Post-Incident Activity CISM Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is conducting a post-incident review for a phishing incident that led to credential compromise. The analyst has collected emails, logs, and interview notes. What is the next step in the review process?

   • AImmediately draft the final report and send it to management.
   • BConduct a root cause analysis before collecting all relevant data.
   • CDelete the collected data to protect user privacy.
   • DAnalyze the collected data to identify the sequence of events and contributing factors.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   After a post-incident review, the security team has identified several improvement actions. The security manager must decide how to implement them effectively. The team has limited resources and multiple ongoing projects. What is the most effective approach?

   • AAssign actions to the incident response team as additional duties.
   • BDefer all actions until the next budget cycle.
   • CImplement all actions simultaneously to address all issues at once.
   • DPrioritize actions based on risk reduction and assign owners with clear deadlines.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security manager is planning a post-incident review after a significant security incident. The primary goal of this review is to improve the organization's incident response capability. Which activity is most aligned with this goal?

   • ADetermining which employees were responsible for the incident and assigning disciplinary action.
   • BRestoring all affected systems to their pre-incident state.
   • CCalculating the total financial cost of the incident for insurance claims.
   • DIdentifying what went wrong and what went right during the response, and developing action items to address gaps.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which sequence correctly represents the steps of a post-incident review process?

   • AAnalysis, reporting, data collection
   • BReporting, data collection, analysis
   • CData collection, analysis, reporting
   • DData collection, reporting, analysis
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary audience for a post-incident review report?

   • AAll stakeholders who need to understand the incident and its implications
   • BExternal auditors only
   • CLaw enforcement agencies
   • DOnly the incident response team
   Reveal Solution Discussion Select an answer first