CISM Incident Management: 480 practice questions

12 of the 480 Incident Management questions in the Certsqill CISM bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISM? Take the free 5-min readiness check →

1. Activate the incident commander and continuity lead under: What is the BEST action?

1. Ask store managers to decide individually whether connectivity should be disabled.

   Local decisions bypass the approved authority matrix and can create inconsistent containment and continuity outcomes.
2. Activate the incident commander and continuity lead under the approved authority matrix. ✓

   This uses documented authority while ensuring continuity consequences are evaluated before disruptive containment occurs.
3. Isolate every affected store immediately to prevent possible lateral movement.

   Immediate isolation exceeds the stated policy threshold and could disrupt essential sales without continuity confirmation.
4. Wait for complete forensic confirmation before activating incident governance.

   Waiting delays authorized coordination while service degradation is already creating a business-impacting incident.

Activate designated incident and continuity authorities together before containment, because policy requires continuity confirmation.

2. Validate the fallback through a focused exercise: What should management prioritize?

1. Publish the fallback instructions to all employees before testing the channel.

   Broad publication does not establish usability, availability, or 30-minute coordination performance under disruption.
2. Replace the fallback with a newly selected commercial messaging service.

   Replacing an approved channel introduces delay and governance uncertainty when readiness must be demonstrated promptly.
3. Wait until the next major routing exercise to evaluate the fallback.

   Deferring validation leaves the company unable to demonstrate compliance with its immediate coordination requirement.
4. Validate the fallback through a focused exercise with required participants. ✓

   A focused exercise verifies that the approved channel and participants can meet the explicit coordination requirement.

Exercise the approved fallback with required participants, proving it can support coordination within the stated disruption constraint.

3. Add the supplier to the next downtime exercise and test: What is the BEST management action?

1. Add the supplier to the next downtime exercise and test its assigned coordination responsibilities. ✓

   This satisfies the explicit exercise requirement while validating supplier roles, communications, and operational coordination before disruption.
2. Require the supplier to provide updated contact details before reviewing exercise participation.

   Updated contacts help, but they do not demonstrate the supplier can coordinate securely during the required downtime exercise.
3. Ask hospital staff to perform the exercise first, then brief the supplier afterward.

   Excluding the critical supplier prevents validation of dependencies and leaves the required external coordination untested.
4. Revise the supplier contract to transfer all response coordination to hospital administration.

   Contract revision may clarify accountability, but it does not fulfill the current requirement to test supplier participation and exchange.

Include the critical supplier in the required exercise, testing both assigned roles and secure coordination before service disruption.

4. Assign list ownership and obtain business-owner: What is the BEST next action?

1. Ask the security team to update the list from publicly available information.

   Security can assist, but public information does not provide the required business-owner validation or accountability.
2. Replace the list with a general mailbox monitored by administrative staff.

   A shared mailbox may add resilience, but it does not establish validated individuals and escalation responsibilities.
3. Assign list ownership and obtain business-owner confirmation at the required review. ✓

   Named ownership and confirmation directly satisfy the partnership’s maintenance requirement and improve contact reliability.
4. Schedule a tabletop exercise before assigning responsibility for list maintenance.

   An exercise may reveal contact failures, but the immediate requirement is ownership and quarterly business-owner confirmation.

Assign accountable owners and obtain their required confirmation, directly correcting the documented maintenance failure.

5. Align the incident playbook with the approved alternate: What should management do?

1. Let the incident commander choose between the conflicting documents during the disruption.

   Deferring reconciliation preserves ambiguity when the organization already has an approved continuity workflow.
2. Replace the continuity workflow with the incident playbook’s isolation recommendation.

   Replacing the approved business workaround with isolation disregards the steering committee’s established continuity decision.
3. Align the incident playbook with the approved alternate fulfillment workflow. ✓

   Alignment ensures incident actions invoke an already approved continuity response instead of creating conflicting business instructions.
4. Run a technical recovery test before reconciling the two planning documents.

   Testing may provide useful evidence, but it does not resolve the immediate governance conflict between approved plans.

Reconcile the playbook with the approved continuity workflow so incident actions support established business priorities.

6. Escalate to the policy owner for direction while: What is the BEST action?

1. Escalate to the policy owner for direction while preserving evidence and monitoring. ✓

   This respects the stated confirmation threshold, avoids an unauthorized isolation, and obtains direction from the authority responsible for resolving the policy conflict.
2. Isolate the affected network immediately because shipment delays are preferable to compromise.

   The action bypasses the explicit confirmation requirement and applies an unstated risk preference instead of authorized direction.
3. Continue routine monitoring until credential compromise is conclusively proven.

   Routine monitoring alone may prolong exposure and does not escalate the unresolved operational and security tradeoff for a timely decision.
4. Have the network administrator approve temporary isolation for operational speed.

