CISM Incident Management — Timed 20 Questions

Question 1

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

20 minute time limit — choose an answer to begin.

Accepted Answer

To preserve attorney-client privilege and avoid creating damaging records. Legal counsel involvement helps protect communications under attorney-client privilege and avoids speculation that could create liability.

Answer

To approve technical containment actions

Answer

To coordinate with external forensics firms

Answer

To ensure compliance with regulatory notification deadlines

Question 2

After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?

Accepted Answer

Supply chain. Supply chain incidents involve attacks through third-party vendors or partners, even if the initial vector is credential compromise.

Answer

Insider threat

Answer

Account compromise

Answer

DDoS

Question 3

During a major security incident classified as P1, which of the following is the MOST appropriate communication frequency to the executive team?

Accepted Answer

Hourly situation reports (sitreps). For P1 (critical) incidents, hourly situation reports (sitreps) are expected to keep executives informed of rapidly evolving events.

Answer

Daily summary reports

Answer

Only upon significant changes

Answer

At the end of the incident

Question 4

Which of the following is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a step-by-step guide for responding to incidents. The IR plan provides a structured approach to manage incidents, minimizing impact and ensuring efficient response.

Answer

To document vendor contacts only

Answer

To assign blame for security failures

Answer

To replace the need for incident response training

Question 5

During a DDoS attack classified as P2, what is the EXPECTED response time and notification level?

Accepted Answer

Business hours response; management notification. P2 incidents require management notification and a response during business hours.

Answer

Standard response; team lead notification

Answer

24/7 response; executive notification

Answer

Scheduled remediation; email notification

Question 6

When should an incident response transition to business continuity and disaster recovery (BC/DR) activation?

Accepted Answer

When the incident cannot be resolved within the maximum tolerable downtime (MTD). BC/DR is activated when the incident cannot be resolved within the maximum tolerable downtime (MTD).

Answer

Immediately upon detection of any incident

Answer

Only after the incident is fully contained

Answer

When the incident exceeds the recovery time objective (RTO) but is still within MTD

Question 7

Which of the following is the FIRST step when engaging an external forensics firm for an incident?

Accepted Answer

Activate the forensic retainer agreement. Having a pre-existing retainer agreement reduces time to engage and ensures terms are already in place.

Answer

Provide evidence to the firm

Answer

Define the scope of work

Answer

Sign a non-disclosure agreement

Question 8

Which TWO of the following are key roles on the crisis management team (CMT) for a major cybersecurity incident? (Select two.)

Accepted Answer

Chief Information Security Officer (CISO). The Chief Information Security Officer (CISO) is a key CMT role because this executive owns the security program, provides incident-strategy guidance, and acts as the primary interface between technical responders and executive leadership during a major cybersecurity incident. The Chief Executive Officer (CEO) is also a key CMT role because major incidents require executive-level decisions on business continuity, resource allocation, legal/regulatory notifications, and public communications, and the CEO holds ultimate accountability for the organization's response. By contrast, a security analyst, help desk manager, and network administrator are operational or tactical roles that support incident handling but are not typically designated as key executive-level CMT roles in a major cybersecurity crisis.

Answer

Security analyst

Answer

Help desk manager

Answer

Network administrator

Question 9

Which THREE of the following are incident severity levels defined in a typical incident management program? (Select three.)

Accepted Answer

P3 – Medium. In a typical incident management program, severity levels are commonly defined as P1 through P5, where P1 represents the highest priority and P5 the lowest. Option C (P1 – Critical) is correct because P1 is the standard designation for the most severe incidents that require immediate response and often trigger major incident processes. Option E (P2 – High) is correct because P2 is the next tier down, used for high-severity incidents that significantly impact services but are less catastrophic than P1. Option B (P3 – Medium) is correct because P3 is the mid-level severity used for moderate incidents with limited business impact. Option A (P5 – Low) is not marked correct because while P5 exists in many schemes, the question asks for three specific levels and P5 is not among the marked correct answers here. Option D (P0 – Emergency) is not marked correct because P0 is not a standard severity level in most incident management frameworks; the scale typically starts at P1.

Answer

P5 – Low

Answer

P0 – Emergency

Question 10

An organization's incident response team is handling a P2 incident involving an insider threat. The team has identified the employee responsible. The communications lead is preparing a notification to affected parties. Which of the following should be included in the notification?

Accepted Answer

The type of data that was compromised and steps taken to mitigate. Regulatory notifications must include a description of the incident, data involved, and mitigation steps, while avoiding speculation.

Answer

A detailed timeline of the investigation

Answer

An apology from the CEO

Answer

The name of the employee responsible

Question 11

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 — Critical incidents, such as a complete system outage or data breach, require immediate executive notification and a 24/7 response because they pose an imminent threat to business operations, legal compliance, or data integrity. This severity level triggers the highest escalation path, often involving the CEO, CISO, and legal counsel, with round-the-clock resource allocation to contain and remediate the issue.

Answer

P3 — Medium

Answer

P4 — Low

Answer

P2 — High

Question 12

During a DDoS attack, the incident response team is struggling to mitigate the attack. The team decides to engage the organization's ISP and a DDoS mitigation service. Which of the following should be done FIRST?

