Response CISM Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company discovers a breach that may involve sensitive customer data. The incident response team is preparing to notify affected customers. However, the legal team advises that the investigation is ongoing and the full scope is not yet known. What is the MOST appropriate action?

   • ANotify customers as soon as possible with the information currently available.
   • BWait until the investigation is complete before notifying customers.
   • CNotify customers after the public relations team approves the message.
   • DNotify only customers whose data is confirmed to be affected.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   After a security incident, a company has restored its systems and believes the threat is eradicated. However, the incident response team is unsure if the root cause was fully addressed. What is the MOST appropriate action?

   • ARestore the systems again from the same backups.
   • BConduct a root cause analysis and implement corrective actions before resuming normal operations.
   • CIncrease the frequency of backups to ensure faster recovery in the future.
   • DResume normal operations and monitor for any signs of recurrence.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has eradicated a malware infection and restored systems. Before resuming normal operations, what is the MOST important step to prevent recurrence?

   • AChange all user passwords and enforce multi-factor authentication.
   • BApply all relevant security patches and update antivirus signatures.
   • CIncrease logging and monitoring on all systems.
   • DConduct a security awareness training for all employees.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational company experiences a breach that affects customer data in multiple jurisdictions. The incident response team must notify stakeholders. What is the MOST important factor in determining the notification strategy?

   • AThe preferences of the company's public relations team.
   • BThe legal and regulatory requirements of each affected jurisdiction.
   • CThe time zone of the affected customers.
   • DThe severity of the breach as determined by the technical team.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary reason for preserving evidence when implementing containment measures?

   • ATo reduce the cost of containment
   • BTo avoid notifying stakeholders
   • CTo speed up the recovery process
   • DTo support potential legal proceedings and forensic analysis
   Reveal Solution Discussion Select an answer first