CISM Incident Management Practice Question
During a data breach investigation, legal counsel instructs the forensics team to preserve evidence under attorney-client privilege. Which of the following actions is most critical to maintain that privilege?
⚠ Common exam trap
CISM often tests the misconception that technical security measures like encryption or network isolation are sufficient to maintain attorney-client privilege, but the key is controlling the distribution of information.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Limit distribution of forensic reports to individuals with a need-to-know and under legal direction
To maintain attorney-client privilege during a data breach investigation, it is critical to limit distribution of forensic reports to individuals with a need-to-know and under legal direction. This preserves confidentiality, which is essential for privilege to apply. Uncontrolled distribution can waive privilege, exposing sensitive information to discovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a separate, isolated network for forensic analysis
Why it's wrong here
Network isolation protects evidence integrity from tampering, not privilege, which depends on counsel directing the work and controlling distribution. It is tempting because isolated analysis networks are genuinely correct for malware containment or high-assurance forensic acquisition, where preventing cross-contamination matters.
- ✓
Limit distribution of forensic reports to individuals with a need-to-know and under legal direction
Why this is correct
Attorney-client privilege depends on confidentiality; disclosure to third parties can waive it. Restricting forensic reports to need-to-know recipients acting under legal direction preserves the protected communication channel, satisfying counsel's instruction and preventing inadvertent waiver during the breach investigation.
- ✗
Encrypt all forensic images with a strong algorithm
Why it's wrong here
Encryption protects confidentiality of the images but does not establish or preserve attorney-client privilege, which depends on the material being created for legal advice and its access being restricted to counsel. It is tempting because encryption is a genuine forensic control, and it is correct when the requirement is protecting evidence integrity or confidentiality.
- ✗
Destroy all preliminary notes after the final report is issued
Why it's wrong here
Destroying notes eliminates the documentary trail privilege protects, so no evidence remains to withhold or assert privilege over. Retention under counsel's direction is what sustains the claim. The action is tempting as routine file hygiene after report closure, which suits ordinary records management, not privileged investigation material.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.