Incident Management & Response
63 practice questions with explanations — 15 free to try
3 of these 63 questions are in the free 15-question taster · the full topic is part of Premium
PassNova has 63 CISM practice questions on Incident Management & Response, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Incident Management & Response: example questions & answers
3 worked examples with answers and explanations below. Try 15 CISM questions free in the browser; the full 63-question Incident Management & Response bank is part of PassNova Premium.
An information security manager is developing an incident response plan. What should be defined FIRST?
- AThe annual operating budget for the security operations centre
- BThe contact list for external forensic and legal support
- CA clear definition of what constitutes a security incident✓
- DThe communication templates for notifying regulators
Answer: A clear incident definition is foundational, because it determines what triggers the response process and ensures events are recognised and escalated consistently.
What is the PRIMARY objective of incident response?
- ATo collect and preserve evidence to support prosecution of the attackers involved
- BTo determine the underlying root cause of every incident that occurs in the organisation
- CTo notify the regulators within the mandatory reporting deadline set by law
- DTo limit damage and restore normal operations as quickly as possible✓
Answer: The primary objective of incident response is to contain damage and restore normal business operations quickly, minimising overall impact.
During a confirmed active security incident, what should the information security manager prioritise FIRST?
- AUpdating the long-term security strategy
- BIdentifying the full root cause of the incident in detail
- CContaining the incident to prevent further damage✓
- DDrafting a press release
Answer: Containment is the immediate priority during an active incident to stop the spread and prevent additional harm before eradication and recovery.