What is the primary purpose of evaluating the scope and impact of an incident during the investigation phase?

To assign a public relations spokesperson for the incident

To determine which systems and data are affected and the extent of damage

To decide whether to disconnect the entire network

To calculate the exact financial loss for insurance claims

After a malware infection, a company has isolated affected systems and identified the root cause. They now need to restore operations. Which action is MOST critical during the eradication and recovery phase?

Reimage affected systems from a trusted source and apply security patches.

Delete the malware from each system manually.

Restore data from the most recent backup without verifying its integrity.

Reconnect all systems to the network immediately to resume business.

Which factor primarily determines the escalation level of an incident during response communications?

The type of operating system involved

The number of IT staff available

The time of day the incident occurred

The severity and potential impact of the incident

Which activity is essential to validate that recovery from an incident has been successful?

Testing the restored systems to confirm they function as expected

Immediately disconnecting the systems from the network

Notifying the media of the recovery

Deleting all logs from the incident period

What is the primary goal of the eradication phase in incident response?

Preserving evidence for legal action

Identifying all affected systems

Restoring systems to normal operation

Removing the root cause of the incident from affected systems

Certified Information Security Manager

Domain 4Objective 2

Response CISM Practice Questions (Page 2)

Part of the Domain 4: Incident Management domain, which accounts for 30% of the CISM exam.

26questions here

6free pages

4concepts

30%of the exam

Questions 6–10

6foundation · easy
What is the primary purpose of evaluating the scope and impact of an incident during the investigation phase?
Select an answer first
7application · medium
After a malware infection, a company has isolated affected systems and identified the root cause. They now need to restore operations. Which action is MOST critical during the eradication and recovery phase?
Select an answer first
8foundation · easy
Which factor primarily determines the escalation level of an incident during response communications?
Select an answer first
9foundation · easy
Which activity is essential to validate that recovery from an incident has been successful?
Select an answer first
10foundation · easy
What is the primary goal of the eradication phase in incident response?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.