CISM Incident Management Practice Question
During a P1 incident, the crisis management team (CMT) has been activated. The CEO asks for an hourly sitrep. Which of the following is the MOST appropriate content for the sitrep?
⚠ Common exam trap
The ISACA CISM exam often tests the distinction between operational incident management (executive sitrep) and technical incident response (detailed analysis), leading candidates to choose overly technical options like B instead of the legally vetted, decision-focused summary in A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Current status of containment, confirmed facts, and actions taken, with legal counsel input.
During a P1 incident, the CEO requires a concise, actionable sitrep focused on containment status, confirmed facts, and actions taken. Legal counsel input is critical to avoid premature attribution or disclosure that could create liability or violate data breach notification laws. This aligns with the CISM incident management principle of providing decision-ready information to executive leadership without technical clutter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Current status of containment, confirmed facts, and actions taken, with legal counsel input.
Why this is correct
This provides clear, factual updates while protecting privilege.
- ✗
A detailed technical analysis of the attack vector and exploited vulnerabilities.
Why it's wrong here
Technical details may be too complex for executive audience and could include speculation.
- ✗
Names of individuals potentially responsible for the incident.
Why it's wrong here
Attribution is premature and could have legal implications.
- ✗
Estimated financial impact and potential regulatory penalties.
Why it's wrong here
Financial estimates may be premature and speculative.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.