easyMultiple Select
CISM Incident Management Practice Question
Which TWO of the following are PRIMARY goals of incident management according to industry best practices?
⚠ Common exam trap
Candidates often confuse 'documentation' or 'compliance' as primary goals, but ISACA CISM emphasizes that operational restoration and business disruption minimization are the top priorities, with documentation being a supporting process that must not delay recovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restore normal operations as quickly as possible
Option A is correct because a primary goal of incident management, as defined in frameworks such as ITIL and NIST SP 800-61, is to restore normal service operation as quickly as possible while maintaining service quality. Option B is correct because minimizing the adverse impact on business operations and users is the other core objective, ensuring that disruptions to critical business functions are reduced. Documentation (C) is a supporting activity that aids auditing and post-incident review, but it is not a primary goal. Assigning blame (D) is counterproductive and contradicts the blameless post-mortem culture recommended by best practices. Increasing the security budget (E) is a possible organizational outcome but is not a goal of the incident management process itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restore normal operations as quickly as possible
Why this is correct
Rapid restoration of normal operations is a primary incident management goal because it directly limits the duration of adverse impact. This satisfies the stem's requirement for best-practise goals by focusing on returning the organisation to its pre-incident service level, rather than root-cause analysis or long-term remediation.
- ✓
Minimize business disruption
Why this is correct
Minimising business disruption is a primary incident management goal because it protects the organisation's ability to deliver critical services during and after an incident. This satisfies the stem's best-practise requirement by prioritising continuity of operations over purely technical containment or forensic investigation.
- ✗
Document all steps for compliance
Why it's wrong here
Documenting every step for compliance is a by-product of incident handling, not a primary goal; the primary goals are restoring service and limiting business impact. It tempts because evidence retention matters for audits and regulatory reporting, and would be correct if the question asked about forensic record-keeping.
- ✗
Assign blame to the responsible party
Why it's wrong here
Incident management restores normal service and limits impact; assigning blame is not a goal and actively discourages the candid reporting that response depends on. It tempts because post-incident reviews identify contributing causes, but that is root-cause analysis, not attribution of fault to a person.
- ✗
Increase the security budget
Why it's wrong here
Increasing the security budget is a business outcome that incident management may inform, not one of its primary goals. It tempts because major incidents often drive funding requests, and would be correct if the question asked about outputs of a post-incident review presented to management.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.