CISM Incident Management Practice Test 5 — 15 Questions

Question 1

After detecting a ransomware infection on a file server, the incident response team performs containment and eradication. Which step should be prioritized during the recovery phase to minimize business impact?

Accepted Answer

Restore data from verified clean backups. Restoring data from clean backups is the most direct way to recover operations without paying ransom. Identifying the vulnerability (B) is part of eradication, not recovery. Negotiating with attackers (A) is discouraged. Reimaging all servers (D) may be excessive and cause more downtime.

Answer

Contact the attackers to negotiate a decryption key

Answer

Reimage all servers in the same network segment

Answer

Identify and patch the vulnerability used for entry

Question 2

A company's incident response team uses a SIEM to detect security events. Which SIEM capability is MOST critical for early detection of a potential incident?

Accepted Answer

Correlation rules. Correlation rules analyze multiple log sources to identify patterns indicating an attack, enabling early detection. Real-time alerting (A) is important but relies on correlation. Log retention (B) aids investigation. User behavior analytics (D) is advanced but not the most critical for early detection.

Answer

Real-time alerting

Answer

User and entity behavior analytics (UEBA)

Answer

Long-term log retention

Question 3

During an incident, the incident response team determines that a compromised account was used to exfiltrate data. The account has been disabled. What is the NEXT best action to prevent similar incidents?

Accepted Answer

Perform a root cause analysis. Conducting a root cause analysis identifies how the account was compromised (e.g., phishing, weak password), allowing implementation of preventive measures like multifactor authentication. Resetting all passwords (A) is reactive. Notifying affected customers (C) is a legal step after investigation. Reviewing logs (D) is part of analysis but not the next best preventive action.

Answer

Notify potentially affected customers

Answer

Reset passwords for all user accounts

Answer

Review authentication logs for other anomalies

Question 4

An organization has a distributed incident response team across multiple time zones. During a critical incident, communication delays occur due to different work hours. Which strategy BEST improves coordination and response time?

Accepted Answer

Implement a follow-the-sun incident response model. Implementing a follow-the-sun model ensures that a team is always available during business hours, reducing delays. A single point of contact (A) creates a bottleneck. Overlapping schedules (B) helps but not as comprehensive as follow-the-sun. Outsourcing (D) may introduce new issues.

Answer

Require all team members to work overlapping shifts

Answer

Designate a single incident commander for the entire response

Answer

Outsource incident response to a managed security service provider

Question 5

A security operations center (SOC) analyst receives an alert from the SIEM indicating a potential command and control (C2) communication. The alert is based on a signature that matches known C2 traffic. What is the MOST appropriate next step?

Accepted Answer

Verify the alert by correlating with other log sources. Verifying the alert by checking other log sources (e.g., firewall, DNS) reduces false positives before escalating. Escalating immediately (A) may waste resources. Blocking the IP (C) could be premature if legitimate. Running a full antivirus scan (D) is a reactive, not investigative step.

Answer

Block the destination IP address at the firewall

Answer

Escalate the alert to the incident response team immediately

Answer

Perform a full antivirus scan on all endpoints

Question 6

During a security incident, the incident response team discovers that an attacker used a previously unknown vulnerability (zero-day) in a widely used software. Which action should the team take to address this vulnerability in the short term?

Accepted Answer

Implement a virtual patch through an intrusion prevention system (IPS). Applying a vendor patch may not be available for zero-day. Implementing a virtual patch via an IPS provides immediate protection until a permanent fix is available. Recompiling the software (B) is not feasible. Reimaging all systems (C) does not address the vulnerability. Disabling the software (D) may be too disruptive.

Answer

Recompile the software with additional security controls

Answer

Immediately disable the software across the organization

Answer

Deploy a vendor patch as soon as it becomes available

Question 7

Which TWO of the following are primary goals of the containment phase in incident response? (Select TWO)

Accepted Answer

Prevent the incident from spreading to other systems. Correct: Limiting further damage (A) and preventing expansion (C) are containment goals. Eradication (B) is a separate phase. Preserving evidence (D) is important but not primary in containment, and restoring operations (E) is recovery.

