Incident Management

CISM · 87 questions

• The information security manager finds that the incident response plan was written by the security team without reference to the business continuity and disaster recovery plans. What is the PRIMARY risk of this situation?
• While reviewing a draft incident response plan, the information security manager notes it contains detailed technical procedures for analyzing malware but does not say who decides to escalate or who communicates with stakeholders. What is the BEST recommendation?
• An organization is forming its incident response team. The draft roster includes only network, systems and security engineers. Which change would MOST improve the team's ability to manage a significant data breach?
• A newly hired information security manager finds a well-written incident response plan that has never been approved by senior management. Responders report that business units ignore their containment requests. What should the manager do FIRST?
• Most of the organization's critical applications moved to cloud services over the past year, but the incident response plan still describes only on-premises systems and contacts. What should the information security manager do?
• Post-incident reviews of three ransomware events show responders took different containment steps each time, and in one case a server was restored before the attack vector was understood. What would BEST improve consistency?
• Security analysts frequently disagree about whether an alert should be treated as an incident, so similar alerts are handled in different ways. What is the BEST way for the information security manager to resolve this?
• The organization relies on an external firm for digital forensics during major incidents, but no agreement is in place and the firm's contacts appear nowhere in the incident response plan. What should the information security manager do?
• A new member of the steering committee asks why the organization should conduct a business impact analysis when it already has a risk assessment. Which answer BEST explains the purpose of a BIA?
• The information security manager is coordinating a business impact analysis. Who should provide the primary input on the impact of a disruption to each business process?
• A BIA for the order-processing service finds that the business can survive an outage of no more than 24 hours, systems must be back within 8 hours to leave time to clear backlogs, and no more than 1 hour of transactions can be lost. Which mapping is correct?
• IT has already purchased a recovery site contract and selected backup technologies, but no business impact analysis has been performed. What is the PRIMARY concern for the information security manager?
• A business impact analysis shows that a critical claims-processing function depends on a single external data provider, and no alternative source has been arranged. What should the information security manager do?
• A draft BIA rates the impact of each process disruption purely in lost revenue. As a result, a customer safety notification process shows low revenue impact and is ranked non-critical. What should the information security manager recommend?
• The organization's business impact analysis was completed five years ago. Since then it has launched online sales, closed two plants and outsourced payroll. What should the information security manager do?
• During a business impact analysis, every department head rates their own processes as most critical, making the results useless for prioritizing recovery. What is the BEST way to resolve this?
• Ransomware has encrypted the systems supporting order fulfillment, and the outage is expected to last several days. Staff are unsure whether the incident response plan or the business continuity plan applies. Which statement is correct?
• The information security manager is helping select a continuity strategy for a payment-clearing process. Several options with very different costs are available. What should PRIMARILY drive the selection?
• A flood will make the head office inaccessible for several weeks, although IT systems hosted in a remote data center are unaffected. Which element of the business continuity plan is MOST relevant?
• During a governance review, the information security manager notes that the IT director is named owner of the business continuity plan and business managers have not participated in developing it. What is the BEST recommendation?
• A major incident begins at 2 a.m. on a holiday weekend. The on-call engineer cannot reach anyone with authority to activate the business continuity plan. Which weakness does this reveal?
• A major reorganization has merged several departments, changed reporting lines and replaced many of the managers named in the business continuity plan. What should the information security manager ensure happens?
• A BIA shows that a hospital's medication dispensing process tolerates only a short outage. If its system fails there is no documented way to continue, and a redundant system has been rejected as too costly. What should the information security manager recommend?
• A BIA sets a recovery time objective of 72 hours for an internal reporting system and 2 hours for the customer transaction system. Which recovery site arrangement BEST balances cost and recovery needs?
• A business impact analysis sets a recovery point objective of one hour for the order database, but the database is backed up only once each night. What should the information security manager recommend?
• Threat intelligence shows ransomware groups now routinely locate and encrypt or delete backups before encrypting production systems. Which measure BEST protects the organization's ability to recover?
• The organization is moving its customer portal to an infrastructure-as-a-service platform. When updating the disaster recovery plan, what should the information security manager ensure FIRST?
• After the loss of the primary data center, the recovery team is planning the order in which systems will be restored at the recovery site. Which systems should generally be restored FIRST?
