Incident Management — CISM Practice Questions

A regional bank’s primary data center suffers extensive flood damage, rendering it inoperable. The information security manager must decide how to resume critical transaction processing. Which action aligns best with the organization’s Disaster Recovery Plan (DRP) as defined by NIST SP 800‑34r1?

• A.Activate the DRP to relocate processing to the pre‑established hot site and begin system recovery there
• B.Wait for senior management to approve a new off‑site location before any recovery steps are taken
• C.Transfer the affected workloads to a cloud‑based backup service while the hot site is being prepared
• D.Restore the primary data center’s hardware on‑site before moving any services elsewhere

Why: Use the DRP to move operations to a hot site when the primary site is damaged NIST SP 800‑34r1 defines a DRP as a written plan for recovering systems at an alternate facility and describes a hot site as a fully operational off‑site facility to be used after a disruption; activating the DRP to use the hot site directly follows this guidance.

Suspicious activity is detected on a server that stores regulated customer data, but the facts are incomplete. What should the incident manager do FIRST?

• A.Activate incident assessment and escalation while preserving evidence
• B.Notify senior management and initiate a public announcement after confirming breach
• C.Rebuild the compromised server immediately before collecting any forensic data
• D.Wait for the scheduled management meeting to discuss incident and decide next steps

Why: The first step in incident handling is to assess and classify the event while safeguarding all potential evidence. This enables appropriate escalation, containment, and later forensic analysis. Premature public disclosure, system rebuilding, or waiting for meetings can compromise evidence integrity and delay response. It promptly establishes the incident’s severity, coordinates response actions, and ensures evidence is protected for later analysis.

A cyber incident disables the primary customer contact centre, but an alternate site is available. What should the continuity team prioritize?

• A.Perform detailed forensic analysis prior to any service restoration
• B.Resume critical customer processes via approved alternate arrangements
• C.Reinstate non‑critical applications ahead of the contact centre restoration
• D.Delay response until the attacker initiates communication with the organization

Why: Business continuity planning requires that the most important processes be restored first, using pre‑approved alternate locations. Technical investigations, lower‑priority restorations, and passive responses can be performed after critical services are back online. Maintaining essential business functions is the primary goal of continuity, so critical customer processes must be resumed using the pre‑approved alternate site.

A data centre outage makes the primary infrastructure unavailable; which plan primarily guides the restoration of IT systems at an alternate site?

• A.Business continuity plan
• B.Crisis communications plan
• C.Disaster recovery plan
• D.Incident response plan

Why: Disaster recovery planning is a core component of the organization’s overall business continuity strategy and specifies how IT services are rebuilt, including the use of alternate sites, recovery time objectives, and recovery point objectives. While BCP ensures that critical business processes continue, DRP provides the detailed technical steps to bring IT infrastructure back online. The disaster recovery plan defines the procedures, resources, and alternate locations needed to recover technology systems after a disruption.

Repeated failed login attempts are detected, but there is no evidence of compromise or business impact. What is the BEST initial approach?

• A.Escalate to senior management immediately without further analysis
• B.Close the alert after the initial log review shows no compromise
• C.Notify all affected users before confirming any impact
• D.Triage using defined criteria and adjust severity as evidence develops

Why: Incident management begins with triage, which uses predefined criteria to assign severity and determine the appropriate response. This ensures proportional effort, avoids premature escalation or dismissal, and provides a basis for later containment, eradication, and recovery steps. Because triage applies the incident classification framework, allowing the response to be scaled as more information becomes available.

A tabletop exercise reveals that legal staff do not know when to engage in a privacy incident. What should happen next?

• A.Update roles and escalation procedures and validate the changes
• B.Document the exercise findings and schedule a follow‑up meeting
• C.Add legal to the incident response team without revising procedures
• D.Wait for a real privacy breach before making any changes

Why: After a tabletop exercise, corrective actions are required to address identified weaknesses. Updating the incident response plan’s roles and escalation paths and then validating those changes through testing ensures the organization is ready for actual privacy incidents. This aligns with incident management readiness best practices. The exercise exposed a gap in legal’s escalation knowledge, so the roles and escalation steps must be updated and then tested to ensure the fix works.

A suspected insider incident may lead to legal action. What is MOST important when collecting evidence?

