CISM Incident Management Practice Question
Which role in the incident response team structure is responsible for coordinating all response activities and making decisions about incident severity classification?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident response manager
The IR manager leads the team, coordinates activities, and classifies incidents based on severity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Incident response manager
Why this is correct
The incident response manager runs the response end to end, tasking technical teams and assigning severity classifications that trigger escalation and notification thresholds. This satisfies the stem's requirement for the coordinating role, distinguishing it from the executive sponsor's governance remit and the communications lead's messaging duties.
- ✗
Communications lead
Why it's wrong here
The communications lead manages internal and external messaging, stakeholder updates and media liaison, not response coordination or severity classification. It is tempting because communication is central to incident handling, but severity decisions and activity coordination sit with the incident commander, not the communications function.
- ✗
Security analysts
Why it's wrong here
Security analysts perform triage, investigation and containment tasks under direction; they do not own overall coordination or final severity classification. It is tempting because analysts are deeply involved in incidents, but the coordinating and decision-making authority belongs to the incident commander role.
- ✗
Forensic investigators
Why it's wrong here
Forensic investigators collect, preserve and analyse evidence to support investigation and potential legal action, not coordinate the wider response or classify severity. It is tempting because forensics is a core incident response discipline, but evidence handling is a specialist function subordinate to the incident commander's coordination.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.