What is the purpose of maintaining a chain of custody for evidence in an investigation?

To allow multiple investigators to work on the same evidence simultaneously

To document who handled the evidence and when, ensuring its integrity and admissibility

To encrypt all evidence to prevent unauthorized access

To ensure that evidence is stored in a secure location

What is the primary goal of root cause analysis in incident management?

To assign blame to the responsible individual

To identify the underlying causes of an incident so that preventive measures can be implemented

To quickly restore systems to normal operation

To document the incident for legal purposes

A company is forming an incident response team and needs to ensure that the team can handle both technical and legal aspects of an incident. The team will include IT staff, legal counsel, and public relations. Which role is essential to coordinate these different functions?

An incident commander who leads the response and coordinates all parties.

A legal advisor who makes all decisions.

A public relations specialist who manages external communication.

A forensic analyst who handles all evidence collection.

A security team is managing multiple incidents simultaneously. Each incident has different severity levels and requires different resources. The team lead wants to ensure that each incident is properly tracked and that the most critical incidents receive priority. Which practice is most effective?

Use a ticketing system that assigns severity levels and tracks the status of each incident from detection to closure.

Handle incidents in the order they are reported, regardless of severity.

Assign all incidents to the most senior analyst to ensure quality.

Keep incident details in email threads to avoid extra tools.

Information Systems Security Management Professional

Domain 4Objective 3

4.3 Establish and Maintain Incident Management Program ISSMP Practice Questions (Page 5)

Part of the Security Operations domain, which accounts for 18% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

8concepts

18%of the exam

Questions 21–25

21foundation · easy
What is the purpose of maintaining a chain of custody for evidence in an investigation?
Select an answer first
22foundation · easy
What is the primary goal of root cause analysis in incident management?
Select an answer first
23application · medium
A company is forming an incident response team and needs to ensure that the team can handle both technical and legal aspects of an incident. The team will include IT staff, legal counsel, and public relations. Which role is essential to coordinate these different functions?
Select an answer first
24application · medium
A security team is managing multiple incidents simultaneously. Each incident has different severity levels and requires different resources. The team lead wants to ensure that each incident is properly tracked and that the most critical incidents receive priority. Which practice is most effective?
Select an answer first
25foundation · easy
Which document in an incident management program provides step-by-step instructions for performing a specific technical task, such as collecting memory from a compromised host?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.