• During the annual disaster recovery test, the team finds that backups of a critical database cannot be restored because the encryption keys were never stored at the recovery site. What should the information security manager do?
• A major outage has lasted four hours. Engineers disagree about whether to fail over to the disaster recovery site, and nobody knows who can make the decision. What should have been defined in advance to prevent this?
• The information security manager is defining severity levels for the incident classification scheme. What should PRIMARILY determine an incident's severity?
• An incident was logged as low severity when a laptop was reported stolen. Two days later, investigators learn the laptop held unencrypted customer records. What should happen to the incident's classification?
• An incident team's reports are unreliable because analysts use a single field to record both the kind of incident, such as phishing or malware, and how serious it is. What should the information security manager do?
• A post-incident review finds that a high-severity incident was correctly classified but waited almost a day before senior management was informed, because analysts escalated incidents in the order received. What should be improved?
• An investigation confirms that an attacker accessed a database containing customers' personal data, and the access has now been contained. Which action is MOST important to take promptly?
• Incident reports from the organization's three regions show that similar incidents are rated differently, so senior management cannot compare risk across regions. What should the information security manager do?
• An analyst investigates an alert about unusual data transfers and determines it was an authorized backup job, not an incident. What should the analyst do next?
• A hospital wants proof that its responders can actually perform the technical recovery steps for its patient records system, but the business owner has ruled out any interruption to clinical operations. Which type of test BEST meets both requirements?
• A security manager proposes that a checklist review be this year's only test of the incident response plan. Senior management asks what assurance that review will actually provide. Which answer is MOST accurate?
• An incident response exercise is scheduled for next month. The scenario and participants have been chosen, but no one has documented what the exercise is meant to demonstrate. What should the security manager do FIRST?
• After-action reports from the last two tabletop exercises identified the same escalation gaps, yet the incident response plan has not changed since. What is the BEST action for the security manager?
• An organization moved its core ERP system to a cloud provider and restructured its IT team last year. Its incident response and recovery plans were last tested two years ago. What should concern the security manager MOST?
• The organization bought a new forensic analysis tool six months ago, and management expects the internal incident response team to operate it without vendor help. No responder has used it yet. What should the security manager do to BEST improve readiness?
• Post-incident reviews show that executives were slow to approve containment trade-offs and public statements during recent incidents. They have never taken part in an exercise. Which activity would BEST address this?
• Firewall, endpoint and identity systems each generate alerts reviewed by separate teams. A recent intrusion was missed because related events across those systems were never linked. Which capability would BEST address this?
• During a recent investigation, analysts could not determine which processes ran on the compromised laptops or how the malware moved from one laptop to another. Which capability would MOST improve future investigations?
• Analysts investigating an incident cannot reconstruct the sequence of events because timestamps on servers, firewalls and authentication systems differ by several minutes. Which control would MOST have prevented this problem?
• Security analysts perform the same manual triage steps for every user-reported phishing email: extracting indicators, checking reputation sources and searching mailboxes for copies. Report volumes are rising. What is the MOST efficient way to handle this workload?
• Monitoring dashboards generate thousands of alerts each day, most of which turn out to be false positives, and analysts have begun dismissing alerts without review. What should the security manager do to BEST address this?
• An attacker remained in the network for months using legitimate administrative tools, and no monitoring alert ever fired. What should the security manager implement to MOST improve detection of this type of activity?
• During the last incident, responders spent hours locating write blockers, clean media and approved forensic software before they could begin collecting evidence. What would BEST prevent this delay?
• Evidence gathered during a fraud-related incident may later be presented in court. What is MOST important for the security manager to ensure during evidence handling?
• A compromised production server is still running, and investigators need to preserve as much useful evidence as possible. Which approach should they follow?
• Following a data breach, legal counsel advises that litigation by affected customers is likely. Routine retention schedules will soon delete logs and emails related to the incident. What should the security manager do?
• Responders have confirmed that customer payment data was stolen in an intrusion. The incident response team lead asks whether the organization should report the crime to law enforcement. Who should make that decision?
• Suspicious activity was found on one database server, and early log review suggests the attacker may have reached other systems. The business wants that server restored immediately. What should the security manager ensure FIRST so that containment is effective?
