Response CISM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During an incident, the incident response team discovers that a third-party vendor has access to the affected system. The team needs to communicate with the vendor. What is the MOST important consideration?

   • AAsk the vendor to investigate the incident on their own.
   • BWait until the incident is fully resolved before informing the vendor.
   • CEnsure the vendor is informed of the incident and their access is temporarily revoked.
   • DKeep the incident confidential from the vendor to avoid panic.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company's critical application server is infected with malware that is actively spreading. The server cannot be taken offline without causing significant business disruption. The incident response team must contain the threat while maintaining availability. Which approach is MOST appropriate?

   • AAllow the malware to continue running while monitoring its behavior.
   • BDisconnect the server and wait for business hours to restore.
   • CApply a host-based firewall rule to block all inbound and outbound traffic.
   • DIsolate the server at the network level and deploy a temporary failover system.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which stakeholder group must be notified when an incident involves personally identifiable information (PII) and is subject to data protection regulations?

   • AOnly the internal IT department
   • BRegulatory authorities and affected individuals
   • CThe public via social media
   • DCompetitors and industry partners
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which containment strategy is most appropriate when an infected system must remain online for forensic evidence collection, but its communication with other systems must be restricted?

   • ADisconnecting the system from all networks
   • BImmediate shutdown of the system
   • CDeleting all suspicious files from the system
   • DNetwork segmentation to isolate the system into a separate VLAN
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization experiences a security incident that may involve personally identifiable information (PII). The incident response team is unsure whether the breach meets the threshold for regulatory notification. Who should make the final determination?

   • AThe chief information security officer (CISO)
   • BThe incident response team lead
   • CThe public relations department
   • DLegal counsel
   Reveal Solution Discussion Select an answer first