mediumMultiple Select
CISM Practice Question: Which TWO are common challenges in incident…
Which TWO are common challenges in incident management?
⚠ Common exam trap
The CISM exam often tests the misconception that operational issues like 'too many staff' or 'excessive documentation' are primary challenges, when in fact the core problems are communication breakdowns and lack of executive sponsorship.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inadequate communication between teams
Option A (Inadequate communication between teams) is correct because incident management depends on rapid, accurate information flow across responders, service owners, and stakeholders; breakdowns in communication cause delayed escalations, duplicated effort, and prolonged mean time to resolution (MTTR). Option B (Lack of executive support) is correct because without executive sponsorship, incident management programs often lack the authority, funding, staffing, and cross-departmental cooperation needed to enforce processes, prioritize remediation, and drive continual improvement. Options C, D, and E are not common incident management challenges: having too many technical staff is not typically a recognized problem, over-reliance on automation is a general operational risk rather than a core incident management challenge, and excessive documentation is not a standard pain point since most organizations struggle with insufficient rather than excessive documentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Inadequate communication between teams
Why this is correct
Inadequate communication between teams is a recognised incident management challenge because response depends on coordinated handoffs between security operations, IT, and business units. Poor information flow delays escalation, obscures incident status, and allows containment gaps to persist. CISM highlights this coordination failure as a recurring weakness during high-pressure incidents.
- ✓
Lack of executive support
Why this is correct
Without executive backing, incident response lacks the authority to enforce containment decisions, allocate budget for tooling, and compel cross-departmental co-operation during an active event. This directly satisfies the stem's challenge criterion: response teams cannot prioritise remediation over competing business initiatives, delaying containment and prolonging attacker dwell time.
- ✗
Too many technical staff
Why it's wrong here
Incident management typically suffers from too few skilled technical staff, not too many; overstaffing is not a recognised challenge. Excess headcount is tempting because large teams appear costly, yet the real difficulty is scarce expertise and resource contention during major incidents.
- ✗
Over-reliance on automation
Why it's wrong here
Automation reduces manual toil, so over-reliance is a governance and skills risk rather than a routine incident-handling challenge. It becomes the answer when the stem asks about tooling dependency or loss of analyst judgement, not the standard difficulties of detection, triage, escalation and coordination.
- ✗
Excessive documentation
Why it's wrong here
Excessive documentation is not a standard incident management challenge; teams usually struggle with too little or poorly maintained documentation. It is tempting because bureaucracy is a familiar complaint, but the recognised issues are unclear roles, poor communication and inadequate post-incident review.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.