CISM Incident Management Practice Question
A financial services firm has just contained a malware outbreak that disabled online banking for six hours. The incident commander confirms systems are restored and monitoring is stable. Executive leadership now wants to know what must happen before the incident can be formally closed. Which activity is MOST important to complete prior to closure?
⚠ Common exam trap
The trap here is equating containment and restoration with incident closure, when the post-incident lessons-learned review is what formally completes the lifecycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct a lessons-learned review to identify improvements to the incident response plan and controls
Formal incident closure requires more than restored service; it requires capturing what happened and improving from it. The lessons-learned review examines detection, response, and control effectiveness, producing corrective actions that reduce recurrence likelihood and severity. Tool purchases, additional notifications, and blanket reimaging are either premature, situationally dependent, or duplicative of completed recovery work. By institutionalizing findings before closure, the organization ensures the incident yields lasting security value rather than a return to the status quo.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Notify the regulator a second time to confirm that online banking services have been fully restored
Why it's wrong here
Regulatory notification obligations are defined by jurisdiction and incident type, and a follow-up filing may be required in some cases, but it is a compliance action rather than the primary internal closure step. The question of whether to notify again depends on legal and regulatory guidance already established during the incident. Treating a second notification as the most important pre-closure task substitutes a possible obligation for the essential learning activity that strengthens future response.
- ✓
Conduct a lessons-learned review to identify improvements to the incident response plan and controls
Why this is correct
A lessons-learned review converts the incident into durable improvement by examining what worked, what failed, and which controls, procedures, or training need change. CISM treats post-incident review as the mechanism that closes the loop between response and prevention, ensuring the same weakness is not exploited again. Without it, the organization returns to its prior state and repeats mistakes. It is the defining pre-closure activity because it captures organizational learning while details remain fresh.
- ✗
Purchase additional endpoint detection licenses to cover the remaining unmanaged devices
Why it's wrong here
Acquiring more licenses may be a valid outcome of the lessons-learned review, but it is a procurement action, not the closure criterion itself. Buying tools without first analyzing why the outbreak succeeded and which gaps mattered risks spending on the wrong control. The review should drive such decisions based on evidence. Until the analysis identifies unmanaged endpoints as a root cause, this purchase is premature and does not constitute completing the incident.
- ✗
Rotate all administrative credentials and reimage every server in the affected data center
Why it's wrong here
Credential rotation and reimaging may be appropriate eradication and recovery actions, but they occur during the response, before the incident is considered contained and restored. Once systems are confirmed restored and monitoring is stable, performing blanket reimaging would cause unnecessary additional downtime and cost. The most important remaining step is to analyze the incident and improve defenses, not to repeat recovery work that has already been validated.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.