20+ practice questions focused on Incident Management — one of the most tested topics on the Certified Information Security Manager CISM exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Incident Management PracticeWhich TWO of the following are required components of an incident response programme according to best practices? (Select two.)
Explanation: The incident response policy is the foundational document that establishes management's commitment, defines roles and responsibilities, and sets the scope and authority for the incident response programme. Without a formal policy, the programme lacks organizational mandate and cannot enforce compliance with incident handling procedures.
A company discovers a credential compromise affecting multiple user accounts. According to best practices, what is the first step the incident response team should take?
Explanation: When a credential compromise is discovered, the immediate priority is containment to prevent further unauthorized access. Disabling compromised accounts and resetting passwords (Option B) stops the attacker from using the stolen credentials, aligning with the NIST SP 800-61 incident response lifecycle's containment phase. This action directly mitigates the active threat before any forensic analysis or notification occurs.
Which component of the incident response programme provides step-by-step technical instructions for handling a specific type of security incident?
Explanation: C is correct because an incident response playbook provides detailed, step-by-step technical instructions for handling a specific type of security incident (e.g., ransomware, DDoS, phishing). Unlike the higher-level incident response plan, a playbook contains precise technical actions, such as commands to isolate a host, indicators of compromise (IOCs) to block, and escalation criteria tailored to a particular threat.
During a forensic investigation, the external forensics firm discovers evidence that may indicate criminal activity. The incident manager wants to ensure attorney-client privilege is maintained. What should be done?
Explanation: Involving legal counsel is essential to establish and preserve attorney-client privilege over the forensic investigation. Legal counsel can direct the scope of the investigation, issue a 'Kovel letter' to engage the external forensics firm as an agent of the attorney, and ensure that all communications and findings are protected under the work-product doctrine. Without this step, any evidence of criminal activity could be deemed discoverable and waive privilege, potentially compromising the organization's legal defense.
An organization's incident response (IR) policy should be approved by which of the following to ensure authority and accountability?
Explanation: The IR policy requires senior management approval to demonstrate organizational commitment and allocate necessary resources.
+15 more Incident Management questions available
Practice all Incident Management questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Incident Management. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Incident Management questions on the CISM frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Incident Management is tested as part of the Certified Information Security Manager CISM blueprint. Practicing with targeted Incident Management questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CISM practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Incident Management is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Incident Management practice session with instant scoring and detailed explanations.
Start Incident Management Practice →