A healthcare organization is developing its incident management program. The compliance officer requires that the program clearly defines what constitutes an incident, who is responsible for what, and how incidents are reported. Which document should be the primary reference?

An incident response policy that sets the framework and mandates roles and reporting requirements.

A detailed runbook for a specific type of incident, such as ransomware.

A vendor contract for incident response services.

A list of all security tools and their configurations.

A company experienced a data breach that was traced to a misconfigured firewall rule. The firewall rule was changed by a network administrator two weeks before the breach. The administrator claims the change was approved. The incident response team is conducting a root cause analysis. Which approach is most appropriate?

Review change management records, firewall logs, and interview the administrator to determine why the rule was misconfigured.

Assume the administrator intentionally misconfigured the firewall.

Revert the firewall rule and close the incident.

Discipline the administrator for the misconfiguration.

Information Systems Security Management Professional

Domain 4Objective 3

4.3 Establish and Maintain Incident Management Program ISSMP Practice Questions (Page 3)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

18%of the exam

Questions 11–15

11foundation · easy
Which phase of the incident handling process involves removing the root cause of the incident, such as deleting malware or closing a vulnerability?
Select an answer first
12foundation · easy
Which technique is commonly used in root cause analysis to visually map out the potential causes of an incident?
Select an answer first
13application · medium
A healthcare organization is developing its incident management program. The compliance officer requires that the program clearly defines what constitutes an incident, who is responsible for what, and how incidents are reported. Which document should be the primary reference?
Select an answer first
14expert · hard
A company experienced a data breach that was traced to a misconfigured firewall rule. The firewall rule was changed by a network administrator two weeks before the breach. The administrator claims the change was approved. The incident response team is conducting a root cause analysis. Which approach is most appropriate?
Select an answer first
15foundation · easy
Which incident response methodology is published by the National Institute of Standards and Technology (NIST) and provides a structured approach to handling incidents?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

4.3 Establish and Maintain Incident Management Program ISSMP Practice Questions (Page 3)

Questions 11–15

Which phase of the incident handling process involves removing the root cause of the incident, such as deleting malware or closing a vulnerability?

Which technique is commonly used in root cause analysis to visually map out the potential causes of an incident?

A healthcare organization is developing its incident management program. The compliance officer requires that the program clearly defines what constitutes an incident, who is responsible for what, and how incidents are reported. Which document should be the primary reference?

Which incident response methodology is published by the National Institute of Standards and Technology (NIST) and provides a structured approach to handling incidents?

Keep studying — Security Operations