CISM Incident Management Practice Question
During a major data breach investigation, legal counsel advises the incident response team to preserve attorney-client privilege over communications with external forensic investigators. Which of the following actions BEST supports this objective?
⚠ Common exam trap
A common misconception is that a contractual clause or routing through a senior executive (like the CISO) is sufficient to preserve privilege, when in fact the legal control and direction by counsel is the critical factor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Direct the forensic investigators to report to legal counsel and mark all deliverables as privileged.
Directing forensic investigators to report directly to legal counsel and marking all deliverables as privileged establishes a clear legal framework for attorney-client privilege. This ensures that communications and work product are protected from discovery in litigation, as they are created under the direction of legal counsel for the purpose of providing legal advice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Have all communications with the forensic firm go through the CISO.
Why it's wrong here
Routing communications through the CISO does not create privilege; the CISO is not counsel, so the protection does not attach. It is tempting as a single controlled channel, but it would be correct when counsel directs the engagement and communications flow through them.
- ✗
Avoid documenting any findings related to the breach until after litigation is resolved.
Why it's wrong here
Suppressing documentation obstructs the investigation and breaches evidence-handling duties without conferring privilege. It is tempting as a way to limit discoverable material, but it would be correct only when counsel instructs that specific work product be prepared under their direction.
- ✗
Ensure the forensic engagement letter includes a clause acknowledging attorney-client privilege.
Why it's wrong here
A contractual clause cannot create attorney-client privilege; privilege derives from counsel directing the investigation, not from wording in the engagement letter. It is tempting because it appears to formalise protection, but it would be correct when the firm is retained by outside counsel to assist legal advice.
- ✓
Direct the forensic investigators to report to legal counsel and mark all deliverables as privileged.
Why this is correct
Routing forensic work through legal counsel and marking deliverables privileged brings the investigation under attorney work product, shielding it from disclosure. This satisfies the privilege-preservation objective by establishing counsel as the directing client rather than the incident response team.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.