CISM Information Security Incident Management 2

Question 1

Which of the following BEST describes 'forensic preservation' during incident response?

Accepted Answer

Collecting and preserving evidence in a manner that maintains its integrity for investigation

Answer

Immediately restoring affected systems to minimize downtime

Answer

Deleting all logs to protect sensitive information

Answer

Notifying law enforcement before any investigation begins

Question 2

A CISM is establishing notification procedures for data breach incidents. Under US regulations, breach notification timing is MOST influenced by:

Accepted Answer

State breach notification laws and applicable federal regulations

Answer

The organization's internal investigation timeline

Answer

The organization's public relations strategy

Answer

The type of security tools used to detect the breach

Question 3

Which of the following is the MOST important factor in determining incident severity?

Accepted Answer

The potential business impact of the incident

Answer

The type of attack technique used by the threat actor

Answer

The number of systems technically involved

Answer

The time of day the incident was detected

Question 4

During an active ransomware incident, the FIRST priority of the CISM should be to:

Accepted Answer

Activate the incident response plan and isolate affected systems

Answer

Pay the ransom to restore operations as quickly as possible

Answer

Issue a public statement to customers and stakeholders

Answer

Replace all encrypted systems with new hardware

Question 5

Which of the following BEST describes the role of a CISM during a major security incident?

Accepted Answer

Providing strategic oversight, coordination, and communication

Answer

Personally performing technical forensics on affected systems

Answer

Deciding whether to pay a ransom demand

Answer

Writing all incident reports and post-mortem documentation

Question 6

An organization experiences a security incident involving a third-party vendor's system. The CISM should FIRST:

Accepted Answer

Invoke the vendor's contractual incident notification and response obligations

Answer

Immediately terminate the vendor contract

Answer

File a complaint with the vendor's regulatory body

Answer

Deploy monitoring tools on all vendor-connected systems