Answer

Restore normal business operations

Answer

Eradicate the root cause of the incident

Answer

Preserve evidence for legal proceedings

Question 8

Which THREE of the following are key components of an incident response plan? (Select THREE)

Accepted Answer

Communication and escalation matrix. Correct: Response procedures (A), communication escalation (B), and roles and responsibilities (C) are essential. A budget (D) is not typically part of the plan itself. A list of all employees (E) is too detailed and not a core component.

Answer

List of all employees' contact information

Answer

Annual budget for incident response tools

Question 9

Which TWO of the following are recommended practices when conducting a post-incident review? (Select TWO)

Accepted Answer

Document lessons learned and improvement actions. Correct: Identifying root cause (B) and documenting lessons learned (C) are key. Assigning blame (A) is discouraged. Updating the IRP (D) is a result, but not the review itself. Reimaging systems (E) is recovery, not review.

Answer

Update the incident response plan immediately

Answer

Assign blame to responsible individuals

Answer

Reimage all affected systems

Question 10

After a ransomware attack, a company discovers that backups are also encrypted. The incident response team has isolated the affected systems. What should be the next step?

Accepted Answer

Isolate additional systems and notify law enforcement.. Option C is correct because the priority is to contain the incident and then involve law enforcement to investigate, while preserving evidence. Option A is wrong because paying ransom is not recommended and may not guarantee recovery. Option B is wrong because encrypted backups cannot be restored. Option D is wrong because reimaging destroys forensic evidence.

Answer

Attempt restoration from encrypted backups.

Answer

Pay the ransom to obtain decryption keys.

Answer

Reimage all systems from known clean media.

Question 11

An organization's intrusion detection system alerts on a potential C2 communication from an internal host. Which phase of the incident response lifecycle should be initiated first?

Accepted Answer

Detection and Analysis. Option A is correct because detection and analysis is the first phase after preparation. Option B is wrong because containment follows analysis. Option C is wrong because eradication comes after containment. Option D is wrong because recovery is after eradication.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 12

A multinational corporation experiences a security breach involving customer PII. The incident response team needs to determine notification requirements. Which factor is MOST important in deciding which regulatory bodies to inform?

Accepted Answer

Location of the affected individuals. Option D is correct because notification requirements depend on the jurisdiction of the affected individuals. Option A is wrong because the data custodian's location is not always relevant. Option B is wrong because the CIO's location is irrelevant. Option C is wrong because attacker location does not determine notification obligations.

Answer

Location of the attacker

Answer

Location of the company's CIO

Answer

Location of the data custodian

Question 13

During incident response, a forensic investigator needs to collect evidence from a compromised server. Which action BEST preserves evidence integrity?

Accepted Answer

Pull the power cord. Option B is correct because pulling power ensures memory is preserved and no OS tampering. Option A is wrong because normal shutdown runs processes that can destroy evidence. Option C is wrong because file copy changes timestamps. Option D is wrong because network imaging may miss volatile memory.

Answer

Perform a graceful shutdown

Answer

Create a network-based image

Answer

Copy files to an external drive

Question 14

An incident response plan (IRP) is being tested. Which metric is MOST indicative of the team's effectiveness during an exercise?

Accepted Answer

Mean time to detect (MTTD). Option A is correct because time to detect is a key performance indicator. Option B is wrong because number of tools used does not indicate effectiveness. Option C is wrong because cost of the exercise is not a performance metric. Option D is wrong because volume of logs is not directly tied to response quality.

Answer

Total cost of the exercise

Answer

Number of tools used

Answer

Volume of logs generated

Question 15

After a phishing attack, an organization's incident response team identifies that the attacker gained access to an email account and sent internal spear-phishing emails. What is the BEST immediate containment action?

Accepted Answer

Disable the compromised account. Option D is correct because disabling the compromised account stops further malicious activity. Option A is wrong because blocking the attacker's IP is ineffective if the attacker is using compromised internal accounts. Option B is wrong because resetting passwords across the domain may cause disruption and does not isolate the immediate threat. Option C is wrong because email filtering may not block internal-to-internal emails.

Answer

Reset all user passwords

Answer

Block the attacker's IP address at the firewall

Answer

Increase email filtering rules