CISM Incident Management Practice Test 1 — 15 Questions

Question 1

A multinational corporation has just detected a ransomware attack that encrypted critical files on a file server. The incident response team has been activated. Which of the following should be the FIRST action taken by the team?

Accepted Answer

Isolate the affected systems from the network. The first priority in ransomware incident response is containment to prevent the encryption from spreading to other systems. Isolating the affected file server from the network (e.g., disabling the network interface or disconnecting the cable) stops the ransomware from communicating with its command-and-control server and encrypting additional shares. This aligns with the NIST SP 800-61 containment strategy and ensures that the incident response team can safely preserve forensic evidence before any remediation.

Answer

Restore encrypted files from backup

Answer

Reboot the file server to clear the encryption

Answer

Notify law enforcement

Question 2

During an incident investigation, the security team discovers that an attacker exfiltrated sensitive customer data via encrypted DNS tunneling over a period of three months. The data loss was only noticed after a routine audit. Which of the following weaknesses MOST likely allowed the attacker to remain undetected for so long?

Accepted Answer

Inadequate monitoring of DNS traffic for anomalies. The correct answer is A because DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.

Answer

Weak password policies

Answer

Unpatched web server software

Answer

Lack of data-at-rest encryption

Question 3

An organization's incident response plan includes a step to 'contain the incident.' Which of the following actions is an example of containment?

Accepted Answer

Disconnecting an infected workstation from the network. Disconnecting an infected workstation from the network is a classic containment action because it immediately isolates the compromised system, preventing the spread of malware or unauthorized lateral movement to other hosts. Containment focuses on limiting the scope and impact of an incident, not on remediation or investigation. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is performed before eradication and recovery.

Answer

Restoring data from backup

Answer

Analyzing log files to determine the attack vector

Answer

Removing malware from the system

Question 4

During a simulated phishing exercise, several employees clicked a link and entered their credentials on a fake login page. The security team needs to determine the impact. Which of the following should be the NEXT step?

Accepted Answer

Reset the affected employees' passwords and enable multi-factor authentication. When credentials are compromised in a phishing attack, the immediate priority is to contain the breach by invalidating the exposed credentials. Resetting the affected employees' passwords and enabling multi-factor authentication (MFA) prevents attackers from using the harvested credentials for unauthorized access, especially if the credentials are reused across other systems. This aligns with the Incident Response phase of containment before moving to eradication or recovery.

Answer

Implement a security awareness training program

Answer

Conduct a forensic analysis of the employees' workstations

Answer

Block the phishing domain at the web proxy

Question 5

An organization is developing an incident response plan. The CISO wants to ensure that the plan aligns with industry best practices. Which framework should the CISO use as a primary reference?

Accepted Answer

NIST SP 800-61. NIST SP 800-61 (Computer Security Incident Handling Guide) is the definitive U.S. government standard for incident response processes, covering preparation, detection, containment, eradication, and recovery. It provides detailed, step-by-step guidance for building an incident response plan, making it the primary reference for aligning with industry best practices.

Answer

ISO 31000

Answer

NIST Cybersecurity Framework

Answer

ITIL

Question 6

After a security incident, the incident response team prepares a report detailing the root cause, impact, and lessons learned. Who is the PRIMARY audience for this report?

Accepted Answer

Senior management and the board of directors. The primary audience for a post-incident report detailing root cause, impact, and lessons learned is senior management and the board of directors. They require this information to make strategic decisions about risk acceptance, resource allocation for remediation, and to fulfill fiduciary duties regarding cybersecurity governance. The report provides the business context and financial impact necessary for executive-level oversight, not the technical details needed by operational teams.

Answer

The affected users

Answer

The IT support team

Answer

External auditors

Question 7

During an incident, the response team collects volatile data from a compromised server. Which of the following should be collected FIRST to minimize loss of evidence?

Accepted Answer

Contents of RAM. Volatile data, such as the contents of RAM, is lost when a system is powered off. The first priority during incident response is to capture this data because it contains running processes, network connections, encryption keys, and malware that exist only in memory. Collecting RAM first ensures that this critical evidence is preserved before any other actions that might alter the system state.

Answer

Contents of hard drive

Answer

Event logs

Answer

Network configuration

Question 8

An organization uses a SIEM to correlate security events. The SIEM generates an alert for a possible brute-force attack against an admin account. The incident response team reviews the alert and finds that the account is a service account with a known password. What should the team do NEXT?

