CISM Incident Management Practice Test 9 — 15 Questions

Question 1

A user reports that their computer is behaving oddly, and an IT technician finds a suspicious file in the startup folder. The technician is not sure if this is an incident. What should the technician do FIRST?

Accepted Answer

Escalate to the security team. When unsure, the best practice is to escalate to the security team to investigate further. Deleting the file could destroy evidence, and scanning may not be sufficient. Option B is correct.

Answer

Document the findings and continue monitoring

Answer

Run an antivirus scan

Answer

Delete the suspicious file

Question 2

After an incident is contained and eradicated, the incident response team conducts a post-incident review. Which of the following is the PRIMARY objective of this review?

Accepted Answer

Identify process improvements. The main goal of a post-incident review is to identify process improvements to prevent future incidents. Option B is correct.

Answer

Update security policies

Answer

Determine the financial impact

Answer

Assign blame to the responsible parties

Question 3

During a cyber incident, the organization's legal counsel advises that certain information about the breach should not be shared with external partners due to ongoing law enforcement investigation. The incident response team must balance transparency with confidentiality. Which of the following is the BEST approach?

Accepted Answer

Provide only non-sensitive overview to partners. Providing a non-sensitive overview keeps partners informed without compromising the investigation. Option B is correct.

Answer

Seek partner input on what to share

Answer

Share all information with partners under NDA

Answer

Withhold all information until investigation ends

Question 4

Which TWO are key indicators of a data breach? (Choose two.)

Accepted Answer

Unusual outbound network traffic. Unusual outbound traffic and unauthorized access to sensitive data are classic indicators of a data breach. Multiple failed logins may indicate brute force, spam relates to phishing, and performance degradation is too vague.

Answer

System performance degradation

Answer

Increased spam emails to the organization

Answer

Multiple failed login attempts from a single user

Question 5

Which THREE are essential steps in incident containment? (Choose three.)

Accepted Answer

Disable compromised accounts. Isolating affected systems, disabling compromised accounts, and preserving forensic evidence are critical containment steps. Root cause analysis is part of investigation, and notifying regulators is a post-containment step.

Answer

Root cause analysis

Answer

Notify external regulators

Question 6

Which THREE are valid sources for threat intelligence that can be used during incident response? (Choose three.)

Accepted Answer

Industry information sharing groups. OSINT, industry information sharing groups, and vendor vulnerability databases are established threat intelligence sources. Social media posts from employees are unreliable, and internal network traffic logs are operational data, not threat intelligence.

Answer

Social media posts from employees

Answer

Internal network traffic logs

Question 7

Refer to the exhibit.
Given the exhibit, which type of incident is MOST likely occurring?

Accepted Answer

Insider threat. The exhibit shows a user logging in from an unusual location, attempting unauthorized access, and then exfiltrating sensitive data. This pattern is indicative of an insider threat, as it involves a legitimate user performing malicious actions. Option A is correct.

Answer

Phishing campaign

Answer

Ransomware attack

Answer

DDoS attack

Question 8

Refer to the exhibit.
Based on the exhibit, what is the security implication of this S3 bucket policy?

Accepted Answer

Allows any user from internal network to read objects, but any user can write objects from anywhere. The policy allows GetObject only from the internal IP range (10.0.0.0/8), but PutObject is allowed from any IP without restriction. This means anyone on the internet can write objects to the bucket. Option B is correct.

Answer

Denies all access except from 10.0.0.0/8

Answer

Allows only users from 10.0.0.0/8 to read and write

Answer

Allows any authenticated user to read and write objects

Question 9

Refer to the exhibit.
The exhibit shows network traffic from a server to a database. What does this pattern MOST likely indicate?

Accepted Answer

SQL injection attempt. A rapid increase in connections to a database in a short time is typical of an automated SQL injection tool testing and exploiting vulnerabilities. Normal application load would be steadier, and a crash would show no connections. Option C is correct.

Answer

Query optimization issue

Answer

Normal application load

Answer

Database server crash

Question 10

After a security incident, which step should be taken first?

Accepted Answer

Containment. Containment is the first priority to prevent further damage. Eradication, recovery, and lessons learned come later.

Answer

Recovery

Answer

Lessons learned

Answer

Eradication

Question 11

A company's IDS alerts on a potential breach. The incident response team is called. What should they do immediately?

Accepted Answer

Verify the alert and assess scope. The first step is to verify the alert and assess the scope to determine if it's a true positive and understand the impact.

Answer

Disconnect all network cables

Answer

Notify law enforcement

Answer

Reimage affected systems

Question 12

During incident investigation, which evidence preservation method is most important?

Accepted Answer

Create a forensic image of affected drives. Creating a forensic image preserves a bit-by-bit copy of the drive for analysis without altering evidence.

Answer

Take screenshots of the attack

Answer

Interview witnesses immediately

Answer

Reboot the system to capture memory

Question 13

A company experiences ransomware that encrypts critical servers. Backups are available but were taken 2 weeks ago. What is the best course?

Accepted Answer

Restore from backups after verifying no residual malware and performing security scans. Restore from backups after verifying no residual malware and performing security scans to ensure clean restoration.

Answer

Restore from backups immediately

Answer

Rebuild servers from scratch

Answer

Pay the ransom

Question 14

An organization's incident response plan includes a call tree. During an incident, the primary contact is unreachable. What should happen?

Accepted Answer

Move to the next person in the call tree. The call tree should have alternates; proceeding to the next person ensures continuity.

Answer

Escalate to senior management

Answer

Use a different communication method like email

Answer

Wait for the primary to become available

Question 15

After containing a security incident, the team conducts a root cause analysis. They find the breach originated from a compromised third-party vendor account. What is the most effective long-term mitigation?

Accepted Answer

Implement vendor access reviews and enforce MFA. Implementing vendor access reviews and enforcing MFA addresses the root cause of unauthorized access.

Answer

Increase logging on vendor accounts

Answer

Change all passwords manually

Answer

Terminate the vendor relationship