CISM (CISM) General 4

Question 1

Which element is MOST important when developing an information security incident response plan?

Accepted Answer

Defining roles, responsibilities, and escalation procedures

Answer

Clear roles, responsibilities, and escalation paths ensure coordinated, timely response when an incident occurs.

Question 2

After containing a security incident, what is the MOST important next step before returning systems to production?

Accepted Answer

Conduct a root cause analysis and verify eradication of the threat

Answer

Root cause analysis identifies how the incident occurred and confirms the threat is fully removed, preventing recurrence after restoration.

Question 3

Which type of test evaluates an organization's incident response capabilities WITHOUT disrupting normal operations?

Accepted Answer

Tabletop exercise

Answer

A tabletop exercise walks participants through a simulated scenario in a discussion format, testing plans and decision-making without operational impact.

Question 4

During a ransomware incident, the incident response team is deciding whether to pay the ransom. Who should make this decision?

Accepted Answer

Executive management, in consultation with legal and security

Answer

Ransom payment decisions involve legal, financial, reputational, and strategic implications requiring executive authority and legal counsel.

Question 5

The PRIMARY goal of the 'lessons learned' phase of incident response is to:

Accepted Answer

Identify improvements to prevent or better handle future incidents

Answer

Lessons learned translate incident experience into actionable improvements in controls, processes, and plans to reduce future risk.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM (CISM) General 4