Post-Incident Activity CISM Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A post-incident review has been completed, and the security manager must communicate the findings to various stakeholders, including the executive team, the IT department, and external regulators. What is the most important consideration when preparing the report?

   • ADelay the report until all recommended actions are implemented to present a complete picture.
   • BInclude every technical detail in the main body of the report to ensure transparency.
   • CFocus only on the positive aspects of the response to maintain stakeholder confidence.
   • DTailor the level of detail and technical language to each audience's needs.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which element is essential for lessons learned documentation to be actionable?

   • AA detailed timeline of the incident
   • BSpecific recommendations for improvement
   • CThe cost of the incident
   • DA list of all personnel involved in the incident
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   After a post-incident review, the security team has developed a list of improvement actions, including patching critical vulnerabilities, updating the incident response plan, and conducting additional staff training. The security manager has limited budget and must prioritize the actions. Which action should be prioritized first?

   • AConduct additional staff training on incident reporting.
   • BPatch critical vulnerabilities that were exploited during the incident.
   • CPurchase additional security monitoring tools.
   • DUpdate the incident response plan to include lessons learned.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   After a post-incident review, the security team identified that the incident response plan lacked clear escalation procedures, which delayed containment. The team has drafted an updated plan. What is the most effective way to ensure the updated plan is effective?

   • AFile the updated plan in the security team's documentation repository.
   • BWait for the next real incident to see if the plan works.
   • CConduct a tabletop exercise to test the updated escalation procedures.
   • DDistribute the updated plan to all team members via email.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a post-incident review, the team identifies that a lack of network segmentation allowed malware to spread rapidly. The team documents this as a lesson learned. What is the most important characteristic of this lesson learned documentation?

   • AIt is stored in a secure location accessible only to the security team.
   • BIt includes a specific, actionable recommendation to implement network segmentation.
   • CIt names the individuals who failed to implement segmentation.
   • DIt describes the malware's technical characteristics in detail.
   Reveal Solution Discussion Select an answer first