CISM Incident Management Practice Question
During a forensic investigation, the external forensics firm discovers evidence that may indicate criminal activity. The incident manager wants to ensure attorney-client privilege is maintained. What should be done?
⚠ Common exam trap
CISM often tests the misconception that speed or direct law enforcement cooperation is the priority, but the trap here is that preserving attorney-client privilege requires legal counsel to be involved from the outset, not after evidence is already shared.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Involve legal counsel to manage privilege
Involving legal counsel is essential to establish and preserve attorney-client privilege over the forensic investigation. Legal counsel can direct the scope of the investigation, issue a 'Kovel letter' to engage the external forensics firm as an agent of the attorney, and ensure that all communications and findings are protected under the work-product doctrine. Without this step, any evidence of criminal activity could be deemed discoverable and waive privilege, potentially compromising the organization's legal defense.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Share evidence directly with law enforcement
Why it's wrong here
Directly handing evidence to law enforcement waives privilege by passing it outside the legal-counsel chain, and it can compromise the investigation. It is tempting because reporting criminal activity is normally required, but the correct route is through legal counsel, who directs engagement and preserves privilege.
- ✓
Involve legal counsel to manage privilege
Why this is correct
Involving legal counsel preserves attorney-client privilege by channelling forensic findings through the legal team, since privilege attaches to communications made for legal advice. This satisfies the incident manager's constraint: counsel directs the investigation, and work product produced under their direction remains protected from disclosure during any subsequent criminal proceedings.
- ✗
Ignore privilege to speed up investigation
Why it's wrong here
Ignoring privilege exposes the firm's findings to discovery and can waive protection, undermining the investigation's legal defensibility. Privilege is preserved by routing work through counsel; speed alone never justifies abandoning it, even when evidence clearly indicates criminal activity.
- ✗
Publicly disclose the evidence
Why it's wrong here
Public disclosure destroys the confidentiality that attorney-client privilege depends on, and it also tips off suspects and contaminates evidence. It is tempting because transparency and breach-notification duties exist, but disclosure belongs to authorised legal or communications channels, not the incident manager acting unilaterally.
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.