CISM Incident Management Practice Test 4 — 15 Questions

Question 1

You are the incident response manager for a multinational corporation that processes sensitive financial data. The company has a mature security operations center (SOC) that monitors network traffic, endpoints, and cloud services. At 2:00 AM local time, the SOC alerts you to a critical incident: an internal server (IP 10.10.10.50) is communicating with an external IP address (198.51.100.23) known to be associated with a ransomware group. The server hosts a financial database that is replicated to a secondary site every 6 hours. The last successful replication was at 1:00 AM. The SOC has already isolated the server from the network by blocking its outbound traffic at the firewall. However, the server is still running. The initial investigation suggests that the communication started 30 minutes ago. The database contains customer PII and transactional data. Your incident response plan includes steps for containment, eradication, recovery, and post-incident review. The CEO is being notified and expects a recommendation on the best course of action. The company has a cyber insurance policy that requires timely notification and preservation of evidence. The legal department advises that any action that could destroy evidence must be carefully considered. Which of the following is the BEST course of action?

Accepted Answer

Take a forensic image of the server's memory and disk for analysis, then rebuild the server from a known good backup.. Option A is correct because it balances forensic preservation (memory and disk imaging) with recovery from a known good backup, ensuring evidence is intact for legal and insurance requirements while restoring operations. The server is isolated, so imaging can be done safely without risk of further compromise, and the 1:00 AM backup (just one hour before the 2:00 AM communication started) is likely clean, minimizing data loss.

Answer

Reconnect the server to the network and attempt to negotiate with the attacker if ransomware is detected.

Answer

Immediately wipe the server and restore from the 1:00 AM backup to minimize downtime.

Answer

Leave the server isolated but running to monitor the attacker's actions and gather intelligence.

Question 2

You are the information security manager for a mid-sized e-commerce company. The company operates a web application that handles credit card transactions and stores customer data in a backend database. The incident response team has just been alerted to a potential data breach: an intrusion detection system (IDS) flagged a SQL injection attack pattern on the web application's login page. The attack originated from an external IP address (5.5.5.5) and appears to have been successful, as the IDS also detected a large outbound data transfer from the database server to another external IP (6.6.6.6) shortly after. The database server is not segmented from the web server. The company has a legal obligation to report breaches involving cardholder data within 72 hours. The incident response plan is being activated. The team includes a forensic analyst, a network engineer, and a legal advisor. The web application is currently running and serving customers. The CEO wants to minimize business disruption. Which of the following actions should the incident response team take FIRST?

Accepted Answer

Isolate the database server from the network and block outbound traffic to the external IP.. Option B is correct because the immediate priority is to contain the breach by isolating the compromised database server and blocking outbound traffic to the attacker's IP (6.6.6.6). This stops the exfiltration of cardholder data, preserves evidence on the isolated server, and minimizes business disruption by keeping the web application running. Shutting down servers (Option A) would cause unacceptable downtime, while patching (Option C) or imaging (Option D) without containment would allow continued data loss.

Answer

Shut down the web application and database server immediately to stop the breach.

Answer

Patch the SQL injection vulnerability in the web application and continue monitoring.

Answer

Take a full forensic image of all servers before taking any containment actions.

Question 3

After a ransomware incident, the incident response team contains the spread and begins eradication. The team discovers that the ransomware encrypted files on a file server and also deleted shadow copies. Which of the following should the team do NEXT to support recovery?

Accepted Answer

Create a forensic image of the file server and affected endpoints.. After containment and eradication, the priority is to preserve evidence for root cause analysis and potential legal action. Creating a forensic image of the file server and affected endpoints captures the ransomware artifacts, encryption keys, and system state before any recovery actions that could overwrite critical data. This aligns with the CISM incident management phase of 'lessons learned' and ensures the team can determine the attack vector and prevent recurrence.

Answer

Restore the encrypted files from the most recent backup.

Answer

Attempt to decrypt the files using available decryption tools.

Answer

Notify law enforcement immediately.

Question 4

An organization's security team detects an unusual spike in outbound traffic from a database server to an external IP address during a routine security scan. The database server contains sensitive customer data. Which of the following is the MOST appropriate initial response?

Accepted Answer

Isolate the database server from the network to stop the traffic.. Isolating the database server is the most appropriate initial response because it immediately halts the suspected data exfiltration, containing the incident and preventing further loss of sensitive customer data. In incident management, the priority is to stop the active threat before performing any investigative or notification steps, as per the NIST SP 800-61 incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery). Delaying containment to review logs or run scans allows the exfiltration to continue, increasing the potential damage.

Answer

Notify the data protection officer and legal team.

Answer

Review firewall logs to confirm data exfiltration.

Answer

Run a full antivirus scan on the database server.

Question 5

During an incident investigation, the incident response team needs to collect volatile data from a compromised server. Which of the following data should be collected FIRST?

Accepted Answer

Contents of system memory (RAM). Volatile data, such as the contents of system memory (RAM), is lost when the system is powered off. Collecting RAM first preserves evidence of running processes, network connections, and encryption keys that would otherwise be destroyed. This follows the order of volatility (RFC 3227), which mandates capturing the most volatile data first.