• A.Preserve evidence integrity, enforce access controls, and maintain chain of custody
• B.Document findings, notify management, and schedule a debrief meeting
• C.Isolate the system, block user access, and begin remediation steps
• D.Interview the suspect, obtain a written statement, and archive the interview

Why: Evidence must be handled in a way that prevents alteration, loss, or contamination. Enforcing strict access controls and a documented chain of custody provides traceability and credibility, which are essential for any subsequent legal action. While other response activities are necessary, they are secondary to safeguarding the evidence itself. Preserving integrity, controlling access, and keeping a documented chain of custody ensure the evidence remains reliable and admissible in legal proceedings.

An endpoint has been identified as infected and is actively communicating with a command-and-control server. What is the MOST appropriate immediate action?

• A.Terminate all network connections immediately without following the isolation procedure.
• B.Escalate the incident to senior management before taking any technical steps.
• C.Isolate the endpoint according to the approved process while preserving evidence.
• D.Document the finding and schedule a full forensic analysis after business hours.

Why: Effective incident response begins with rapid containment to prevent spread, and it must be performed in accordance with the incident response plan to maintain evidence integrity. Isolation of the affected system achieves both goals, enabling subsequent eradication and recovery steps while supporting forensic analysis and potential legal actions. Isolating the endpoint stops further C2 communication while preserving evidence needed for investigation and legal purposes.

An incident may affect a regulated service, but reportability is not yet confirmed; what should the incident manager do?

• A.Wait for the technical investigation to finish before involving any other parties.
• B.Allow the technical team to determine the notification approach without managerial oversight.
• C.Engage legal and compliance early to assess reporting obligations and deadlines.
• D.Publish incident details publicly before confirming regulatory reporting requirements.

Why: When an incident could impact a regulated service, the incident manager must involve legal and compliance promptly to determine if reporting is required and to establish timelines. This prevents missed deadlines, ensures proper communication with regulators, and protects the organization from legal exposure. Relying solely on technical teams or premature public disclosure bypasses essential governance controls. Early legal and compliance involvement ensures the organization meets regulatory reporting obligations and deadlines.

After containing a ransomware incident, the response team proposes restoring the affected systems from backup. What must be verified first before proceeding with the restoration?

• A.Verify that the backup is recent, but do not assess threat removal or system safety before restoration.
• B.Confirm that the threat has been eradicated, the backup is intact, and the environment is safe for restoration.
• C.Ensure that all attacker communications have ceased, while assuming the backup is clean and the environment is ready.
• D.Confirm that forensic analysis is finished for every affected system before proceeding with any restoration activities.

Why: Restoration should only occur after the incident is contained and the root cause is eliminated. Verifying threat eradication, backup integrity, and a secure restoration environment prevents re‑infection and ensures business continuity. Because restoring before confirming eradication, backup integrity, and a safe environment could reintroduce the ransomware.

A major incident has been closed after service restoration; what should the post‑incident review focus on?

• A.Root cause, response effectiveness, lessons learned, corrective actions, and risk reassessment
• B.Identifying the individual responsible, documenting the incident, and filing a report
• C.Generating a technical summary, archiving logs, and assigning a compliance reviewer
• D.Updating the incident ticket, notifying stakeholders, and scheduling a follow‑up meeting

Why: Post‑incident reviews are a core part of incident management operations. They drive continuous improvement by analyzing the root cause, measuring response effectiveness, extracting lessons learned, planning corrective actions, and updating risk assessments. Without this comprehensive analysis, organizations repeat mistakes and fail to enhance their security posture. It ensures the organization understands why the incident occurred, evaluates how well the response performed, captures improvement lessons, defines corrective actions, and reassesses residual risk.

A critical process depends on one specialist and one external data feed. What should continuity planning address?

• A.Specialist role, data feed, and servers
• B.People, supplier/data dependencies, and technology
• C.Financial costs, equipment inventory, and licensing
• D.Regulatory compliance, policy documents, and audit reports

Why: A business impact analysis identifies the people, external suppliers, and technology that a critical process relies on. Continuity planning must incorporate these dependencies to ensure the process can be restored after a disruption. It covers all essential resources—personnel, third‑party data sources, and the supporting technology needed to resume the process.