Post-Incident Activity CISM Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which component is typically included in a post-incident review report?

   • AThe organization's strategic business plan
   • BAction items and recommendations
   • CA detailed budget for the next fiscal year
   • DA list of all employees' performance reviews
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security manager must present the post-incident review findings to the board of directors. The board is primarily concerned with the financial and reputational impact of the incident. What should the manager emphasize in the presentation?

   • AThe business impact, such as costs, customer impact, and regulatory exposure.
   • BThe names of the employees involved in the incident.
   • CThe technical details of the attack vector and malware used.
   • DThe specific log entries that led to the detection of the incident.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security manager is preparing the post-incident review report for a data breach that affected customer records. The report will be presented to the board of directors and will also be used by the technical team to implement fixes. What is the most effective approach for structuring the report?

   • AFocus only on the technical root cause and remediation steps, as the board is not interested in operational details.
   • BDelay the report until all technical fixes are fully implemented so the report can claim complete resolution.
   • CProvide a single detailed technical narrative for all audiences to ensure completeness.
   • DInclude an executive summary with business impact and high-level recommendations, and a separate technical appendix with detailed findings.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   After a malware outbreak, the incident response team documented lessons learned, including the need for better endpoint detection and faster containment procedures. The security manager wants to ensure these lessons translate into tangible improvements. What is the most appropriate next step?

   • AConduct a security awareness training session for all employees on malware prevention.
   • BUpdate the incident response plan and playbooks to incorporate the new procedures and detection requirements.
   • CFile the lessons learned report in the security team's shared drive for future reference.
   • DPurchase additional malware protection licenses for all endpoints.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a post-incident review, the team discovers that a data breach occurred because a database administrator used a shared service account with a weak password. The team wants to prevent similar incidents. Which action is most directly aligned with root cause analysis?

   • AInvestigate why shared accounts and weak passwords were permitted in the organization.
   • BDisable the shared service account and create individual accounts for each administrator.
   • CRequire the database administrator to change their password immediately.
   • DImplement multi-factor authentication for all administrative accounts.
   Reveal Solution Discussion Select an answer first