Response CISM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A malware outbreak is spreading across a company's network, affecting multiple departments. The incident response team needs to contain the outbreak while minimizing business disruption. Which containment strategy is MOST appropriate?

   • ADisconnect the entire network from the internet.
   • BSegment the network to isolate affected departments while keeping others operational.
   • CLet the malware run its course and then clean up.
   • DShut down all affected systems immediately.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After a ransomware incident, a company has restored its systems from backups and believes the threat is eradicated. What additional step is MOST important to validate the recovery?

   • AInform all employees that the incident is resolved.
   • BMonitor the systems for a few days before resuming normal operations.
   • CRestore the systems again from the same backups.
   • DConduct a vulnerability scan and penetration test on restored systems.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company's network is under attack, and the incident response team needs to contain the threat. However, the attack is also affecting a critical business partner's systems. The team must balance containment with maintaining the business relationship. Which action is MOST appropriate?

   • AKeep the incident confidential to avoid damaging the business relationship.
   • BIsolate the affected systems and inform the business partner of the incident and containment actions.
   • CDelay containment to avoid disrupting the partner's operations.
   • DAsk the partner to handle the containment on their end.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization detects unusual outbound network traffic from a server that hosts a public-facing application. The incident response team needs to determine whether this is a security incident. Which action is MOST appropriate?

   • AIgnore the traffic because it is from a public-facing server.
   • BCorrelate the traffic with known indicators of compromise and system logs.
   • CReboot the server to clear any potential malware.
   • DImmediately block all outbound traffic from the server.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial institution discovers a data breach involving customer personal information. The incident response team has confirmed the scope and is preparing to notify affected parties. Which communication should occur FIRST?

   • ANotify the organization's legal counsel and executive management.
   • BContact each affected customer individually by email.
   • CReport the breach to law enforcement.
   • DIssue a press release to inform the public.
   Reveal Solution Discussion Select an answer first