CISM Incident Management Practice Question
Which of the following incident categories would typically require the involvement of the crisis management team?
⚠ Common exam trap
A common pitfall is to assume that any high-severity technical incident automatically triggers crisis management. However, in the CISM framework, crisis management activation depends on the business impact and the need for executive-level decisions. A quickly mitigated DDoS may be handled by the incident response team alone, whereas a critical ransomware attack affecting core business processes requires crisis management due to the potential for significant financial, legal, and reputational consequences.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A P1 critical-severity ransomware attack encrypting critical systems.
A P1 critical-severity ransomware attack encrypting critical systems requires immediate activation of the crisis management team because it poses an existential threat to business operations, often involving legal, PR, executive, and regulatory stakeholders. The crisis management team handles incidents that exceed the capacity of the incident response team, typically those with high business impact, widespread system compromise, or potential for significant financial/reputational damage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A P2 high-severity DDoS attack that has been mitigated within a few hours.
Why it's wrong here
P2 may not require CMT if resolved quickly, though it could escalate.
- ✗
A P3 medium-severity insider threat involving unauthorized access to a non-critical system.
Why it's wrong here
P3 incidents have limited impact and are handled by IR team.
- ✗
A P4 low-severity phishing email reported by a user.
Why it's wrong here
P4 incidents have minimal impact and do not require CMT.
- ✓
A P1 critical-severity ransomware attack encrypting critical systems.
Why this is correct
P1 incidents require executive involvement and CMT activation.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.