easyMultiple ChoiceObjective-mapped
CISM Practice Question: An organization's incident response plan has not…
An organization's incident response plan has not been updated in two years. Which of the following is the MOST likely consequence?
⚠ Common exam trap
Many exam-takers assume a plan's maturity or compliance improves with age, but CISM emphasizes that incident response plans must be living documents updated at least annually to remain effective against evolving threats and technologies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The plan may not address current threats and technologies.
An incident response plan that has not been updated in two years is unlikely to account for recent changes in the threat landscape, such as new attack vectors (e.g., ransomware-as-a-service, zero-day exploits) or shifts in technology stack (e.g., cloud-native architectures, IoT devices). Without periodic review, the plan may lack updated playbooks for current malware families, fail to reference new detection tools, or omit revised containment procedures for modern network segmentation. This gap directly increases the risk of ineffective response during an actual incident.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The plan will comply with new regulations automatically.
Why it's wrong here
Incorrect. An outdated incident response plan is unlikely to comply with new regulations automatically; regulatory changes require active updates to the plan.
- ✗
The plan will be more effective due to maturity.
Why it's wrong here
Incorrect. Maturity does not guarantee effectiveness; an outdated plan may contain obsolete procedures that reduce effectiveness against current threats.
- ✗
The plan will be followed exactly as written.
Why it's wrong here
Incorrect. An outdated plan is less likely to be followed exactly as written because it may not reflect current environments, leading to ad-hoc modifications.
- ✓
The plan may not address current threats and technologies.
Why this is correct
Correct. Over two years, the threat landscape and technologies evolve, so the plan may not address current threats like ransomware or cloud-native architectures, increasing response risk.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.