(CISM) General Flashcards

Which element is MOST important when developing an information security incident response plan?

Answer: Defining roles, responsibilities, and escalation procedures

Clear roles, responsibilities, and escalation paths ensure coordinated, timely response when an incident occurs.

After containing a security incident, what is the MOST important next step before returning systems to production?

Answer: Conduct a root cause analysis and verify eradication of the threat

Root cause analysis identifies how the incident occurred and confirms the threat is fully removed, preventing recurrence after restoration.

Which type of test evaluates an organization's incident response capabilities WITHOUT disrupting normal operations?

Answer: Tabletop exercise

A tabletop exercise walks participants through a simulated scenario in a discussion format, testing plans and decision-making without operational impact.

During a ransomware incident, the incident response team is deciding whether to pay the ransom. Who should make this decision?

Answer: Executive management, in consultation with legal and security

Ransom payment decisions involve legal, financial, reputational, and strategic implications requiring executive authority and legal counsel.

The PRIMARY goal of the 'lessons learned' phase of incident response is to:

Answer: Identify improvements to prevent or better handle future incidents

Lessons learned translate incident experience into actionable improvements in controls, processes, and plans to reduce future risk.

An organization experiences a data breach involving personal information. Which regulatory requirement is MOST commonly triggered in the US?

Answer: State data breach notification laws requiring timely consumer notification

All 50 US states have breach notification laws requiring organizations to notify affected individuals and sometimes regulators within defined timeframes.

Which action BEST preserves digital evidence during an incident investigation?

Answer: Creating a forensic image of the system before any changes

A forensic image captures the exact state of storage at the time of the incident, preserving evidence integrity for analysis or legal proceedings.