What is the PRIMARY role of a Business Continuity Plan (BCP)?

To maintain essential business operations during and after a disruption

To identify and mitigate security vulnerabilities in the network

To restore IT systems and infrastructure to their pre-disaster state

To provide a detailed budget for all IT projects

What is the PRIMARY objective of a Business Impact Analysis (BIA)?

To determine the root cause of past security incidents

To identify critical business functions and quantify the impact of their disruption

To test the effectiveness of the disaster recovery plan

To select and implement security controls for new systems

What is the PRIMARY purpose of testing an incident response plan?

To satisfy regulatory requirements only

To prove that the plan is perfect and requires no changes

To replace the need for training

To identify gaps and areas for improvement in the plan

An organization's SOC uses a SIEM to generate alerts, but the volume of alerts is overwhelming the analysts, leading to alert fatigue and missed critical alerts. The SOC manager wants to improve the effectiveness of the SIEM. Which of the following is the most effective approach?

Implement a ticketing system to manage the alerts.

Disable all low-priority alerts.

Increase the number of SOC analysts to handle the alert volume.

Tune the SIEM to reduce false positives and prioritize alerts based on risk.

Certified Information Security Manager

Domain 4Objective 1

Preparation CISM Practice Questions (Page 6)

Part of the Domain 4: Incident Management domain, which accounts for 30% of the CISM exam.

33questions here

7free pages

9concepts

30%of the exam

Questions 26–30

26foundation · easy
What is the PRIMARY role of a Business Continuity Plan (BCP)?
Select an answer first
27foundation · easy
What is the PRIMARY objective of a Business Impact Analysis (BIA)?
Select an answer first
28foundation · easy
What is the PRIMARY purpose of testing an incident response plan?
Select an answer first
29expert · hard
An organization's SOC uses a SIEM to generate alerts, but the volume of alerts is overwhelming the analysts, leading to alert fatigue and missed critical alerts. The SOC manager wants to improve the effectiveness of the SIEM. Which of the following is the most effective approach?
Select an answer first
30application · medium
A company's network has been infected with malware that is spreading to multiple servers. The incident response team needs to stop the spread while preserving evidence for later analysis. Which technique should be applied first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.