Information Security Incident Management Flashcards
6 cards from real CISM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Information Security Incident Management flashcards as text
What is the PRIMARY purpose of tabletop exercises in incident management?
Answer: To validate the incident response plan and team readiness through discussion-based scenarios
Tabletop exercises use discussion-based scenarios to test the incident response plan's effectiveness and identify gaps in team readiness without disrupting operations.
Which of the following is MOST important when communicating about a security incident to external stakeholders?
Answer: Ensuring communications are timely, accurate, and legally reviewed
External incident communications must be timely, factually accurate, and reviewed by legal counsel to manage liability and maintain stakeholder trust.
A CISM discovers that an incident was caused by an unpatched vulnerability that had been known for 90 days. The ROOT CAUSE was most likely:
Answer: A failure in the vulnerability management program
A known vulnerability remaining unpatched for 90 days indicates a failure in the vulnerability management program's identification, prioritization, or remediation processes.
Which of the following BEST describes the relationship between incident response and disaster recovery?
Answer: Incident response focuses on containment and investigation; disaster recovery focuses on restoring business operations
Incident response focuses on containing, investigating, and eradicating threats, while disaster recovery focuses on restoring critical business operations and systems.
What is the MAIN benefit of having a documented chain of custody during incident investigation?
Answer: It ensures evidence integrity and admissibility in legal or regulatory proceedings
A chain of custody documents who handled evidence, when, and how, ensuring its integrity is maintained for use in legal or regulatory proceedings.
A CISM wants to improve detection of security incidents. The MOST effective improvement is to:
Answer: Implement continuous monitoring with defined detection use cases aligned to risks
Continuous monitoring with detection use cases aligned to the organization's specific risk profile maximizes the relevance and effectiveness of detection capabilities.
How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- isaca.org — Renewal, test delivery, eligibility, score validity, fees, exam format, passing score, retake fee, score release, test dates · verified Oct 2026