CISM Incident Management Practice Question
During a major incident, the incident response manager is coordinating containment while the crisis management team (CMT) handles business continuity decisions. A responder proposes immediately wiping and rebuilding an affected server to restore service quickly, but the server contains evidence relevant to a potential legal action. Which of the following is the MOST appropriate action for the incident response manager to take?
⚠ Common exam trap
The trap here is treating service restoration and evidence preservation as mutually exclusive, when in practice legal guidance plus forensic imaging or alternate infrastructure can satisfy both obligations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Consult legal counsel to determine preservation obligations, then choose a containment or recovery approach that preserves evidence while restoring service.
When legal action is anticipated, evidence preservation becomes a formal obligation that must be balanced against service restoration. The incident response manager should engage legal counsel to confirm preservation requirements, then select a containment or recovery method that keeps evidence intact, such as imaging the server or rebuilding on alternate infrastructure. This coordinated approach protects both operational continuity and the organization's legal position, avoiding the extremes of reckless destruction or unnecessary service outage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delegate the decision entirely to the forensic investigator and proceed based on their technical recommendation alone.
Why it's wrong here
Forensic investigators provide technical guidance on evidence handling but do not own legal preservation decisions or business continuity trade-offs. Delegating the entire decision bypasses legal counsel and business leadership, who must weigh obligations and impact. The incident response manager should integrate forensic, legal, and business input rather than ceding the decision to a single technical role.
- ✓
Consult legal counsel to determine preservation obligations, then choose a containment or recovery approach that preserves evidence while restoring service.
Why this is correct
Legal counsel determines whether a litigation hold or preservation duty applies, and the response must respect that obligation. The manager can often restore service using alternate infrastructure, network isolation, or forensic imaging before rebuild, satisfying both operational and legal needs. Consulting counsel first ensures the chosen containment method does not inadvertently destroy evidence and keeps the response defensible.
- ✗
Refuse to restore service until the forensic investigation is fully complete, regardless of business impact.
Why it's wrong here
Halting all recovery until forensics concludes can cause disproportionate business harm and is rarely required. Preservation obligations generally require retaining evidence, not indefinitely suspending operations; alternatives such as imaging, isolating, or rebuilding on new hardware can satisfy both needs. A blanket refusal ignores business continuity responsibilities and may itself create greater organizational damage than the original incident.
- ✗
Authorize the rebuild immediately because restoring service takes precedence over evidence preservation in all incidents.
Why it's wrong here
Restoring service is important, but asserting that it always overrides evidence preservation is incorrect. When legal action is anticipated, destroying potential evidence can expose the organization to sanctions, adverse inference, or loss of legal remedies. The incident response manager should coordinate with legal counsel and pursue containment or recovery options that preserve evidence where feasible, rather than treating service restoration as an absolute priority.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.