CISM Incident Management Practice Test 2 — 15 Questions

Question 1

Based on the SIEM alert exhibit, which immediate action should the incident responder take?

Accepted Answer

Lock the user account 'jsmith'. The SIEM alert indicates a successful brute-force login from source IP 10.0.0.55 to the destination server using the account 'jsmith'. Locking the user account immediately stops the attacker from further exploiting the compromised credentials, which is the most direct containment action. Blocking the IP alone would not prevent re-authentication if the attacker switches IPs, and contacting the user wastes critical time during an active incident.

Answer

Block the source IP 10.0.0.55 at the firewall

Answer

Increase logging level for the destination server

Answer

Contact the user 'jsmith' to verify activity

Question 2

Given the exhibit output from a web server, which connection is MOST suspicious and likely indicates a command-and-control (C2) channel?

Accepted Answer

Connection to 203.0.113.5:44333. Connection to 203.0.113.5:44333 is the most suspicious because it uses a non-standard high port (44333) to an external IP address, which is a common technique for C2 traffic to evade detection by blending with HTTPS-like traffic. Legitimate web servers typically connect to well-known ports (e.g., 80, 443) or internal services, not arbitrary external high ports. The exhibit likely shows a netstat output where this outbound connection to an external IP on an unusual port stands out as anomalous.

Answer

Connection to 10.0.0.1:54321

Answer

The listening socket on port 443

Answer

Connection to 10.0.0.2:54322

Question 3

Based on the incident response policy exhibit, which phase should include notifying external stakeholders such as law enforcement?

Accepted Answer

Post-Incident. B is correct because the post-incident phase is the appropriate time to notify external stakeholders such as law enforcement, as it occurs after containment and eradication are complete. During this phase, the incident is fully documented, evidence is preserved, and legal obligations (e.g., breach notification laws like GDPR Article 33 or HIPAA Breach Notification Rule) are fulfilled. Notifying law enforcement earlier could compromise forensic integrity or operational continuity, so it is deliberately deferred to the post-incident stage.

Answer

Recovery

Answer

Detection

Answer

Containment

Question 4

You are the incident response manager for a financial services company. The company has a hybrid infrastructure with on-premises servers and cloud services. At 2:00 AM, the SIEM generates a critical alert: a database server in the DMZ is communicating with a known malicious IP address on port 443. The server contains customer PII. The on-call security analyst reports that the server is running and the connection is active. The incident response plan states that any confirmed compromise of PII must be reported to the regulator within 72 hours. You have the following options: A) Immediately isolate the server by disconnecting it from the network, then begin forensic analysis. B) Leave the server connected to gather more intelligence about the attacker's actions, but block only the malicious IP at the firewall. C) Shut down the server to preserve evidence and prevent data exfiltration. D) Copy the server's disk over the network for forensic analysis before taking any action. Which option is the BEST course of action?

Accepted Answer

Block the malicious IP and monitor the server. Option D is the best course of action because it balances the need to stop the immediate data exfiltration threat with the preservation of forensic evidence and the regulatory requirement to report a PII breach within 72 hours. By blocking only the malicious IP at the firewall, you sever the active command-and-control (C2) channel on port 443 while keeping the server running, which allows you to collect volatile data (e.g., memory, active processes, network connections) and perform live forensics without destroying evidence. This approach also avoids the risk of losing critical evidence that would occur with a hard shutdown or isolation, and it provides time to confirm the scope of the compromise before the 72-hour clock starts for regulatory reporting.

Answer

Isolate the server immediately

Answer

Shut down the server

Answer

Copy the disk over the network

Question 5

You are a security analyst for a mid-sized e-commerce company. The company uses a cloud-based email service. Several employees report receiving phishing emails that appear to come from the CEO, asking them to purchase gift cards. The emails have a spoofed sender address but pass SPF and DKIM checks because the attacker compromised a legitimate email account. The CEO's account has been locked, but the attacker may have set up forwarding rules. You need to ensure the attacker cannot use the account further. You have the following options: A) Change the CEO's password and enable MFA, then remove any forwarding rules. B) Delete the CEO's email account and create a new one. C) Block all emails from the CEO's email address at the gateway. D) Restore the CEO's mailbox from a backup taken before the compromise. Which option is the BEST course of action?

