How should I use these Incident Management practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Incident Management questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Incident Management domain.

CISM · topic practice

Incident Management practice questions

CISM Domain 3 (Incident Management) covers preparing for, detecting, responding to, and recovering from security incidents while preserving evidence and coordinating business continuity. Questions test judgment on incident classification, escalation to crisis management, forensic evidence handling, root cause analysis, and post-incident review. Expect scenario-based items asking you to select the BEST or FIRST action, often distinguishing technical response from management and governance responsibilities.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Incident Management

Practice 10 questions Browse domain →

What the exam tests

What to know about Incident Management

You must be able to apply the incident response lifecycle to scenarios, prioritize actions, assign crisis team responsibilities, and protect evidence. The single most important thing: identify whether the question tests technical response or management escalation, then choose the action that fits that layer and preserves business and legal interests.

Incident response plan phases: preparation, detection, containment, eradication, recovery, and lessons learned

Evidence handling: chain of custody, forensic imaging, order of volatility, and legal hold procedures

Crisis management team roles, including CEO accountability for business decisions and stakeholder communication

Threat intelligence sharing via trusted frameworks such as ISACs and STIX/TAXII indicators

Watch out for

Common Incident Management exam traps

▸Choosing technical containment steps when the question asks for the FIRST management or governance action, such as activating the crisis team or notifying executives.
▸Confusing the CEO's crisis role with the CISO's operational role; the CEO decides business impact and communication, not forensic or technical remediation.
▸Overlooking evidence preservation requirements, such as capturing volatile data before powering off systems or failing to maintain chain of custody documentation.

Practice set

Incident Management questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Incident Management explanation →

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

Trap 1: To approve technical containment actions

Technical actions are decided by the IR team, not legal counsel.

Trap 2: To coordinate with external forensics firms

Coordination with forensics is an operational matter, not the primary role of legal in sitreps.

Trap 3: To ensure compliance with regulatory notification deadlines

Regulatory deadlines are important but not the primary reason for counsel involvement in sitreps.

Study all Incident Management common traps →

A
To approve technical containment actions
Why it fails: Technical actions are decided by the IR team, not legal counsel.
B
To preserve attorney-client privilege and avoid creating damaging records
Legal counsel involvement preserves attorney-client privilege over incident communications, shielding sensitive findings from later discovery. This satisfies the stem's constraint: executives receiving hourly sitreps during a P1 incident could inadvertently create damaging, disclosable records. Counsel directs wording and distribution so privileged analysis remains protected, while factual operational updates continue.
C
To coordinate with external forensics firms
Why it fails: Coordination with forensics is an operational matter, not the primary role of legal in sitreps.
D
To ensure compliance with regulatory notification deadlines
Why it fails: Regulatory deadlines are important but not the primary reason for counsel involvement in sitreps.

Incident Management practice questions

What to know about Incident Management

Common Incident Management exam traps

Incident Management questions

During a P1 (critical) incident, the incident response manager has been providing hourly situation reports (sitreps) to executives. What is the primary reason for involving legal counsel in these communications?

After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?

During a major security incident classified as P1, which of the following is the MOST appropriate communication frequency to the executive team?

Which of the following is the PRIMARY purpose of an incident response plan?

During a DDoS attack classified as P2, what is the EXPECTED response time and notification level?

When should an incident response transition to business continuity and disaster recovery (BC/DR) activation?

Which of the following is the FIRST step when engaging an external forensics firm for an incident?

Which TWO of the following are key roles on the crisis management team (CMT) for a major cybersecurity incident? (Select two.)

Which THREE of the following are incident severity levels defined in a typical incident management program? (Select three.)

An organization's incident response team is handling a P2 incident involving an insider threat. The team has identified the employee responsible. The communications lead is preparing a notification to affected parties. Which of the following should be included in the notification?

Which incident severity level requires executive notification and a 24/7 response?

During a DDoS attack, the incident response team is struggling to mitigate the attack. The team decides to engage the organization's ISP and a DDoS mitigation service. Which of the following should be done FIRST?

During a P1 incident, the incident response manager is preparing an executive sitrep. Which of the following should be included to preserve legal privilege?

An incident has been declared as P2 (high severity). According to the incident classification, what is the expected response timeframe and notification requirement?

An organization maintains evidence handling procedures for incident response. A forensic investigator needs to collect a hard drive from a compromised server. Which of the following is the MOST critical step to ensure admissibility in court?

An organization's incident response team is handling a P2 insider threat incident involving unauthorized access to customer data. According to the incident classification, which of the following is the MOST appropriate notification and response timeframe?

During a P1 incident, the crisis management team (CMT) has been activated. The CEO asks for an hourly sitrep. Which of the following is the MOST appropriate content for the sitrep?

An organization is conducting a root cause analysis after a data breach. Which of the following sequences BEST aligns with the 5 Whys approach from a CISM perspective?

Track your progress over time

Start a Incident Management only practice session

Related CISM topic practice pages

Information Security Governance practice questions

Incident Management practice questions

Information Security Programme practice questions

Information Security Program practice questions

Information Security Risk Management practice questions

CISM fundamentals practice questions

CISM scenario practice questions

CISM troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid