Preparation CISM Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following best differentiates a Disaster Recovery Plan (DRP) from a Business Continuity Plan (BCP)?

   • AThe DRP is a regulatory requirement, while the BCP is optional
   • BThe DRP is only used for natural disasters, while the BCP is for cyber incidents
   • CThe DRP focuses on IT recovery, while the BCP covers all business functions
   • DThe DRP is developed after an incident, while the BCP is developed before
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following activities is part of the eradication phase of incident management?

   • ARestoring data from backups
   • BIsolating the affected network segment
   • CNotifying law enforcement
   • DRemoving malware and malicious files from affected systems
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a large incident response team with members in different time zones. The team has a training program that requires all members to attend a live training session at the same time. This has been difficult to schedule, and some members have missed training. Which of the following is the most effective solution?

   • ARequire all members to travel to a central location for training.
   • BReduce the frequency of training to once a year.
   • COffer multiple training sessions at different times and record them for later viewing.
   • DAssign each member to read the training materials on their own.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An organization has a mature incident response plan and conducts tabletop exercises quarterly. The exercises consistently show that the plan is effective, but the organization has never experienced a real major incident. The CISO is concerned that the team may not be prepared for a real incident. Which of the following is the most appropriate action?

   • AConduct a full-scale simulation to test the plan under more realistic conditions.
   • BIncrease the frequency of tabletop exercises to monthly.
   • CContinue with quarterly tabletop exercises because they are sufficient.
   • DWait for a real incident to identify gaps.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following criteria is commonly used to determine the severity of an incident?

   • AThe cost of the incident response tools used
   • BThe number of employees involved in the response
   • CThe potential impact on business operations and data confidentiality
   • DThe time of day the incident occurred
   Reveal Solution Discussion Select an answer first