How should I use these Incident Management practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Incident Management questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Incident Management domain.

CISM · topic practice

Incident Management practice questions

Practise Certified Information Security Manager CISM Incident Management practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Incident Management

Practice 10 questions Browse domain →

What the exam tests

What to know about Incident Management

Incident Management questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Incident Management exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Incident Management questions

20 questions · select your answer, then reveal the explanation

Question 1mediummulti select

Read the full Incident Management explanation →

Which TWO of the following are required components of an incident response programme according to best practices? (Select two.)

Trap 1: IR team roster

Team roster is part of the plan but not a separate core component.

Trap 2: Communication templates

Templates are useful but not a core required component.

Trap 3: Vendor contacts list

Vendor contacts are helpful but not a core required component.

Study all Incident Management common traps →

A
IR team roster
Why wrong: Team roster is part of the plan but not a separate core component.
B
Incident response policy
The policy provides high-level commitment and direction.
C
Incident response plan
The plan defines the overall approach, roles, and procedures.
D
Communication templates
Why wrong: Templates are useful but not a core required component.
E
Vendor contacts list
Why wrong: Vendor contacts are helpful but not a core required component.

Incident Management practice questions

What to know about Incident Management

Common Incident Management exam traps

Incident Management questions

Which TWO of the following are required components of an incident response programme according to best practices? (Select two.)

A company discovers a credential compromise affecting multiple user accounts. According to best practices, what is the first step the incident response team should take?

Which component of the incident response programme provides step-by-step technical instructions for handling a specific type of security incident?

During a forensic investigation, the external forensics firm discovers evidence that may indicate criminal activity. The incident manager wants to ensure attorney-client privilege is maintained. What should be done?

An organization's incident response (IR) policy should be approved by which of the following to ensure authority and accountability?

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is unable to restore operations within the maximum tolerable downtime (MTD). Which action should be taken next?

Which incident severity level requires executive notification and a 24/7 response?

Following a data breach, an organization conducts a root cause analysis using the 5 Whys technique. The analysis identifies that a misconfigured firewall allowed unauthorized access. What is the most important next step to prevent recurrence?

An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?

Which of the following is typically a member of the crisis management team (CMT) during a major cybersecurity incident?

As part of post-incident activities, an organization schedules a lessons learned meeting. When should this meeting ideally take place?

During a data breach investigation, legal counsel instructs the forensics team to preserve evidence under attorney-client privilege. Which of the following actions is most critical to maintain that privilege?

An organization is updating its incident response playbook after a ransomware attack. Which of the following should be included as a key step in the ransomware playbook?

Which of the following is the primary purpose of having a pre-established forensic retainer agreement?

After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?

Which TWO of the following are essential components of an incident response programme?

Which THREE of the following should be included in an incident communication template?

Which TWO of the following are appropriate actions for preserving evidence during a cybersecurity incident?

During a major security incident classified as P1, which of the following is the MOST appropriate communication frequency to the executive team?

Track your progress over time

Start a Incident Management only practice session

Related CISM topic practice pages

Information Security Governance practice questions

Incident Management practice questions

Information Security Programme practice questions

Information Security Program practice questions

Information Security Risk Management practice questions

CISM fundamentals practice questions

CISM scenario practice questions

CISM troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid