CISM Incident Management Practice Test 3 — 15 Questions

Question 1

During a ransomware incident, the incident response team identifies that the encryption process is still ongoing. The CISO decides to isolate affected systems to prevent further spread. Which of the following is the MOST appropriate next step?

Accepted Answer

Preserve forensic evidence before taking any recovery actions.. Option D is correct because preserving forensic evidence is critical before any recovery actions, especially during an ongoing ransomware incident. The encryption process may still be active, and taking immediate recovery steps (like disconnecting cables or restoring backups) could destroy volatile data (e.g., encryption keys in memory, process artifacts, network connections) that are essential for understanding the attack vector, identifying the ransomware variant, and supporting legal or law enforcement actions. The CISO's decision to isolate systems helps contain the spread, but the next priority must be evidence preservation to ensure a thorough investigation and potential prosecution.

Answer

Disconnect all network cables to stop the encryption.

Answer

Contact law enforcement before any internal actions.

Answer

Restore systems from the most recent backup immediately.

Question 2

An organization's security monitoring system detects multiple failed login attempts from an internal IP address to a critical database server. The attempts are occurring every few seconds. What is the FIRST step the incident response team should take?

Accepted Answer

Verify whether the activity is legitimate.. The first step is to verify if the activity is legitimate or malicious to avoid false positives and understand the context.

Answer

Block the IP address at the firewall immediately.

Answer

Disable the database server to prevent data breach.

Answer

Reset the password of the database service account.

Question 3

After a major security incident, the incident response team completes the containment, eradication, and recovery phases. The CISO is now planning the post-incident activities. Which activity is MOST critical to ensure that lessons learned are effectively incorporated?

Accepted Answer

Conducting a post-incident review and updating policies.. Conducting a post-incident review and updating policies is the most critical post-incident activity because it ensures that the root cause, response gaps, and process deficiencies are formally documented and translated into actionable improvements. This directly supports the continuous improvement cycle required by NIST SP 800-61 and ISO 27035, preventing recurrence of similar incidents.

Answer

Publishing a public disclosure of the incident.

Answer

Terminating the incident response team's engagement.

Answer

Restoring all systems to full production status.

Question 4

An organization has an incident response plan that designates a primary and alternate incident response team. During a simulated ransomware attack, the primary team is unavailable. What should the alternate team do FIRST?

Accepted Answer

Assess the situation and then activate the plan.. Option D is correct because the alternate team must first assess the situation to understand the scope, impact, and validity of the ransomware attack before activating the plan. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis precede containment, eradication, and recovery. Jumping directly to execution without assessment could lead to inappropriate response actions, such as isolating systems that are not affected or failing to preserve critical forensic evidence.

Answer

Contact the primary team members for instructions.

Answer

Declare a disaster and escalate to senior management.

Answer

Execute the incident response plan as documented.

Question 5

A financial institution has a mature incident response program. During a security incident, the incident response team identifies that a business-critical application is affected. The team must decide whether to continue containing the incident or allow limited operations to continue. Which factor should be given the HIGHEST priority?

Accepted Answer

Regulatory compliance and data protection.. In a mature incident response program, regulatory compliance and data protection take precedence because financial institutions are subject to strict data privacy laws (e.g., GDPR, PCI DSS, SOX) that mandate safeguarding sensitive data during an incident. Allowing limited operations could lead to unauthorized data exposure or breach of legal obligations, resulting in severe penalties and reputational damage that outweigh the benefits of continued uptime.

Answer

Maintaining customer trust.

Answer

Minimizing downtime of the application.

Answer

Preserving evidence for potential litigation.

Question 6

During an incident investigation, the forensic analyst discovers that a malware sample communicates with an external IP address. The organization's incident response plan requires a decision on whether to block the IP at the firewall. What should the incident response team do FIRST?

Accepted Answer

Check threat intelligence feeds to confirm maliciousness.. Option D is correct because the incident response team must first validate the maliciousness of the IP address using threat intelligence feeds before taking any irreversible action. Blocking an IP without confirmation could disrupt legitimate business operations or tip off an attacker, and the CISM framework emphasizes evidence-based decision-making during incident response.

Answer

Monitor the connection further without taking action.

Answer

Block the IP address immediately to prevent data exfiltration.

Answer

Notify law enforcement about the IP address.

Question 7

An incident response team discovers that an employee's workstation is infected with malware. The workstation contains sensitive customer data. Which of the following is the MOST appropriate containment strategy?

Accepted Answer

Disconnect the workstation from the network.. Disconnecting the workstation from the network (Option C) is the most appropriate containment strategy because it immediately stops the malware from communicating with command-and-control servers, prevents lateral movement to other systems, and preserves the volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes isolation over destruction or data exfiltration risk.

Answer

Shut down the workstation immediately.

Answer

Perform a full system wipe and reinstall the OS.

Answer

Copy all files to a secure server and then disconnect.

