After a malware outbreak, the root cause analysis reveals that the malware entered through a phishing email that bypassed the email filter. The filter was configured to allow emails from a specific domain that was later compromised. The team must recommend preventive measures. Which recommendation addresses the root cause most effectively?

Disable email delivery from all external domains.

Increase user awareness training on phishing emails.

Implement a process to regularly review and update email filter rules based on threat intelligence.

Purchase a more expensive email security solution.

Which of the following is a common metric used to quantify the impact of an incident?

Number of security alerts generated

A company's incident response team is preparing a report for the board of directors after a denial-of-service attack that lasted three hours. The board wants to understand the business impact and the effectiveness of the response. Which information is most important to include?

The names of the security analysts who responded.

The estimated revenue loss, customer impact, and response time metrics.

A list of all firewall rules that were changed during the incident.

The IP addresses of the attacking systems.

A security operations center detects a worm spreading across the network. The incident response team needs to stop the spread while preserving evidence for analysis. According to NIST SP 800-61, which step should be performed first?

Post-incident activity: conduct a lessons-learned review.

Eradication: remove the worm from all systems.

Containment: isolate affected systems to prevent further spread.

Recovery: restore systems from backups.

During a suspected data breach, a forensic investigator needs to collect evidence from a compromised server. The server is still running and is needed for business operations. The investigator must preserve evidence while minimizing disruption. Which action is most appropriate?

Run a full antivirus scan and then delete any detected malware.

Power off the server immediately to preserve the disk state.

Capture a memory image and a forensic disk image while the system is running, then document the collection process.

Copy only the relevant files to a USB drive and then continue operations.

Information Systems Security Management Professional

Domain 4Objective 3

4.3 Establish and Maintain Incident Management Program ISSMP Practice Questions (Page 2)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

18%of the exam

Questions 6–10

6expert · hard
After a malware outbreak, the root cause analysis reveals that the malware entered through a phishing email that bypassed the email filter. The filter was configured to allow emails from a specific domain that was later compromised. The team must recommend preventive measures. Which recommendation addresses the root cause most effectively?
Select an answer first
7foundation · easy
Which of the following is a common metric used to quantify the impact of an incident?
Select an answer first
8application · medium
A company's incident response team is preparing a report for the board of directors after a denial-of-service attack that lasted three hours. The board wants to understand the business impact and the effectiveness of the response. Which information is most important to include?
Select an answer first
9application · medium
A security operations center detects a worm spreading across the network. The incident response team needs to stop the spread while preserving evidence for analysis. According to NIST SP 800-61, which step should be performed first?
Select an answer first
10expert · hard
During a suspected data breach, a forensic investigator needs to collect evidence from a compromised server. The server is still running and is needed for business operations. The investigator must preserve evidence while minimizing disruption. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.