CISM Incident Management Practice Question
Which TWO of the following are key responsibilities of the crisis management team (CMT) during a major cybersecurity incident?
⚠ Common exam trap
Test-takers frequently confuse the strategic responsibilities of the CMT with the tactical or operational tasks of the technical incident response team, leading candidates to select hands-on actions like log analysis or backup restoration instead of high-level decision-making roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Approving external communications and public statements
The crisis management team (CMT) is responsible for high-level strategic decisions, including approving external communications and public statements to manage reputation and legal exposure during a major cybersecurity incident. This aligns with the CMT's role in coordinating response efforts and ensuring consistent messaging, as defined in incident management frameworks like NIST SP 800-61.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restoring backups of affected servers
Why it's wrong here
This is a technical recovery task.
- ✓
Approving external communications and public statements
Why this is correct
The CMT oversees communication strategy.
- ✗
Analyzing log files to identify the attack vector
Why it's wrong here
This is a technical investigation task.
- ✗
Conducting technical forensic analysis of compromised systems
Why it's wrong here
This is the role of forensic investigators, not the CMT.
- ✓
Making strategic decisions about business continuity activation
Why this is correct
The CMT decides whether to activate BC/DR plans.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.