Updating the IR plan and playbooks based on lessons learned is the definitive post-incident activity that directly incorporates findings from the after-action review into the operational documentation. This ensures the plan reflects actual gaps or improvements identified during the incident, making it actionable for future events. Without this update, the plan remains static and fails to evolve with the organization's threat landscape.

Answer

Sharing indicators of compromise with an ISAC

Answer

Revising the IR policy

Answer

Conducting a tabletop exercise

Question 9

Under the proposed SEC rules for cybersecurity incident disclosure, what is the timeframe for reporting a material cybersecurity incident?

Accepted Answer

Within 4 business days. The proposed SEC rules require reporting within 4 business days for material cybersecurity incidents. GDPR requires 72 hours for personal data breaches.

Answer

Within 7 calendar days

Answer

Within 72 hours

Answer

Within 24 hours

Question 10

Which of the following is an example of an external stakeholder that should be included in the incident response plan's vendor contacts list?

Accepted Answer

External legal counsel. Third-party contacts such as legal firms, forensic investigators, PR agencies, and insurance providers are essential for incident response. Internal contacts are separate.

Answer

Chief Information Security Officer

Answer

Incident response manager

Answer

Board of directors

Question 11

Which TWO of the following are key responsibilities of the crisis management team (CMT) during a major cybersecurity incident?

Accepted Answer

Approving external communications and public statements. The crisis management team (CMT) is responsible for high-level strategic decisions, including approving external communications and public statements to manage reputation and legal exposure during a major cybersecurity incident. This aligns with the CMT's role in coordinating response efforts and ensuring consistent messaging, as defined in incident management frameworks like NIST SP 800-61.

Answer

Restoring backups of affected servers

Answer

Analyzing log files to identify the attack vector

Answer

Conducting technical forensic analysis of compromised systems

Question 12

Which THREE of the following are essential elements of a forensic evidence handling procedure to ensure admissibility in court?

Accepted Answer

Placing a legal hold on relevant data. A legal hold is essential because it suspends the normal data retention and deletion policies, ensuring that potentially relevant evidence is preserved from alteration or destruction. This is a foundational step in the e-discovery process and directly supports the admissibility of evidence by demonstrating that the organization took proactive steps to prevent spoliation.

Answer

Performing analysis directly on original systems

Answer

Using automated tools without validation

Question 13

During a P1 (critical) incident involving a ransomware attack that has encrypted critical systems, the incident manager needs to provide updates to executives. What is the recommended frequency for situation reports (sitreps)?

Accepted Answer

Hourly. For P1 incidents, hourly sitreps keep executives informed of rapidly evolving situations.

Answer

Only at milestone events

Answer

Every 4 hours

Answer

Daily

Question 14

A security analyst discovers that an employee's credentials were used to access a sensitive database containing customer PII. The analyst immediately disables the account and begins remediation. Which incident category best describes this scenario?

Accepted Answer

Account compromise. The incident involves unauthorized use of legitimate credentials to access a sensitive database, which is the defining characteristic of an account compromise. The immediate disabling of the account and remediation aligns with standard incident response procedures for credential theft, where the attacker has gained authenticated access without authorization. This is distinct from a data breach, which focuses on the exfiltration or exposure of data, not the method of access.

Answer

Data breach

Answer

Physical security

Answer

Insider threat

Question 15

Following containment of a ransomware incident, the incident response team is conducting a root cause analysis. Which method involves repeatedly asking 'why' to drill down to underlying causes?

Accepted Answer

5 Whys. The 5 Whys technique is a simple root cause analysis method that iteratively asks 'why' to move from symptoms to root causes.

Answer

Pareto analysis

Answer

SWOT analysis

Answer

Fishbone diagram