hardMultiple ChoiceObjective-mapped
CISM Practice Question: Has a distributed incident response team across…
An organization has a distributed incident response team across multiple time zones. During a critical incident, communication delays occur due to different work hours. Which strategy BEST improves coordination and response time?
⚠ Common exam trap
A common mistake is to assume that a single incident commander can effectively manage a global incident, but this overlooks the operational reality of time zone gaps. The follow-the-sun model provides continuous coverage through structured handoffs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a follow-the-sun incident response model
The follow-the-sun model aligns incident response handoffs with time zone shifts, ensuring continuous coverage without requiring all team members to work overlapping shifts. This reduces communication delays by transferring active incident ownership to the next available region, maintaining momentum and minimizing response time during critical incidents.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require all team members to work overlapping shifts
Why it's wrong here
Overlapping shifts improve coverage but may not cover all time zones.
- ✓
Implement a follow-the-sun incident response model
Why this is correct
Follow-the-sun ensures continuous coverage by handing off between regions.
- ✗
Designate a single incident commander for the entire response
Why it's wrong here
A single commander may not be available 24/7, causing delays.
- ✗
Outsource incident response to a managed security service provider
Why it's wrong here
Outsourcing may result in loss of control and context.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.