CISM Incident Management Practice Question
An organization's incident response plan defines containment, eradication, and recovery phases. During a major incident involving a compromised application server, the incident response manager must decide whether to take the server offline immediately or keep it running to observe attacker behavior. Which of the following is the MOST important factor in making this decision?
⚠ Common exam trap
The trap here is assuming that forensic preservation always takes precedence over business impact, when in fact containment decisions must be driven by business risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The potential business impact of taking the server offline versus the risk of allowing the attacker to persist.
The containment decision during an incident must balance the risk of continued attacker presence against the business impact of taking systems offline. CISM emphasizes aligning incident response with business objectives, so the incident response manager should prioritize business impact and risk. Forensic preservation, threat intelligence, and past experience are supporting considerations but not the primary factor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The attacker's known tactics, techniques, and procedures (TTPs) from threat intelligence.
Why it's wrong here
Understanding TTPs helps predict attacker behavior, but it is not the most important factor in the containment decision. The decision must weigh business impact and risk. TTPs inform the response but do not determine whether to take the server offline. This option is a distractor because it focuses on threat intelligence rather than business considerations.
- ✗
The incident response team's previous experience with similar incidents.
Why it's wrong here
Past experience can guide decisions, but it is not the most important factor. Each incident is unique, and the decision should be based on current business impact and risk. Relying solely on past experience could lead to inappropriate actions. This option is less relevant than assessing the specific business impact and risk.
- ✓
The potential business impact of taking the server offline versus the risk of allowing the attacker to persist.
Why this is correct
This is correct because the containment decision must balance business impact against security risk. The incident response manager should assess how critical the server is to business operations and the potential damage if the attacker remains. This aligns with CISM's focus on aligning incident response with business objectives. The other options are less directly relevant to the immediate containment trade-off.
- ✗
The availability of forensic tools to capture volatile memory before shutting down the server.
Why it's wrong here
While forensic preservation is important, it is not the primary factor in deciding whether to contain immediately. The decision should first consider business impact and risk. Forensic considerations are part of the response but do not override the need to protect business operations. This option is plausible but not the most important factor.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.