easyMultiple ChoiceObjective-mapped
CISM Practice Question: A small business without a dedicated incident…
A small business without a dedicated incident response team experiences a suspected breach. Who should be primarily responsible for leading the incident response efforts?
⚠ Common exam trap
Candidates often assume the IT administrator who discovered the breach should lead because they are most familiar with the systems, but CISM emphasizes that incident response requires impartial, trained leadership to avoid evidence mishandling and ensure adherence to legal and forensic best practices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The external cybersecurity consultant on retainer.
In a small business lacking a dedicated incident response team, the external cybersecurity consultant on retainer (Option C) is the most appropriate leader because they possess the specialized expertise, tools, and experience required to manage the technical aspects of incident response, such as forensic analysis, containment, and eradication. The consultant can provide an objective, skilled response without the conflicts of interest or lack of training that internal staff may have, ensuring adherence to industry frameworks like NIST SP 800-61 or SANS PICERL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CEO of the company.
Why it's wrong here
Incorrect: CEO should oversee but not lead technical response.
- ✗
The IT administrator who discovered the breach.
Why it's wrong here
Incorrect: May lack incident response training and objectivity.
- ✓
The external cybersecurity consultant on retainer.
Why this is correct
Correct: Brings specialized skills and experience.
- ✗
The legal counsel.
Why it's wrong here
Incorrect: Legal counsel advises on legal matters, not incident response.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.