CISM Incident Management — Timed 25 Questions

Question 1

An organization's incident response (IR) policy should be approved by which of the following to ensure authority and accountability?

Accepted Answer

The board of directors or executive management. The IR policy requires senior management approval to demonstrate organizational commitment and allocate necessary resources.

Answer

The incident response manager

Answer

The legal counsel

Answer

The IT director

Question 2

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

Accepted Answer

To preserve attorney-client privilege and avoid creating damaging records. Legal counsel involvement helps protect communications under attorney-client privilege and avoids speculation that could create liability.

Answer

To approve technical containment actions

Answer

To coordinate with external forensics firms

Answer

To ensure compliance with regulatory notification deadlines

Question 3

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is unable to restore operations within the maximum tolerable downtime (MTD). Which action should be taken next?

Accepted Answer

Escalate to activate the business continuity/disaster recovery plan. When an incident cannot be resolved within MTD, it escalates to business continuity/disaster recovery activation to restore operations.

Answer

Notify law enforcement

Answer

Increase the ransom payment

Answer

Engage the forensics firm to preserve evidence

Question 4

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have major business impact and require immediate executive notification and round-the-clock response.

Answer

P2 — High

Answer

P3 — Medium

Answer

P4 — Low

Question 5

Following a data breach, an organization conducts a root cause analysis using the 5 Whys technique. The analysis identifies that a misconfigured firewall allowed unauthorized access. What is the most important next step to prevent recurrence?

Accepted Answer

Implement a change management process to prevent unauthorized configuration changes. Root cause analysis should uncover not just technical causes but also the process and governance failures that allowed the misconfiguration. Addressing the management failure (e.g., inadequate change management) provides a systemic fix.

Answer

Update the firewall rule base immediately

Answer

Conduct a vulnerability scan on all firewalls

Answer

Disconnect the firewall from the network

Question 6

An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?

Accepted Answer

Credential compromise playbook. Credential compromise incidents, such as account takeover via phishing, are handled by the credential compromise playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 7

Which of the following is typically a member of the crisis management team (CMT) during a major cybersecurity incident?

Accepted Answer

Chief executive officer (CEO). The CMT includes senior leaders such as the CEO, CFO, CISO, General Counsel, and Communications head to handle strategic decisions and external communications.

Answer

Security operations center (SOC) analyst

Answer

Help desk manager

Answer

External forensics investigator

Question 8

As part of post-incident activities, an organization schedules a lessons learned meeting. When should this meeting ideally take place?

Accepted Answer

Within 2 weeks of incident resolution. Lessons learned meetings should occur within two weeks of incident resolution while details are fresh, to capture accurate feedback and improve the IR plan.

Answer

At the next quarterly board meeting

Answer

Immediately after the incident is detected

Answer

Only after all legal proceedings are concluded

Question 9

During a data breach investigation, legal counsel instructs the forensics team to preserve evidence under attorney-client privilege. Which of the following actions is most critical to maintain that privilege?

Accepted Answer

Limit distribution of forensic reports to individuals with a need-to-know and under legal direction. To preserve attorney-client privilege, communications and work product must be kept confidential and not shared with third parties unless protected by common interest or waiver.

Answer

Use a separate, isolated network for forensic analysis

Answer

Encrypt all forensic images with a strong algorithm

Answer

Destroy all preliminary notes after the final report is issued

Question 10

An organization is updating its incident response playbook after a ransomware attack. Which of the following should be included as a key step in the ransomware playbook?

Accepted Answer

Isolate affected systems from the network. Ransomware playbooks should include isolating infected systems to prevent spread, as containment is a priority.

Answer

Reboot all servers to clear the ransomware

Answer

Immediately pay the ransom demand

Answer

Notify all customers immediately

Question 11

Which of the following is the primary purpose of having a pre-established forensic retainer agreement?

Accepted Answer

To reduce the time required to engage external forensics during an incident. A pre-established retainer reduces the time to engage a forensics firm during an incident, ensuring rapid response.

Answer

To ensure the forensics firm is certified

Answer

To guarantee the lowest price for forensic services

Answer

To comply with regulatory requirements

Question 12

After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?

Accepted Answer

Supply chain. Supply chain incidents involve attacks through third-party vendors or partners, even if the initial vector is credential compromise.

Answer

Insider threat

Answer

Account compromise

Answer

DDoS

Question 13

Which TWO of the following are essential components of an incident response programme?

Accepted Answer

Incident response plan. An IR programme must include a formal policy and a documented plan. Playbooks are also important but the core components are policy and plan.

Answer

Annual penetration test

Answer

Vulnerability scanning schedule

Answer

Security awareness training

Question 14

Which THREE of the following should be included in an incident communication template?

Accepted Answer

Affected systems or data. Communication templates should include the incident description, affected parties, and guidance on actions to take. Technical details and attacker attribution are not typically included in templates.

Answer

Technical indicators of compromise (IoCs)

Answer

Attribution of the attacker

Question 15

Which TWO of the following are appropriate actions for preserving evidence during a cybersecurity incident?

Accepted Answer

Create forensic bit-for-bit images of affected systems. Preserving evidence includes creating forensic images and issuing legal holds to prevent spoliation. Disconnecting systems without imaging and rebooting can destroy evidence.

Answer

Reboot systems to capture volatile memory

Answer

Disconnect affected systems from the network immediately

Answer

Delete temporary files to free up space

Question 16

During a major security incident classified as P1, which of the following is the MOST appropriate communication frequency to the executive team?

Accepted Answer

Hourly situation reports (sitreps). For P1 (critical) incidents, hourly situation reports (sitreps) are expected to keep executives informed of rapidly evolving events.

Answer

Daily summary reports

Answer

Only upon significant changes

Answer

At the end of the incident

Question 17

An organization's incident response team has contained a ransomware incident. What is the NEXT step according to the incident management program?

Accepted Answer

Eradicate the malware and restore systems. After containment, the next priority is eradication of the threat to remove all traces of the malware and restore systems securely.

Answer

Perform root cause analysis

Answer

Conduct a lessons learned meeting

Answer

Notify regulatory authorities

Question 18

An organization has just experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of the breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 19

Which of the following is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a step-by-step guide for responding to incidents. The IR plan provides a structured approach to manage incidents, minimizing impact and ensuring efficient response.

Answer

To document vendor contacts only

Answer

To assign blame for security failures

Answer

To replace the need for incident response training

Question 20

During a DDoS attack classified as P2, what is the EXPECTED response time and notification level?

Accepted Answer

Business hours response; management notification. P2 incidents require management notification and a response during business hours.

Answer

Standard response; team lead notification

Answer

24/7 response; executive notification

Answer

Scheduled remediation; email notification