hardMultiple Choice
CISM Practice Question: Has a distributed incident response team across…
An organization has a distributed incident response team across multiple time zones. During a critical incident, communication delays occur due to different work hours. Which strategy BEST improves coordination and response time?
⚠ Common exam trap
A common mistake is to assume that a single incident commander can effectively manage a global incident, but this overlooks the operational reality of time zone gaps. The follow-the-sun model provides continuous coverage through structured handoffs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a follow-the-sun incident response model
The follow-the-sun model aligns incident response handoffs with time zone shifts, ensuring continuous coverage without requiring all team members to work overlapping shifts. This reduces communication delays by transferring active incident ownership to the next available region, maintaining momentum and minimizing response time during critical incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require all team members to work overlapping shifts
Why it's wrong here
Overlapping shifts shrink the daily window in which nobody is available, but they do not give the incident continuous coverage across all time zones. It tempts because overlap directly targets the communication-delay symptom, yet it still leaves periods where most of the distributed team is off-shift.
- ✓
Implement a follow-the-sun incident response model
Why this is correct
A follow-the-sun model assigns coverage across time zones so analysts in active working hours handle the incident continuously, eliminating the delays caused by differing work schedules. This directly satisfies the coordination constraint by ensuring round-the-clock handoffs rather than waiting for one region to wake.
- ✗
Designate a single incident commander for the entire response
Why it's wrong here
A single incident commander centralises decision authority but does not remove the time-zone gap causing the delays; the commander still waits on responders asleep in other regions. It tempts because unified command is standard incident-response practise, yet it addresses accountability, not round-the-clock coverage.
- ✗
Outsource incident response to a managed security service provider
Why it's wrong here
Outsourcing transfers response to a provider whose own staff also work set hours, so the time-zone coordination problem persists and organisational context is lost. It tempts because MSSPs offer 24/7 monitoring, but the stem asks to improve coordination among the existing distributed team, not to replace it.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.