An organization's SOC uses a SIEM to collect logs from various sources. The SIEM generates an alert for a potential brute-force attack on a critical server. The SOC analyst needs to determine if the attack was successful. Which additional tool would be most useful for this analysis?

An endpoint detection and response (EDR) tool

What is the PRIMARY purpose of classifying and categorizing incidents?

To document incidents for legal purposes only

To assign blame to responsible parties

To automatically resolve all incidents without human intervention

To prioritize response efforts and allocate resources effectively

A hospital's BCP includes a manual process for patient tracking that can sustain operations for up to 12 hours. The DRP for the EHR system has an RTO of 8 hours and an RPO of 1 hour. During a disaster, the EHR system is restored in 10 hours, but the last backup was 4 hours before the disaster. Which of the following is the most significant issue?

The RPO was met, but the RTO was not met.

The RTO was met, but the RPO was not met.

The RTO was not met, and the RPO was not met.

What is the PRIMARY focus of a Disaster Recovery Plan (DRP)?

Ensuring compliance with data protection regulations

Preventing security incidents from occurring

Restoring IT infrastructure and systems after a disaster

Maintaining business operations at an alternate site

Certified Information Security Manager

Domain 4Objective 1

Preparation CISM Practice Questions (Page 2)

Part of the Domain 4: Incident Management domain, which accounts for 30% of the CISM exam.

33questions here

7free pages

9concepts

30%of the exam

Questions 6–10

6application · medium
An organization's SOC uses a SIEM to collect logs from various sources. The SIEM generates an alert for a potential brute-force attack on a critical server. The SOC analyst needs to determine if the attack was successful. Which additional tool would be most useful for this analysis?
Select an answer first
7foundation · easy
What is the PRIMARY purpose of classifying and categorizing incidents?
Select an answer first
8foundation · easy
Which of the following tools is specifically designed to preserve and analyze digital evidence?
Select an answer first
9expert · hard
A hospital's BCP includes a manual process for patient tracking that can sustain operations for up to 12 hours. The DRP for the EHR system has an RTO of 8 hours and an RPO of 1 hour. During a disaster, the EHR system is restored in 10 hours, but the last backup was 4 hours before the disaster. Which of the following is the most significant issue?
Select an answer first
10foundation · easy
What is the PRIMARY focus of a Disaster Recovery Plan (DRP)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.

Preparation CISM Practice Questions (Page 2)

Questions 6–10

An organization's SOC uses a SIEM to collect logs from various sources. The SIEM generates an alert for a potential brute-force attack on a critical server. The SOC analyst needs to determine if the attack was successful. Which additional tool would be most useful for this analysis?

What is the PRIMARY purpose of classifying and categorizing incidents?

Which of the following tools is specifically designed to preserve and analyze digital evidence?

What is the PRIMARY focus of a Disaster Recovery Plan (DRP)?

Keep studying — Domain 4: Incident Management