Answer

Network connection logs from the firewall

Answer

Contents of the hard drive

Answer

Event logs from the system

Question 6

A security analyst reviews the following alert from the SIEM: 'Multiple failed login attempts from IP 10.0.0.5 to the domain controller within 5 minutes.' Which TWO actions should the analyst take as part of initial incident response?

Accepted Answer

Review authentication logs from other servers for similar patterns.. Option B is correct because reviewing authentication logs from other servers for similar patterns helps determine if the failed login attempts are part of a broader brute-force or password-spraying attack targeting multiple systems, not just the domain controller. This lateral analysis is a key initial step in incident response to assess the scope and identify compromised accounts or additional indicators of compromise (IoCs). Option E is correct because verifying whether the source IP belongs to an internal asset is critical to distinguish between an external attacker and a misconfigured internal service or user, which directly impacts the response strategy (e.g., internal remediation vs. external threat containment).

Answer

Block the IP address in the firewall immediately.

Answer

Escalate the alert to the incident response team.

Answer

Reset the password of the targeted account.

Question 7

Based on the exhibit, which of the following is the MOST likely attack vector?

Accepted Answer

Privilege escalation via a compromised account. The exhibit shows a user account with administrative privileges being used from an unusual geographic location at an anomalous time, followed by lateral movement to a domain controller. This pattern indicates that the initial access was gained through a compromised account, which was then leveraged for privilege escalation to move laterally and access sensitive systems. The attack vector is the misuse of valid credentials, not an injection or social engineering attack.

Answer

SQL injection attack

Answer

Phishing email with malicious attachment

Answer

Denial of service attack

Question 8

You are the information security manager for a financial services company that processes credit card transactions. The company uses a mix of on-premises servers and cloud services. During a routine vulnerability scan, you discover that one of the web servers has been compromised with a web shell that allows remote command execution. The server is part of a cluster that handles customer-facing web traffic. The incident response team is activated. The team's immediate actions include isolating the server from the network and taking a forensic image. However, the server is critical for business operations, and management is pressuring you to restore service quickly. The server's logs show that the web shell was uploaded three days ago, and during that time, the server processed approximately 10,000 transactions. The team has not yet fully analyzed the forensic image. You need to decide on the next steps. What should you do FIRST?

Accepted Answer

Conduct a thorough analysis of the forensic image to determine the extent of data access and exfiltration.. Option B is correct because before restoration, it is essential to assess the scope of the breach to determine if any sensitive data (e.g., credit card numbers) was exfiltrated. This informs legal and compliance obligations. Option A is premature without knowing the full impact. Option C is too passive; waiting for months is not feasible. Option D may be needed later but is not the first priority.

Answer

Wait for the next scheduled patch cycle to apply updates and then restore the server.

Answer

Restore the server from the most recent clean backup and bring it back online immediately to minimize revenue loss.

Answer

Notify the payment card industry (PCI) compliance auditor and request guidance on next steps.

Question 9

Order the steps for a risk assessment process according to ISACA's risk management framework.

Question 10

Order the steps for establishing a security incident response team (IRT).

Question 11

Match each incident management phase to its activity.

Question 12

Match each data classification level to its handling requirement.

Question 13

A security analyst detects unusual outbound traffic from a critical server to an unknown external IP address during business hours. Which step should be taken FIRST in the incident response process?

Accepted Answer

Contact the server owner to verify the traffic. The first step is to verify if the traffic is legitimate or malicious. Contacting the server owner helps determine if the traffic is authorized, preventing unnecessary escalation. Immediate containment (C) is premature without verification. Reporting to management (A) or law enforcement (D) occurs after confirmation.

Answer

Notify law enforcement about the potential breach

Answer

Isolate the server from the network immediately

Answer

Report the incident to senior management

Question 14

During a post-incident review, the incident response team identifies that the root cause of a data breach was a misconfigured firewall rule that allowed unrestricted inbound access from the internet. Which corrective action BEST addresses this issue?

Accepted Answer

Implement a change management process for firewall modifications. Implementing a change management process ensures that firewall rule changes are reviewed and approved, preventing misconfigurations. A one-time review (B) is temporary. Penetration testing (C) identifies vulnerabilities but doesn't fix process. Restoring from backup (D) does not address the configuration issue.

Answer

Increase the frequency of penetration tests

Answer

Conduct a one-time review of all firewall rules

Answer

Restore the firewall configuration from the last known good backup

Question 15

An organization's incident response plan (IRP) is being updated. Which stakeholder should be included in the IRP development to ensure legal and regulatory requirements are met?

Accepted Answer

Legal counsel. Legal counsel ensures the plan complies with relevant laws and regulations, such as breach notification requirements. The CISO (A) oversees security but may not have legal expertise. IT manager (B) focuses on technical aspects. External auditors (D) are not typically involved in plan development.

Answer

External auditors

Answer

Chief Information Security Officer (CISO)

Answer

IT manager