Post-Incident Activity CISM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of documenting lessons learned from an incident?

   • ATo satisfy regulatory requirements for incident reporting
   • BTo provide evidence for potential legal action
   • CTo create a historical record for auditing purposes
   • DTo capture actionable improvements for future incident handling
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After a ransomware incident, the incident response team restored systems from backups and resumed operations. During the post-incident review, the team identifies that the initial infection occurred through a phishing email that bypassed the email gateway. The team is now discussing how to prevent recurrence. Which action best aligns with root cause analysis principles?

   • AConduct a '5 Whys' analysis to trace the chain of events from the phishing email to the ransomware deployment.
   • BDisable email attachments for all users until further notice.
   • CIncrease the frequency of backup testing to ensure faster recovery in future incidents.
   • DImplement additional email filtering rules to block similar phishing emails.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Following a post-incident review, the security team has identified several improvement actions, including updating the incident response playbook and deploying additional monitoring. The security manager needs to ensure these actions are actually completed. What is the most effective way to drive implementation?

   • APublish the actions in the company newsletter to raise awareness.
   • BAsk the incident response team to volunteer for the actions during their spare time.
   • CAssign each action to an owner with a target completion date and track progress in a project management tool.
   • DIncorporate the actions into the next annual security strategy review.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the main goal of root cause analysis in the context of incident management?

   • ATo identify the individual who caused the incident
   • BTo identify underlying causes and prevent recurrence
   • CTo determine the immediate symptoms of the incident
   • DTo document the incident for compliance purposes
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During which step of the post-incident review would the team examine logs, system timelines, and interview notes?

   • AReporting
   • BData collection
   • CImprovement implementation
   • DAnalysis
   Reveal Solution Discussion Select an answer first