What is the primary purpose of conducting a post-incident review?

To document the incident for legal proceedings

To restore systems to their normal operating state

To identify lessons learned and improve incident response processes

To assign blame to the individuals responsible for the incident

What is the purpose of developing an action plan based on post-incident review findings?

To enhance incident response capabilities

To document the incident for insurance claims

To assign blame to responsible parties

To satisfy regulatory reporting requirements

An organization experienced a service disruption caused by an unpatched vulnerability. During the post-incident review, the team is collecting data to understand the timeline and impact. Which data source is most critical for reconstructing the sequence of events?

System and application logs from the affected servers.

The personal recollections of the system administrator who first noticed the issue.

The organization's business continuity plan.

The vendor's patch release notes for the vulnerability.

A post-incident review is underway after a data breach. The team has collected logs, emails, and interview notes. However, some logs are missing due to inadequate log retention policies. The security manager must decide how to proceed. What is the most appropriate action?

Cancel the review because the missing logs prevent a complete analysis.

Rely solely on interview notes to reconstruct the timeline.

Delay the review until log retention policies are updated and new logs are collected.

Proceed with the review using available data and note the gaps as a finding in the report.

Certified Information Security Manager

Domain 4Objective 3

Post-Incident Activity CISM Practice Questions (Page 5)

Part of the Domain 4: Incident Management domain, which accounts for 30% of the CISM exam.

30questions here

6free pages

6concepts

30%of the exam

Questions 21–25

21foundation · easy
What is the primary purpose of conducting a post-incident review?
Select an answer first
22foundation · easy
What is the purpose of developing an action plan based on post-incident review findings?
Select an answer first
23application · medium
An organization experienced a service disruption caused by an unpatched vulnerability. During the post-incident review, the team is collecting data to understand the timeline and impact. Which data source is most critical for reconstructing the sequence of events?
Select an answer first
24expert · hard
A post-incident review is underway after a data breach. The team has collected logs, emails, and interview notes. However, some logs are missing due to inadequate log retention policies. The security manager must decide how to proceed. What is the most appropriate action?
Select an answer first
25foundation · easy
Which technique is commonly used to identify the underlying cause of an incident by repeatedly asking 'why'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.