CISM Incident Management Practice Question
During a major data breach investigation, legal counsel advises the incident response team to preserve attorney-client privilege over communications with external forensic investigators. Which of the following actions BEST supports this objective?
⚠ Common exam trap
A common misconception is that a contractual clause or routing through a senior executive (like the CISO) is sufficient to preserve privilege, when in fact the legal control and direction by counsel is the critical factor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Direct the forensic investigators to report to legal counsel and mark all deliverables as privileged.
Directing forensic investigators to report directly to legal counsel and marking all deliverables as privileged establishes a clear legal framework for attorney-client privilege. This ensures that communications and work product are protected from discovery in litigation, as they are created under the direction of legal counsel for the purpose of providing legal advice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Have all communications with the forensic firm go through the CISO.
Why it's wrong here
The CISO may not be legal counsel; privilege requires legal direction.
- ✗
Avoid documenting any findings related to the breach until after litigation is resolved.
Why it's wrong here
Not documenting is impractical and may hinder response.
- ✗
Ensure the forensic engagement letter includes a clause acknowledging attorney-client privilege.
Why it's wrong here
While helpful, the key is legal counsel directing the work.
- ✓
Direct the forensic investigators to report to legal counsel and mark all deliverables as privileged.
Why this is correct
This ensures the work is done under legal direction and protected by privilege.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.