CISM Information Security Incident Management 3

Question 1

What is the PRIMARY purpose of tabletop exercises in incident management?

Accepted Answer

To validate the incident response plan and team readiness through discussion-based scenarios

Answer

Tabletop exercises use discussion-based scenarios to test the incident response plan's effectiveness and identify gaps in team readiness without disrupting operations.

Question 2

Which of the following is MOST important when communicating about a security incident to external stakeholders?

Accepted Answer

Ensuring communications are timely, accurate, and legally reviewed

Answer

External incident communications must be timely, factually accurate, and reviewed by legal counsel to manage liability and maintain stakeholder trust.

Question 3

A CISM discovers that an incident was caused by an unpatched vulnerability that had been known for 90 days. The ROOT CAUSE was most likely:

Accepted Answer

A failure in the vulnerability management program

Answer

A known vulnerability remaining unpatched for 90 days indicates a failure in the vulnerability management program's identification, prioritization, or remediation processes.

Question 4

Which of the following BEST describes the relationship between incident response and disaster recovery?

Accepted Answer

Incident response focuses on containment and investigation; disaster recovery focuses on restoring business operations

Answer

Incident response focuses on containing, investigating, and eradicating threats, while disaster recovery focuses on restoring critical business operations and systems.

Question 5

What is the MAIN benefit of having a documented chain of custody during incident investigation?

Accepted Answer

It ensures evidence integrity and admissibility in legal or regulatory proceedings

Answer

A chain of custody documents who handled evidence, when, and how, ensuring its integrity is maintained for use in legal or regulatory proceedings.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM Information Security Incident Management 3