CISM Information Security Incident Management

Question 1

What is the FIRST step in the incident response lifecycle according to best practices?

Accepted Answer

Preparation

Answer

Preparation is the first phase of incident response, involving developing plans, training teams, and establishing capabilities before incidents occur.

Question 2

During a security incident, who is PRIMARILY responsible for declaring an incident a 'major incident'?

Accepted Answer

A designated incident manager or crisis management team

Answer

A designated incident manager or crisis management team, with appropriate authority, is responsible for formally declaring and escalating major incidents.

Question 3

Which of the following is the PRIMARY purpose of containment in incident response?

Accepted Answer

To limit the scope and impact of an ongoing incident

Answer

Containment limits the spread and impact of an active incident while preserving evidence and buying time for eradication and recovery.

Question 4

A CISM is reviewing an incident response plan (IRP). Which element is MOST critical to include?

Accepted Answer

Defined escalation procedures and communication chains

Answer

Clearly defined escalation procedures and communication chains ensure that the right people are notified and empowered to act during an incident.

Question 5

After an incident is resolved, which activity is MOST important to improve future response?

Accepted Answer

Conducting a post-incident review (lessons learned)

Answer

A post-incident review (lessons learned) identifies what worked, what failed, and improvements to prevent recurrence and enhance future response capability.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM Information Security Incident Management