   The scenario does not delegate authority to the administrator, and operational urgency does not remove the confirmation condition.

Respect the confirmation threshold and escalate the unresolved conflict to the policy owner.

7. One incident lead and a contemporaneous decision log: What should management establish first?

1. One incident lead and a contemporaneous decision log. ✓

   This immediately creates coordination authority and preserves the decisions needed to manage conflicting information responsibly.
2. A communications statement describing the conflicting operational reports.

   A statement may inform audiences later, but it does not first establish internal authority and decision traceability.
3. A forensic review to determine which team issued the first update.

   Determining update chronology can wait; the immediate policy requirement is coordinated leadership and contemporaneous logging.
4. A larger technical bridge staffed by representatives from every department.

   More participants may increase information flow but does not establish the required single lead or decision record.

Designate one lead and begin contemporaneous logging, satisfying the policy requirement while stabilizing conflicting coordination.

8. Include counsel in fact review and notification planning: What is the BEST action?

1. Have the incident manager determine notification obligations using the response playbook.

   The incident manager may coordinate facts, but policy specifically requires counsel to assess notification obligations.
2. Wait for complete incident facts before involving counsel in the response.

   Deferring counsel prevents timely assessment of obligations and ignores the policy’s requirement to involve counsel before notice.
3. Notify every potentially affected client immediately, then ask counsel to review the messages.

   Immediate notification violates the stated prerequisite and may communicate unverified or unnecessarily sensitive information.
4. Include counsel in fact review and notification planning before external notice. ✓

   Counsel’s required participation supports obligation analysis while facts develop and prevents premature or incomplete external communication.

Involve counsel during fact review and planning, as policy requires that assessment before external notification.

9. A signed authority matrix naming the incident commander: Which evidence most directly demonstrates that result

1. A signed authority matrix naming the incident commander and containment limits. ✓

   The signed matrix directly records delegated authority, responsible leadership, and the boundaries governing disruptive response actions.
2. A completed awareness course for store and security personnel.

   Training indicates preparation, but it does not establish who holds authority or what containment limits apply.
3. A tabletop exercise showing teams discussed possible ransomware scenarios.

   Discussion demonstrates practice, but does not directly prove approved authority and containment boundaries were formally established.
4. An updated contact list containing executives and store managers.

   Contacts support escalation, but they do not identify delegated authority or define permissible containment actions.

A signed authority matrix directly proves designated leadership and containment boundaries existed before disruption.

10. An exercise record showing designated participants: Which evidence most directly establishes readiness?

1. A completed communications plan listing the fallback channel and escalation sequence.

   A plan describes intended readiness but does not demonstrate that participants can connect within the required timeframe.
2. A procurement record showing the fallback service was approved and purchased.

   Approval and purchase establish availability of a service, not successful coordination by required participants during disruption.
3. A current contact roster containing mobile numbers for response participants.

   Accurate numbers support outreach, but they do not prove the fallback channel works within 30 minutes.
4. An exercise record showing designated participants connected through the fallback within 30 minutes. ✓

   This record demonstrates actual participant reachability, channel usability, and performance against the stated coordination requirement.

A timed exercise record directly proves the fallback reached designated participants within the required 30-minute window.

11. An exercise record shows the supplier used the agreed: Which evidence most directly establishes that supplier

1. The supplier’s current contract includes security obligations.

   Contract language establishes expectations, but does not demonstrate that the supplier can execute the required incident coordination.
2. An exercise record shows the supplier used the agreed escalation path. ✓

   Exercise evidence directly demonstrates that the supplier understood and performed the required coordination under response conditions.
3. The supplier’s account manager attended the hospital’s annual security awareness briefing.

   Awareness attendance may improve knowledge, but does not establish supplier participation in the required response workflow.
4. The supplier received the hospital’s incident response plan.

   Receipt confirms distribution, but not understanding, acceptance, or successful use of the specified escalation process.

The exercise record demonstrates actual supplier coordination, rather than merely documenting obligations, distributing plans, or providing general awareness.

12. Use the owner’s quarterly review record: Which evidence best proves the requirement is being met?

1. Provide the quarterly emergency-messaging platform test results

   Platform testing supports communications readiness but does not prove ownership or review of the contact list itself.
2. Show that the security team can edit the contact list

   Editing permission shows capability, not assignment of accountability or evidence that a quarterly review occurred.
3. Show that the current contact list is stored in the response repository

   Storage demonstrates availability, but not accountable ownership or completion of quarterly maintenance.
4. Use the owner’s quarterly review record ✓

   The record directly evidences both the accountable owner and completion of the required quarterly review.

A named owner’s quarterly review record proves both accountability and required maintenance.

Other CISM domains

• Information Security Program — 528 questions →
• Information Security Risk Management — 320 questions →
• Information Security Governance — 272 questions →
• All 1600 CISM questions →
• CISM certification: requirements, cost and exam format →