Preparation CISM Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A global company has its headquarters in Europe and a major data center in Asia. The BIA indicates that the customer relationship management (CRM) system has an RTO of 4 hours and an RPO of 1 hour. The company is considering two recovery strategies: Strategy A uses a hot standby site in Europe with an RTO of 2 hours and an RPO of 15 minutes, but it is expensive. Strategy B uses backups replicated to a cloud provider with an RTO of 6 hours and an RPO of 2 hours, but it is cheaper. Which strategy should the company choose?

   • AA hybrid approach using Strategy A for the first 4 hours and Strategy B for long-term recovery.
   • BStrategy A, because it meets both the RTO and RPO requirements.
   • CNeither strategy; the company should accept the risk.
   • DStrategy B, because it is cheaper and still provides some recovery capability.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company is developing a training program for its incident response team. The team includes members from IT, legal, HR, and public relations. The training is intended to ensure that each member understands their specific role and the communication protocols during an incident. Which training approach would best achieve this objective?

   • AConduct role-specific training sessions followed by a joint tabletop exercise.
   • BConduct a full-scale simulation without any prior training.
   • CDistribute the IRP document and ask team members to read it on their own.
   • DProvide a single general training session covering the entire IRP to all team members.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After a full-scale incident response exercise, the evaluation report identifies that the communication plan failed because the on-call contact list was outdated. Which of the following is the most effective corrective action?

   • AUpdate the contact list and implement a quarterly review process.
   • BConduct another full-scale exercise immediately.
   • CReplace the communication plan with a new one.
   • DAssign a single person to maintain the contact list.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the PRIMARY function of a Security Information and Event Management (SIEM) system in incident management?

   • ATo automatically patch vulnerabilities in software
   • BTo perform forensic analysis of hard drives
   • CTo provide a ticketing system for tracking incidents
   • DTo collect and analyze log data from multiple sources to detect potential incidents
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A financial services firm has an incident classification scheme that categorizes incidents as low, medium, high, or critical based on the number of affected customers. During a recent incident, a single high-net-worth customer's account was compromised, but the customer is a major source of revenue. The incident was classified as low because only one customer was affected. Which of the following is the best course of action?

   • AIgnore the classification and respond based on the customer's status.
   • BTreat all incidents involving customers as critical.
   • CReclassify this incident as critical and respond accordingly.
   • DRevise the classification criteria to include the financial impact or strategic importance of affected customers.
   Reveal Solution Discussion Select an answer first