CISM Information Security Incident Management 2

Question 1

Which of the following BEST describes 'forensic preservation' during incident response?

Accepted Answer

Collecting and preserving evidence in a manner that maintains its integrity for investigation

Answer

Forensic preservation involves collecting evidence using documented, integrity-preserving methods to support investigation and potential legal proceedings.

Question 2

A CISM is establishing notification procedures for data breach incidents. Under US regulations, breach notification timing is MOST influenced by:

Accepted Answer

State breach notification laws and applicable federal regulations

Answer

US data breach notification requirements are governed by state laws and federal sector-specific regulations, which define mandatory notification timelines.

Question 3

Which of the following is the MOST important factor in determining incident severity?

Accepted Answer

The potential business impact of the incident

Answer

Incident severity should be determined by potential business impact — the degree of harm to operations, data, reputation, and stakeholders.

Question 4

During an active ransomware incident, the FIRST priority of the CISM should be to:

Accepted Answer

Activate the incident response plan and isolate affected systems

Answer

Activating the incident response plan and isolating affected systems are the immediate priorities to contain the ransomware and prevent further spread.

Question 5

Which of the following BEST describes the role of a CISM during a major security incident?

Accepted Answer

Providing strategic oversight, coordination, and communication

Answer

During a major incident, the CISM's role is strategic — providing oversight, coordinating the response team, and managing communication with leadership.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM Information Security Incident Management 2