easyMultiple ChoiceObjective-mapped
CISM Practice Question: Based on the incident response policy exhibit,…
Exhibit
Refer to the exhibit. ``` Policy: IncidentResponse - Phase: Detection - Action: Alert security team - Phase: Analysis - Action: Determine scope and impact - Phase: Containment - Action: Isolate affected systems - Phase: Eradication - Action: Remove malware - Phase: Recovery - Action: Restore from backup - Phase: Post-Incident - Action: Conduct lessons learned ```
Based on the incident response policy exhibit, which phase should include notifying external stakeholders such as law enforcement?
⚠ Common exam trap
ISACA often tests the misconception that law enforcement must be notified immediately upon detection, but the correct timing is after containment and eradication to avoid compromising evidence and operational response.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Post-Incident
B is correct because the post-incident phase is the appropriate time to notify external stakeholders such as law enforcement, as it occurs after containment and eradication are complete. During this phase, the incident is fully documented, evidence is preserved, and legal obligations (e.g., breach notification laws like GDPR Article 33 or HIPAA Breach Notification Rule) are fulfilled. Notifying law enforcement earlier could compromise forensic integrity or operational continuity, so it is deliberately deferred to the post-incident stage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Recovery
Why it's wrong here
Recovery restores operations.
- ✓
Post-Incident
Why this is correct
Post-incident includes reporting and lessons learned, which may involve external notifications.
- ✗
Detection
Why it's wrong here
Detection is about identifying the incident.
- ✗
Containment
Why it's wrong here
Containment focuses on limiting damage.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.