Accepted Answer

Change password, enable MFA, and remove forwarding rules. Option D is the best course of action because the attacker has already compromised the CEO's legitimate account, bypassing SPF and DKIM. Changing the password immediately revokes the attacker's session tokens and access, enabling MFA adds an additional authentication factor to prevent re-entry, and removing any forwarding rules stops the attacker from exfiltrating emails or continuing the phishing campaign through auto-forwarding. This directly addresses the root cause—the compromised account—without disrupting business continuity.

Answer

Block the CEO's email address at the gateway

Answer

Delete the account and create a new one

Answer

Restore from backup

Question 6

An analyst receives an alert indicating a potential data exfiltration. The alert shows a host IP address 10.10.50.200 sending large amounts of data to an external IP address 203.0.113.5 over port 443. What should the analyst do FIRST?

Accepted Answer

Verify the alert by checking logs and network traffic. Option C is correct because the first step in incident response is to validate the alert. The analyst must verify that the traffic is indeed anomalous and not legitimate (e.g., a large backup or software update) by examining logs and packet captures. Premature action without verification could disrupt business operations or destroy forensic evidence.

Answer

Block the external IP address immediately

Answer

Escalate to the incident response team

Answer

Isolate the host from the network

Question 7

A financial institution is designing an incident response plan. They want to ensure that during a ransomware incident, critical transaction systems can be restored within 4 hours. Which metric should be used to measure this requirement?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable downtime after a disaster or incident, which directly aligns with the requirement to restore critical transaction systems within 4 hours. In incident management, RTO is the metric used to set the target for system recovery, ensuring business continuity. For ransomware incidents, RTO drives the restoration strategy and resource allocation to meet the 4-hour window.

Answer

Mean Time to Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)

Question 8

After a security incident, the incident response team identifies that the root cause was a phishing email that bypassed the email filter. The email contained a malicious macro that executed PowerShell commands. Which control would be MOST effective in preventing similar incidents in the future?

Accepted Answer

Disable macros in documents originating from external sources. Disabling macros in documents from external sources directly addresses the attack vector: the malicious macro that executed PowerShell commands. This control prevents the macro from running, regardless of the email filter's failure, by blocking the execution environment at the endpoint level. It is a preventive technical control that stops the attack before it can proceed.

Answer

Implement network segmentation for sensitive systems

Answer

Deploy additional antivirus software on endpoints

Answer

Conduct security awareness training for all employees

Question 9

During an incident, the CIRT leader decides to contain a compromised server by disconnecting it from the network. However, this action may result in loss of volatile forensics data. What should the CIRT leader do?

Accepted Answer

Collect volatile data (memory, processes) before disconnecting. Option D is correct because volatile data (e.g., memory contents, running processes, network connections) is lost when power is removed or the network interface is disabled. The CIRT leader must follow the order of volatility (RFC 3227) and capture this data first to preserve forensic evidence before containment actions that alter the system state.

Answer

Proceed with disconnection immediately to prevent further damage

Answer

Keep the server connected but block all inbound/outbound traffic

Answer

Perform a full disk imaging before disconnection

Question 10

An organization has a mature incident management process. After a major incident, they conduct a post-incident review. Which activity is MOST important during this review?

Accepted Answer

Determine root causes and document lessons learned. Option C is correct because identifying root causes and improvements prevents recurrence. Option A (assigning blame) is counterproductive. Option B (updating tools) is part of improvement but not the most important. Option D (metrics) supports analysis but is not the primary goal.

Answer

Identify individuals responsible for the incident

Answer

Update security tools to block similar attacks

Answer

Calculate the total cost of the incident

Question 11

Which TWO actions are appropriate during the containment phase of an incident involving a malware outbreak on multiple workstations?

