Response CISM Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An incident response team is investigating a suspected data exfiltration. They have identified a compromised endpoint and need to preserve evidence. Which action is MOST appropriate?

   • ACreate a forensic image of the endpoint's hard drive.
   • BRun a full antivirus scan on the endpoint.
   • CDelete suspicious files to prevent further damage.
   • DReboot the endpoint to clear memory.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an incident investigation, an analyst discovers that a compromised user account was used to access a file share containing sensitive documents. The analyst needs to determine the full scope of the incident. Which action is MOST appropriate?

   • ADisable the user account immediately.
   • BReview authentication logs for all access events from that account.
   • CAsk the user to explain their actions.
   • DCheck the file share's audit logs only.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   During a major incident, the incident response team needs to communicate with multiple stakeholders, including executives, legal, and technical staff. The team must ensure that information is shared appropriately. What is the MOST important consideration?

   • ADelay communication until the incident is fully resolved.
   • BTailor the communication to the needs and level of detail appropriate for each stakeholder group.
   • CCommunicate only through the incident response team lead.
   • DShare all information with all stakeholders to ensure transparency.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   During an incident investigation, which activity is most directly associated with determining the root cause of an incident?

   • ANotifying regulatory authorities of the incident
   • BIsolating the affected system from the network
   • CAnalyzing logs and correlating events to identify the underlying trigger
   • DRestoring the system from a known good backup
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   After a ransomware attack, a company has restored its systems from backups. However, the backups were also encrypted by the ransomware. The company must recover its data. Which action is MOST appropriate?

   • ARestore from the encrypted backups and hope the data is intact.
   • BPay the ransom to obtain the decryption key.
   • CUse offline backups or snapshots that were not affected by the ransomware.
   • DAttempt to decrypt the files using publicly available tools.
   Reveal Solution Discussion Select an answer first