• A regulator has indicated that it may review the organization's handling of a significant data breach. What should the security manager ensure about the incident investigation records?
• Data loss prevention alerts suggest that an employee may be copying confidential product designs to a personal cloud account. What should the security manager do FIRST?
• Endpoint alerts show that malware is active on several workstations in the finance department. The incident response plan requires evidence to be preserved for investigation. What is the BEST immediate containment action?
• Investigators confirm that a domain administrator account is being used by an attacker right now to access servers. What is the BEST containment action for this account?
• Ransomware has encrypted file servers in one network segment, and alerts show it is beginning to spread to systems in adjacent segments. What should the incident response team do FIRST?
• Containing an active intrusion would require taking the e-commerce platform offline during peak trading. The incident response plan does not pre-authorize the security team to shut down revenue systems. What should the security manager do?
• A compromised public web server has been isolated and the attacker's addresses blocked. The business needs the service back within days, but a clean rebuild and full investigation will take weeks. What is the appropriate longer-term containment step?
• A virtual machine hosted with an infrastructure cloud provider shows signs of compromise, and the incident response plan requires evidence to be preserved. What should responders do FIRST?
• Monitoring shows large volumes of data leaving a file server for an unfamiliar external host, and the transfer is still in progress. What should the incident response team do FIRST?
• Investigators discover that a skilled attacker has had quiet, persistent access to multiple systems for months. There is no sign of ongoing data theft or damage. What is the BEST approach to containment?
• An investigation confirms that personal data of customers in several countries was accessed without authorization. The organization is unsure which notification obligations apply. What should the security manager do?
• During a publicized incident, several employees have given conflicting statements to journalists, and the press is reporting contradictory details. What should the security manager recommend?
• Responders suspect the attacker has access to the corporate email system that the incident response team normally uses to coordinate. How should the team communicate during the response?
• Analysts are unsure whether a developing incident is serious enough to inform senior management. Some want to wait until the root cause is known. When should senior management be informed?
• Legal counsel has confirmed that customers must be notified about a breach of their personal data. The security manager is reviewing the draft notification. What content is MOST important to include?
• During a ransomware incident, rumours are spreading among staff that payroll data was stolen and that the company will close, and some employees are posting speculation online. What should the security manager recommend FIRST?
• A business partner's systems connect directly to the environment that has been compromised, and responders believe the partner may also be at risk. What should the security manager do?
• After an intrusion, the operations team wants to restore a key application to service immediately, although the attacker's persistence mechanisms and entry point have not yet been removed. What should the security manager advise?
• A server compromised by an attacker with administrative rights has been contained. Analysts removed the malware they found, but cannot be certain they found every change the attacker made. What is the BEST approach to recovery?
• After a ransomware attack, the team is preparing to restore systems from backups. Investigators believe the attacker was present for several weeks before the encryption began. What should the security manager ensure BEFORE restoration?
• Systems affected by a serious intrusion have been rebuilt and returned to production. What should the security manager ensure happens NEXT?
• A widespread attack has disrupted dozens of systems, and the recovery team cannot restore them all at once. How should the security manager guide the order of restoration?
• After an incident, the IT team declares that the order management system has been recovered and wants to close the recovery phase. What should happen before the system returns to normal operation?
• Investigators confirm that an attacker obtained administrative access to the organization's central directory service, which authenticates all users and services. What is the BEST approach to credential remediation?
• Systems have been restored after an intrusion, and a team member asks why a root cause analysis is still needed, since everything is working again. What is the PRIMARY reason?
• A major incident has just been closed. The incident manager suggests holding the lessons-learned meeting at the next quarterly security review, in about three months, with only the security team present. What should the security manager recommend?
• During a post-incident review, participants begin blaming the engineer who misconfigured the firewall rule that the attacker exploited. What should the security manager do?
• While preparing a post-incident review, the security manager finds that most corrective actions agreed after the previous two incidents were never completed. What is the BEST way to address this?
• A post-incident review finds that the attacker exploited a weakness that the risk register rated as low likelihood and low impact. What should the security manager do as a result?
• Post-incident reviews for three separate incidents identified the same gaps in escalation and evidence handling, and each time responders followed the incident response plan as written. What should the security manager do?
• Senior management wants to know whether the organization's ability to handle incidents is improving over time. Which metrics would BEST support this?