CISM Incident Management Practice Question
A company experiences a DDoS attack that overwhelms its internet-facing services. The incident response team implements mitigation measures. During which phase of incident response is it most appropriate to collect and preserve evidence for potential legal action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
During containment, eradication, and recovery
Evidence collection should occur during containment, eradication, and recovery, but ideally before remediation to preserve forensic data. In a DDoS, logs and traffic captures should be preserved early.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
During containment, eradication, and recovery
Why this is correct
Evidence preservation should be done before or during containment and recovery to ensure admissibility.
- ✗
During preparation
Why it's wrong here
Preparation involves planning, not evidence collection during an incident.
- ✗
During detection and analysis
Why it's wrong here
While initial evidence is gathered, the formal preservation for legal action occurs during the response phase.
- ✗
During post-incident activity
Why it's wrong here
Post-incident is too late; evidence may be lost or altered.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.