Accepted Answer

Change the password for the service account. The correct next step is to change the password for the service account because the alert indicates a possible brute-force attack, and a known password represents a compromised credential. Even if the account is a service account, the password must be rotated to prevent unauthorized access. This aligns with the incident response principle of containing the threat by invalidating the compromised authentication factor.

Answer

Notify the service owner

Answer

Disable the service account

Answer

Investigate the source IP addresses

Question 9

Which of the following is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a systematic method for responding to incidents. The primary purpose of an incident response plan is to establish a structured, systematic methodology for detecting, containing, eradicating, and recovering from security incidents. This ensures that the organization can minimize damage, reduce recovery time and costs, and preserve evidence for forensic analysis. Without a predefined plan, responses become ad hoc, increasing the likelihood of errors and extended downtime.

Answer

To assign blame for security failures

Answer

To prevent all security incidents from occurring

Answer

To meet regulatory compliance requirements

Question 10

A security analyst detects unusual outbound network traffic from a database server to an unknown IP address. The traffic uses encrypted connections on port 443. Which type of attack is MOST likely occurring?

Accepted Answer

Data exfiltration. The encrypted outbound traffic on port 443 (HTTPS) from a database server to an unknown IP is a classic indicator of data exfiltration. Attackers often use encrypted channels to bypass network security controls, as the contents of the traffic cannot be inspected by DLP or IDS/IPS systems. The database server is a high-value target for sensitive data, making this the most likely attack scenario.

Answer

SQL injection

Answer

Ransomware

Answer

Denial of service

Question 11

During an incident investigation, the team discovers that an attacker used a valid user's credentials to access a sensitive database. The user's account had multi-factor authentication (MFA) enabled. How is this MOST likely possible?

Accepted Answer

The user approved a fraudulent MFA prompt. MFA fatigue attacks involve repeatedly sending push notifications until the user approves one. Option A is less likely; Option C would not bypass MFA; Option D is not direct.

Answer

MFA was not properly configured

Answer

The attacker guessed the MFA token

Answer

The attacker used a man-in-the-middle attack

Question 12

Which TWO of the following are key indicators of a potential insider threat incident? (Select exactly 2)

Accepted Answer

A user accessing large volumes of data not related to their job function. Option C is correct because a user accessing large volumes of data unrelated to their job function is a classic behavioral anomaly indicating potential data exfiltration. This pattern often precedes an insider threat incident, as the user may be collecting sensitive information for unauthorized purposes, such as selling it or using it for personal gain. Security information and event management (SIEM) systems typically flag such access based on deviations from baseline user behavior, triggering further investigation.

Answer

Multiple failed login attempts from an external IP address

Answer

An increase in network traffic to a known malicious domain

Answer

A user updating their password as required by policy

Question 13

Which THREE of the following are essential components of an incident response plan? (Select exactly 3)

Accepted Answer

Communication plan for internal and external stakeholders. A communication plan is essential because it defines how the incident response team will coordinate internally and notify external stakeholders such as regulators, law enforcement, customers, and the media. Without a predefined communication plan, critical updates may be delayed or mishandled, leading to regulatory penalties or reputational damage. This aligns with NIST SP 800-61 and CISM best practices for incident management.

Answer

A list of all software licenses in the organization

Answer

Annual budget for security tools

Question 14

Which TWO of the following are best practices for preserving digital evidence during an incident? (Select exactly 2)

Accepted Answer

Create a forensic image of the hard drive using a write blocker. Creating a forensic image with a write blocker (Option A) is a best practice because it captures an exact bit-for-bit copy of the storage media without altering the original data. The write blocker intercepts write commands at the hardware or software level, ensuring the integrity of the evidence. This preserves the original state for later analysis and admissibility in legal proceedings.

Answer

Interview witnesses before collecting data

Answer

Run antivirus scans on the affected system

Answer

Reboot the system to clear memory

Question 15

Which THREE of the following are common challenges in incident response? (Select exactly 3)

Accepted Answer

Poor coordination between teams. Poor coordination between teams (Option B) is a common challenge in incident response because security incidents often require collaboration across IT, legal, PR, and management. Without clear communication channels and predefined roles, response efforts become fragmented, leading to delays in containment and recovery. This is a well-documented issue in frameworks like NIST SP 800-61, which emphasizes the need for a coordinated incident response plan.

Answer

Over-reliance on cloud services

Answer

Difficulty in identifying the root cause