CISM Incident Management Practice Question
During a major incident, the incident response team has contained the threat but recovery is taking longer than expected. The business continuity manager reports that the manual workaround in place will fail within four hours due to capacity limits. Which action should the incident manager take FIRST?
⚠ Common exam trap
The trap here is treating containment as the end of the incident manager's decision scope, when recovery risk crossing business tolerance requires executive escalation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Escalate the recovery timeline risk to the crisis management team (CMT) so it can decide on activating the business continuity plan.
Containment success does not end the incident if recovery cannot be completed within the tolerance of interim workarounds. The imminent failure of the manual workaround is a business continuity trigger that exceeds the incident response team's authority. Escalating to the CMT enables executives to authorize continuity plan activation, alternate processing, and stakeholder communications before the workaround collapses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Instruct the business continuity manager to extend the manual workaround beyond its documented capacity limits.
Why it's wrong here
Capacity limits in a workaround typically reflect hard constraints such as staffing, licensing, or physical throughput. Directing staff to exceed documented limits invites errors, service degradation, and potential safety or compliance violations. The continuity manager has already signaled the limit; the correct response is to escalate for a decision rather than override a control the business relies on.
- ✗
Direct the recovery team to work overtime and compress testing steps to accelerate system restoration.
Why it's wrong here
Compressing testing to meet a deadline increases the risk of reintroducing the threat or deploying unstable systems, potentially causing a second incident. Overtime alone does not address the capacity limit that will fail within four hours. The incident manager should not trade security assurance for speed without executive awareness of the residual risk and the alternatives available through continuity planning.
- ✗
Suspend incident communications until the recovery team confirms a new restoration estimate.
Why it's wrong here
Halting communications during an evolving incident leaves stakeholders uninformed and can worsen reputational and regulatory exposure. Executives, customers, and regulators may have notification expectations that continue regardless of recovery uncertainty. The incident manager should share the current status, the emerging capacity risk, and the escalation underway, keeping communications accurate even when timelines remain fluid.
- ✓
Escalate the recovery timeline risk to the crisis management team (CMT) so it can decide on activating the business continuity plan.
Why this is correct
When containment is achieved but recovery threatens to exceed the tolerance of manual workarounds, the decision to invoke the business continuity plan involves enterprise trade-offs beyond the incident response team's authority. Escalating to the CMT ensures executives can authorize alternate processing sites, customer communications, or resource commitments before the workaround fails, preventing an avoidable operational outage.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.