CISM Incident Management Practice Question
Which of the following is the PRIMARY purpose of having a pre-established contract with a digital forensics firm before an incident occurs?
⚠ Common exam trap
Many exam-takers confuse a secondary benefit (like cost savings or availability) with the primary operational goal of reducing engagement time, which is the core driver in incident management scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To reduce the time required to engage the firm during an incident
The primary purpose of a pre-established contract with a digital forensics firm is to eliminate procurement delays during an incident. When an incident occurs, time is critical; having a signed contract in place allows the firm to be engaged immediately without waiting for legal or administrative approvals, which directly supports the incident response goal of minimizing damage and preserving evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To ensure attorney-client privilege is automatically applied
Why it's wrong here
Attorney-client privilege depends on the firm being engaged through legal counsel and the nature of the communication, not on the contract's existence. A retainer's purpose is rapid mobilisation and pre-agreed scope, terms and contacts before evidence degrades.
- ✗
To ensure the firm is available 24/7
Why it's wrong here
Round-the-clock availability is an operational convenience, not the primary purpose; many firms provide it without a prior contract. The retainer's core value is pre-negotiated scope, rates, escalation paths and legal terms so response begins immediately without procurement delays.
- ✗
To guarantee a discounted rate
Why it's wrong here
Cost reduction is a commercial benefit, not the primary purpose; rates can be negotiated at any time. A pre-established contract primarily secures pre-agreed scope, terms and mobilisation procedures so forensic response starts immediately and evidence handling is defensible.
- ✓
To reduce the time required to engage the firm during an incident
Why this is correct
A retainer establishes pre-negotiated rates, scopes and call-out procedures, so the firm can be mobilised immediately rather than negotiating terms mid-incident. That directly satisfies the stem's constraint of reducing engagement time when every hour of dwell time increases damage.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.