Match each incident management phase to its activity.
Drag a concept onto its matching description — or click a concept then click the description.
Develop incident response plan and train team
Identify and validate security incidents
Isolate threat, remove malware, restore operations
Conduct lessons learned and update procedures
Notify stakeholders and regulatory bodies
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Detection: Identifying signs of an incident.
The correct phases are: Detection (identifying signs), Response (immediate containment), Mitigation (controls to reduce impact), and Recovery (restoration). Common confusions include swapping Detection and Response activities, or Mitigation and Recovery activities.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Detection: Identifying signs of an incident.
Why this is correct
Detection is the phase where potential incidents are identified through monitoring and alerts.
Response: Implementing immediate containment actions.
Why this is correct
Response involves taking quick actions to contain the incident and prevent further damage.
Mitigation: Applying controls to reduce impact.
Why this is correct
Mitigation focuses on implementing controls to minimize the impact of the incident.
Recovery: Restoring normal operations.
Why this is correct
Recovery is the process of restoring systems and operations to normal after an incident.
Detection: Taking immediate containment actions.
Why it's wrong here
Incorrect — this describes the Response phase, not Detection.
Mitigation: Restoring normal operations.
Why it's wrong here
Incorrect — this describes the Recovery phase, not Mitigation.
Go deeper
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.