Preparation CISM Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company's incident response team includes members from different departments, but during a recent incident, the legal department was not informed until after the company had already made a public statement. The incident response manager wants to improve communication protocols. Which action would be most effective?

   • AAdd legal to the incident response team and define their role in the communication plan.
   • BRequire all public statements to be approved by the CEO.
   • CConduct a training session on public speaking for the incident response team.
   • DCreate a separate communication plan for legal incidents.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company has experienced a ransomware attack that encrypted critical files. The incident response team has isolated the affected systems to prevent further spread. Which of the following should be the next step in the response process?

   • ANotify law enforcement immediately.
   • BConduct a lessons-learned review.
   • CEradicate the ransomware from the affected systems.
   • DRestore the encrypted files from backups.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a typical activation trigger for a Business Continuity Plan?

   • AA major disruption that prevents normal business operations
   • BA quarterly board meeting
   • CA minor password reset request from an employee
   • DA scheduled software update
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a typical output of a Business Impact Analysis?

   • AA prioritized list of business functions with recovery time objectives (RTOs)
   • BA list of all security vulnerabilities in the network
   • CA log of all security incidents from the past year
   • DA detailed diagram of the network architecture
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a key component typically found in an incident response plan?

   • AA detailed inventory of all hardware assets
   • BA list of incident response team members and their roles
   • CA marketing plan for public relations after an incident
   • DA schedule for regular employee performance reviews
   Reveal Solution Discussion Select an answer first