CISM Incident Management Strategy Quiz

1. What is a primary advantage of establishing a Security Operations Center (SOC) for incident management?

Centralized monitoring, faster detection, and coordinated response

Guaranteed prevention of all security incidents

Elimination of the need for incident response plans

Reduced need for employee security awareness training

2. Which element is essential for effective incident communication during an active incident?

Clear chain of command, consistent messaging, and stakeholder awareness

Immediate public disclosure of all details

Avoiding communication until the incident is fully resolved

Communicating only with the CEO

3. True or False: Incident response plans should address only internal incidents and exclude third-party vendor breaches.

True

False

4. What role does forensic evidence preservation play in incident management?

Supports investigation, legal proceedings, and root cause analysis

Speeds up system recovery

Reduces insurance costs

Eliminates the need for backups

5. Which practice best supports continuous improvement in incident management?

Conducting lessons-learned sessions after each significant incident

Avoiding documentation to save time

Keeping incident procedures confidential

Limiting incident response training to management only

6. True or False: Incident response playbooks should be static documents updated only annually.

True

False

7. In incident severity classification, what typically determines whether an incident is rated 'critical'?

Impact on business operations and number of systems affected

The number of attackers involved

The cost of the security tools used

The time of day the incident occurred

8. What is the primary benefit of incident tabletop exercises?

Testing response procedures and identifying gaps without actual impact

Replacing the need for formal incident response plans

Eliminating all potential security threats

Reducing insurance premiums automatically

9. Which stakeholder group should be involved in developing incident communication strategies?

IT, Legal, Communications, Management, and potentially regulators

Only the IT department

External consultants exclusively

The incident commander alone

10. True or False: Post-incident reviews should focus only on assigning blame to responsible parties.

True

False

11. What is the primary goal of an incident response plan?

Minimize impact and restore normal operations quickly

Ensure all incidents result in criminal prosecution

Eliminate all cybersecurity risks permanently

Document every user action in the organization

12. Which metric is most important for measuring incident response effectiveness?

Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

Number of incidents reported annually

Total budget spent on security

Employee satisfaction scores

13. True or False: Incident response procedures should be tested only after an actual incident occurs.

True

False

14. During the recovery phase, what should be verified before restoring systems to production?

That the threat has been eliminated and integrity is confirmed

That all employees have been interviewed

That insurance claims have been filed

That media notifications have been completed

15. What is the primary purpose of incident categorization?

To prioritize response resources based on severity and impact

To ensure all incidents are reported to law enforcement

To eliminate the need for security training

To reduce incident detection time

16. True or False: An incident management strategy should include predetermined escalation procedures.

True

False

17. Which of the following is a key component of an incident response team structure?

Incident commander, technical analysts, and communications lead

Only IT staff and no external stakeholders

Solely the Chief Information Security Officer

Finance department and legal counsel only

18. In incident containment, what is the primary difference between short-term and long-term containment?

Short-term stops the attack; long-term prevents recurrence

Short-term is manual; long-term is automated

Short-term costs more; long-term costs less

Short-term requires management approval; long-term does not

19. What does CISM stand for?

Certified Information Security Manager

Cyber Information Systems Management

Critical Infrastructure Security Model

Comprehensive IT Security Methodology

20. Which phase of incident management focuses on identifying that a security event has occurred?

Containment

Detection and Analysis

Recovery

Preparation

CISM Incident Management Strategy Quiz

1. What is a primary advantage of establishing a Security Operations Center (SOC) for incident management?

2.

What first name or nickname would you like us to use?

2. Which element is essential for effective incident communication during an active incident?

3. True or False: Incident response plans should address only internal incidents and exclude third-party vendor breaches.

4. What role does forensic evidence preservation play in incident management?

5. Which practice best supports continuous improvement in incident management?

6. True or False: Incident response playbooks should be static documents updated only annually.

7. In incident severity classification, what typically determines whether an incident is rated 'critical'?

8. What is the primary benefit of incident tabletop exercises?

9. Which stakeholder group should be involved in developing incident communication strategies?

10. True or False: Post-incident reviews should focus only on assigning blame to responsible parties.

11. What is the primary goal of an incident response plan?

12. Which metric is most important for measuring incident response effectiveness?

13. True or False: Incident response procedures should be tested only after an actual incident occurs.

14. During the recovery phase, what should be verified before restoring systems to production?

15. What is the primary purpose of incident categorization?

16. True or False: An incident management strategy should include predetermined escalation procedures.

17. Which of the following is a key component of an incident response team structure?

18. In incident containment, what is the primary difference between short-term and long-term containment?

19. What does CISM stand for?

20. Which phase of incident management focuses on identifying that a security event has occurred?