Question 8

A large enterprise experiences a data breach involving personal identifiable information (PII) of customers. The incident response team has contained the breach and is now in the eradication phase. The CISO wants to ensure that the same vulnerability cannot be exploited again. Which action is MOST critical?

Accepted Answer

Patch the specific vulnerability identified.. Patching the specific vulnerability is the most critical action during the eradication phase because it permanently removes the root cause of the breach. Without this step, the same attack vector (e.g., an unpatched SQL injection flaw or a known CVE in a web server) remains exploitable, rendering containment efforts temporary. The CISO's goal to prevent recurrence directly requires eliminating the technical weakness, not just mitigating its symptoms.

Answer

Change all passwords of affected accounts.

Answer

Notify affected customers about the breach.

Answer

Deploy additional endpoint protection software.

Question 9

An organization's incident response team is notified of a potential denial-of-service (DoS) attack targeting their web application. The team suspects a distributed denial-of-service (DDoS) attack. What is the FIRST step the team should take?

Accepted Answer

Analyze network traffic to confirm the attack.. Before taking any action, the incident response team must first confirm that a DDoS attack is actually occurring. Analyzing network traffic (e.g., using NetFlow, sFlow, or packet capture) allows the team to distinguish a genuine DDoS from a flash crowd, a misconfiguration, or a legitimate spike in traffic. This step ensures that subsequent mitigation efforts are based on accurate evidence, preventing unnecessary disruption to services.

Answer

Contact the ISP to block the attacking IPs.

Answer

Shut down the web application to protect resources.

Answer

Implement rate limiting on the web server.

Question 10

Which TWO of the following are key components of an effective incident response plan?

Accepted Answer

A clear chain of command and escalation procedures.. A clear chain of command and escalation procedures ensure that during an incident, decision-making authority and notification paths are predefined, reducing confusion and enabling rapid, coordinated response. This aligns with NIST SP 800-61 incident response guidelines, which emphasize the need for defined roles and communication hierarchies to avoid delays or missteps in critical situations.

Answer

Automatic detection and response tools.

Answer

Predefined response scripts for every possible incident.

Question 11

Which THREE of the following are best practices for handling evidence during an incident investigation?

Accepted Answer

Document all actions taken during evidence collection.. Option A is correct because documenting all actions taken during evidence collection ensures the integrity and admissibility of evidence in legal proceedings. This documentation, often referred to as a 'paper trail' or 'audit log,' must include timestamps, personnel involved, tools used, and any deviations from standard procedures. Without this, the chain of custody is weakened, and the evidence may be challenged as unreliable or tampered with.

Answer

Analyze evidence directly on live systems to avoid delays.

Answer

Store evidence in its original location to avoid disturbance.

Question 12

Which TWO of the following are indicators of a potential security incident?

Accepted Answer

Multiple unexpected system reboots.. Multiple unexpected system reboots (B) are a strong indicator of a potential security incident because they may result from malware, kernel-level exploits, or denial-of-service attacks that crash the operating system. Unusual outbound network traffic from a server (E) often indicates data exfiltration, command-and-control (C2) communication, or a compromised service sending sensitive data to an external host. Both behaviors deviate from baseline operations and warrant immediate investigation under the Incident Management domain.

Answer

Low disk space on a file server.

Answer

A new version of a critical software released.

Answer

A successful login by an authorized user.

Question 13

Based on the exhibit, what is the MOST likely scenario?

Accepted Answer

An attacker brute-forced the password and then used the credentials to access a file server.. The exhibit shows multiple failed authentication attempts (Event ID 4625) from a single user account within a short time window, followed by a successful logon (Event ID 4624) and then an access event to a file share (Event ID 5140). This pattern of rapid, repeated failures culminating in a single success is characteristic of a brute-force attack, where the attacker guesses the password and then uses the compromised credentials to access a file server.

Answer

A user is performing a scheduled task that requires authentication.

Answer

A user forgot their password and successfully logged in after retrying.

Answer

A system administrator is testing password policies.

Question 14

Based on the exhibit, what is the MOST likely issue?

Accepted Answer

A system is infected with malware that is beaconing to a command and control server.. The IDS alert indicates a malware beacon, and the firewall log shows periodic outbound connections to an external IP, which is typical of command and control traffic.

Answer

A user is streaming video from a legitimate site.

Answer

A software update is being downloaded from an external site.

Answer

A network scan is being performed from the internal IP.

Question 15

Based on the exhibit, which role is responsible for notifying affected users about the phishing attack?

Accepted Answer

Communications Lead. The Communications Lead is responsible for notifying affected users about the phishing attack because this role manages external and internal communications, including user notifications, during an incident. In the exhibit, the Communications Lead is explicitly assigned the task of 'Notify affected users' under the communication plan, ensuring timely and accurate messaging to reduce further risk.

Answer

Technical Lead

Answer

Legal Counsel

Answer

Incident Response Manager