CISM Incident Management — Timed 10 Questions

Question 1

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

10 minute time limit — choose an answer to begin.

Accepted Answer

To preserve attorney-client privilege and avoid creating damaging records. Legal counsel involvement helps protect communications under attorney-client privilege and avoids speculation that could create liability.

Answer

To approve technical containment actions

Answer

To coordinate with external forensics firms

Answer

To ensure compliance with regulatory notification deadlines

Question 2

After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?

Accepted Answer

Supply chain. Supply chain incidents involve attacks through third-party vendors or partners, even if the initial vector is credential compromise.

Answer

Insider threat

Answer

Account compromise

Answer

DDoS

Question 3

During a major security incident classified as P1, which of the following is the MOST appropriate communication frequency to the executive team?

Accepted Answer

Hourly situation reports (sitreps). For P1 (critical) incidents, hourly situation reports (sitreps) are expected to keep executives informed of rapidly evolving events.

Answer

Daily summary reports

Answer

Only upon significant changes

Answer

At the end of the incident

Question 4

Which of the following is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a step-by-step guide for responding to incidents. The IR plan provides a structured approach to manage incidents, minimizing impact and ensuring efficient response.

Answer

To document vendor contacts only

Answer

To assign blame for security failures

Answer

To replace the need for incident response training

Question 5

During a DDoS attack classified as P2, what is the EXPECTED response time and notification level?

Accepted Answer

Business hours response; management notification. P2 incidents require management notification and a response during business hours.

Answer

Standard response; team lead notification

Answer

24/7 response; executive notification

Answer

Scheduled remediation; email notification

Question 6

When should an incident response transition to business continuity and disaster recovery (BC/DR) activation?

Accepted Answer

When the incident cannot be resolved within the maximum tolerable downtime (MTD). BC/DR is activated when the incident cannot be resolved within the maximum tolerable downtime (MTD).

Answer

Immediately upon detection of any incident

Answer

Only after the incident is fully contained

Answer

When the incident exceeds the recovery time objective (RTO) but is still within MTD

Question 7

Which of the following is the FIRST step when engaging an external forensics firm for an incident?

Accepted Answer

Activate the forensic retainer agreement. Having a pre-existing retainer agreement reduces time to engage and ensures terms are already in place.

Answer

Provide evidence to the firm

Answer

Define the scope of work

Answer

Sign a non-disclosure agreement

Question 8

Which TWO of the following are key roles on the crisis management team (CMT) for a major cybersecurity incident? (Select two.)

Accepted Answer

Chief Information Security Officer (CISO). The Chief Information Security Officer (CISO) is a key CMT role because this executive owns the security program, provides incident-strategy guidance, and acts as the primary interface between technical responders and executive leadership during a major cybersecurity incident. The Chief Executive Officer (CEO) is also a key CMT role because major incidents require executive-level decisions on business continuity, resource allocation, legal/regulatory notifications, and public communications, and the CEO holds ultimate accountability for the organization's response. By contrast, a security analyst, help desk manager, and network administrator are operational or tactical roles that support incident handling but are not typically designated as key executive-level CMT roles in a major cybersecurity crisis.

Answer

Security analyst

Answer

Help desk manager

Answer

Network administrator

Question 9

Which THREE of the following are incident severity levels defined in a typical incident management program? (Select three.)

Accepted Answer

P3 – Medium. In a typical incident management program, severity levels are commonly defined as P1 through P5, where P1 represents the highest priority and P5 the lowest. Option C (P1 – Critical) is correct because P1 is the standard designation for the most severe incidents that require immediate response and often trigger major incident processes. Option E (P2 – High) is correct because P2 is the next tier down, used for high-severity incidents that significantly impact services but are less catastrophic than P1. Option B (P3 – Medium) is correct because P3 is the mid-level severity used for moderate incidents with limited business impact. Option A (P5 – Low) is not marked correct because while P5 exists in many schemes, the question asks for three specific levels and P5 is not among the marked correct answers here. Option D (P0 – Emergency) is not marked correct because P0 is not a standard severity level in most incident management frameworks; the scale typically starts at P1.

Answer

P5 – Low

Answer

P0 – Emergency

Question 10

An organization's incident response team is handling a P2 incident involving an insider threat. The team has identified the employee responsible. The communications lead is preparing a notification to affected parties. Which of the following should be included in the notification?

Accepted Answer

The type of data that was compromised and steps taken to mitigate. Regulatory notifications must include a description of the incident, data involved, and mitigation steps, while avoiding speculation.

Answer

A detailed timeline of the investigation

Answer

An apology from the CEO

Answer

The name of the employee responsible