Post-Incident Activity CISM Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which outcome is the most direct result of a well-executed post-incident review?

   • AImmediate notification of regulatory authorities
   • BAutomatic deletion of malicious files from affected systems
   • CEnhanced incident response procedures based on identified improvements
   • DImmediate containment of the active threat
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A post-incident review is being conducted after a service outage caused by a misconfigured firewall rule. The team has identified that the misconfiguration occurred during a routine change by a junior administrator. The security manager must decide the most effective improvement to prevent recurrence. Which action is most aligned with root cause analysis?

   • AImplement a peer review process for all firewall configuration changes.
   • BRoll back the firewall rule and restore service.
   • CRetrain the junior administrator on firewall configuration best practices.
   • DAdd additional monitoring to detect misconfigurations sooner.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security manager is leading a post-incident review after a ransomware attack. The team has identified that the attack originated from a phishing email, but further analysis shows that the email bypassed the gateway because the gateway's spam rules were misconfigured during a recent update. The manager must decide the most effective improvement to prevent recurrence. Which approach is most aligned with root cause analysis?

   • AInvestigate why the misconfiguration occurred and implement a change management process for gateway updates.
   • BIncrease user awareness training on phishing emails.
   • CDeploy an additional email security solution as a backup to the gateway.
   • DUpdate the spam rules and add a rule to block the specific phishing email's sender domain.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security manager is planning a post-incident review after a significant security incident. The manager is concerned that the review may become a blame session, which could hinder learning. What is the most effective way to prevent this?

   • AEstablish ground rules that focus on process improvement, not individual blame.
   • BExclude the individuals involved in the incident from the review.
   • CFocus only on the positive aspects of the response.
   • DLimit the review to technical staff only.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which element is crucial for the successful implementation of an improvement action plan?

   • ALimiting the plan to technical fixes only
   • BImplementing all actions immediately without review
   • CKeeping the plan confidential from all staff
   • DAssigning responsibility and deadlines for each action item
   Reveal Solution Discussion Select an answer first