Accepted Answer

Refer to the incident response playbook for DDoS attacks. The IR plan should include pre-established contacts and procedures; contacting the ISP and mitigation service should follow the plan's escalation process.

Answer

Activate the crisis management team

Answer

Notify law enforcement

Answer

Initiate legal hold on all relevant logs

Question 13

Following a credential compromise incident, the incident response team is conducting root cause analysis using the 5 Whys technique. The first 'why' reveals that the password was weak. The second 'why' reveals that the password policy allowed simple passwords. What should be the focus of the third 'why'?

Accepted Answer

Why the password policy allowed weak passwords. Root cause analysis should continue to identify why the password policy was not enforced or why it was inadequate, which is a process failure.

Answer

Why the intrusion was not detected earlier

Answer

Why the user had access to the compromised system

Answer

Why the user chose a weak password

Question 14

During a P1 incident, the incident response manager is preparing an executive sitrep. Which of the following should be included to preserve legal privilege?

Accepted Answer

A statement that the sitrep is prepared under the direction of legal counsel. To preserve attorney-client privilege, a sitrep should be prepared at the direction of legal counsel and should state that fact on its face. This makes clear the document is a privileged legal communication rather than a routine business record, which would otherwise be discoverable. Financial estimates, technical attack details, and responder names are operational content and do not by themselves establish privilege.

Answer

An estimated financial impact

Answer

A detailed technical analysis of the attack vector

Answer

Names of the individuals involved in the response

Question 15

An incident has been declared as P2 (high severity). According to the incident classification, what is the expected response timeframe and notification requirement?

Accepted Answer

Management notification and response during business hours.. A P2 (high severity) incident typically requires management notification and response during business hours, reflecting a moderate urgency that does not demand 24/7 executive escalation. This aligns with common incident classification matrices where P1 is critical (24/7, executive), P2 is high (business hours, management), and P3/P4 are lower. The expected response timeframe is business-hours based with management awareness.

Answer

Scheduled remediation with minimal notification.

Answer

Standard response with no specific notification.

Answer

Executive notification and 24/7 response.

Question 16

An organization maintains evidence handling procedures for incident response. A forensic investigator needs to collect a hard drive from a compromised server. Which of the following is the MOST critical step to ensure admissibility in court?

Accepted Answer

Documenting the chain of custody from the moment of collection.. Chain of custody documentation is essential for evidence integrity and admissibility.

Answer

Encrypting the hard drive during transport.

Answer

Creating a forensic image of the hard drive before disconnecting it.

Answer

Ensuring the investigator has the proper certification.

Question 17

An organization's incident response team is handling a P2 insider threat incident involving unauthorized access to customer data. According to the incident classification, which of the following is the MOST appropriate notification and response timeframe?

Accepted Answer

Notification to management within 24 hours and response during business hours.. A P2 insider threat incident involving unauthorized access to customer data is a high-severity event that requires notification to management within 24 hours and a response during business hours per the classification matrix. This balances urgency with the operational reality that P2 is serious but not the highest priority (P1), which would demand 24/7 response and executive notification.

Answer

No notification required; handle during scheduled remediation.

Answer

Notification to the communications lead and response within 48 hours.

Answer

Immediate notification to the executive sponsor and 24/7 response.

Question 18

During a P1 incident, the crisis management team (CMT) has been activated. The CEO asks for an hourly sitrep. Which of the following is the MOST appropriate content for the sitrep?

Accepted Answer

Current status of containment, confirmed facts, and actions taken, with legal counsel input.. During a P1 incident, the CEO requires a concise, actionable sitrep focused on containment status, confirmed facts, and actions taken. Legal counsel input is critical to avoid premature attribution or disclosure that could create liability or violate data breach notification laws. This aligns with the CISM incident management principle of providing decision-ready information to executive leadership without technical clutter.

Answer

A detailed technical analysis of the attack vector and exploited vulnerabilities.

Answer

Names of individuals potentially responsible for the incident.

Answer

Estimated financial impact and potential regulatory penalties.

Question 19

An organization has experienced a DDoS attack that is overwhelming its internet-facing services. The incident response team has implemented mitigations, but services remain degraded. The maximum tolerable downtime (MTD) for the affected services is 4 hours, and 3 hours have passed. Which of the following should the incident manager do NEXT?

Accepted Answer

Escalate to the crisis management team to consider activating the disaster recovery plan.. If an incident cannot be resolved within the MTD, it should transition to BC/DR activation. The decision authority (e.g., CISO or CMT) should declare a disaster.

Answer

Continue current mitigation efforts and reassess after another hour.

Answer

Increase the capacity of the DDoS mitigation service.

Answer

Notify customers of a prolonged outage.

Question 20

An organization is conducting a root cause analysis after a data breach. Which of the following sequences BEST aligns with the 5 Whys approach from a CISM perspective?

Accepted Answer

Technical cause → Process failure → Management failure. The 5 Whys should drill down from technical cause to process failure to management/governance failure, as per the domain content.

Answer

Management failure → Process failure → Technical cause

Answer

Process failure → Technical cause → Management failure

Answer

Technical cause → Management failure → Process failure