hardMultiple SelectObjective-mapped
CISM Practice Question: Which TWO of the following are appropriate…
Which TWO of the following are appropriate actions to take during the detection phase of incident management?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Activate the incident response team
During detection, the team activates the incident response team and collects/analyzes logs to confirm the incident. Root cause analysis occurs later, evidence preservation is during containment, and rebuilding is recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Activate the incident response team
Why this is correct
Once an incident is suspected, the team should be mobilized.
- ✓
Collect and analyze logs
Why this is correct
Log analysis helps confirm and scope the incident.
- ✗
Rebuild systems from backups
Why it's wrong here
Rebuilding is a recovery action.
- ✗
Conduct root cause analysis
Why it's wrong here
Root cause analysis is performed after containment.
- ✗
Preserve evidence
Why it's wrong here
Evidence preservation is part of containment.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISM
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During the detection and analysis phase of incident response, which two activities are essential? (Choose two.)
easy- ✓ A.Identifying indicators of compromise.
- B.Restoring systems from backup.
- C.Notifying regulatory bodies.
- D.Applying security patches.
- ✓ E.Determining the scope of the incident.
Why A: Options A and E are correct because identifying indicators of compromise and determining the scope of the incident are key activities during the detection and analysis phase. Option C (notifying regulatory bodies) occurs later, typically after containment and eradication. Restoration (B) and patching (D) are part of the recovery phase.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.