Accepted Answer

Isolate infected workstations from the network. Option C is correct because isolating infected workstations from the network is a primary containment action that prevents the malware from spreading laterally to other systems, limiting the scope of the incident. This is typically achieved by disconnecting network cables, disabling switch ports, or using network access control (NAC) to quarantine the affected hosts, which stops further propagation without destroying forensic evidence.

Answer

Contact all users to warn them about the malware

Answer

Reimage all affected workstations immediately

Answer

Notify customers about potential data breach

Question 12

Which THREE elements should be included in an incident response plan to ensure effective communication during a security incident?

Accepted Answer

Escalation procedures for notifying management and legal. Option A is correct because escalation procedures define the specific thresholds and contact paths for notifying management and legal teams when an incident exceeds predefined severity levels. This ensures that decision-makers are informed promptly to authorize critical actions like legal holds or regulatory notifications, preventing delays that could worsen the incident's impact.

Answer

List of affected systems and data

Answer

Public relations strategy for external communication

Question 13

Refer to the exhibit. The security analyst observes these alerts. What is the MOST likely sequence of events?

Accepted Answer

Attacker compromised jsmith's credentials, established C2, and exfiltrated data. The correct sequence is that an attacker compromised jsmith's credentials, established command-and-control (C2) communication, and then exfiltrated data. The alerts show a brute-force or credential-stuffing attempt from an external IP (10.0.0.45) against jsmith's account, followed by an outbound C2 beacon (e.g., DNS or HTTP) from jsmith's workstation, and finally a large data transfer to an external destination. This matches the typical kill chain: initial access via compromised credentials, persistence via C2, and data exfiltration as the final objective.

Answer

Insider threat: jsmith intentionally exfiltrated data

Answer

Network scan from 10.0.0.45 triggered false positives

Answer

Malware downloaded on jsmith's workstation and exfiltrated data

Question 14

Refer to the exhibit. During a ransomware incident, the response team discovers that the backup server is also encrypted. Which phase of the playbook is MOST impacted?

Accepted Answer

Phase 4: Recovery. Option D is correct because the Recovery phase (Phase 4) is most impacted when the backup server is encrypted during a ransomware incident. Without clean, unencrypted backups, the organization cannot restore systems and data to a known good state, which is the primary goal of the Recovery phase. The encryption of backups directly undermines the ability to recover, forcing the team to consider alternative recovery methods such as decryption keys, offline backups, or system rebuilds.

Answer

Phase 5: Post-Incident

Answer

Phase 3: Eradication

Answer

Phase 2: Containment

Question 15

You are the incident response manager for a mid-sized e-commerce company. At 2:00 PM, the security operations center receives an alert from the intrusion detection system indicating a potential SQL injection attack against the customer database server. The server hosts a critical database containing customer PII and payment card data. The alert shows multiple suspicious queries from an internal IP address 192.168.10.50, which belongs to the development team's jump box. The development team uses this jump box to access production servers for maintenance. The jump box is managed by the IT operations team. The CEO is currently in a meeting with investors and cannot be disturbed. The CISO is on leave. The company has a written incident response plan that designates the IT director as the incident response coordinator in the absence of the CISO. The IT director has limited security knowledge. The database administrator (DBA) reports that the database is experiencing high CPU usage and that some customer records appear to have been modified. You need to take immediate action. What should you do FIRST?

Accepted Answer

Isolate the jump box from the network immediately. Isolating the jump box (192.168.10.50) is the correct first action because it immediately stops the active SQL injection attack at its source, preventing further data exfiltration or modification. The suspicious queries originate from this internal IP, and containment is the priority in incident response to halt the threat before investigation or recovery. This aligns with the NIST SP 800-61 containment strategy, which prioritizes stopping the attack vector before preserving evidence or notifying stakeholders.

Answer

Shut down the database server to prevent further data loss

Answer

Contact the development team lead to ask about the activity

Answer

Escalate the incident to the IT director and request guidance

CISM Incident Management Practice Test 2 — 15 Questions

Exhibit

CISM Incident Management Practice Test 2 — 15 Questions

Exhibit