CISM Domain 4 - Information Security
Incident Management Exam Questions
& Answers (Grade A+)
1 Which of the following should be determined FIRST when
establishing a business continuity program?
A. Cost to rebuild information processing facilities
B. Incremental daily cost of the unavailability of systems
C. Location and cost of offsite recovery facilities
D. Composition and mission of individual recovery teams - B is the
correct answer.
Justification:
A. The cost to rebuild information processing facilities would not be
the first thing to determine.
B. Prior to creating a detailed business continuity plan, it is
important to determine the incremental daily cost of losing
different systems. This will allow recovery time objectives to be
determined.
C. Location and cost of a recovery facility cannot be addressed until
the potential losses are calculated, which will determine the type of
recovery site that is needed-and this will affect cost.
D. Individual recovery team requirements will occur after the
requirements for business continuity are determined.
,CISM Domain 4 - Information Security
Incident Management Exam Questions
& Answers (Grade A+)
2 A company has a network of branch offices with local file/print
and mail servers; each branch individually contracts a hot site.
Which of the following would be the GREATEST weakness in
recovery capability?
A. Exclusive use of the hot site is limited to six weeks.
B. The hot site may have to be shared with other customers.
C. The time of declaration determines site access priority.
D. The provider services all major companies in the area. - D is the
correct answer.
Justification:
A. Access to a hot site is not indefinite; the recovery plan should
address a long-term outage.
B. Sharing a hot site facility is common practice and sometimes
necessary in the case of a major disaster and not a significant
weakness.
C. First come, first served is a standard practice in hosted facilities
and does not constitute a major weakness.
D. In case of a disaster affecting a localized geographical area, the
vendor's facility and capabilities could be insufficient for all of its
clients, which will all be competing for the same resource.
Preference will likely be given to the larger corporations, possibly
,CISM Domain 4 - Information Security
Incident Management Exam Questions
& Answers (Grade A+)
delaying the recovery of a branch that will likely be smaller than
other clients based locally.
3 Which of the following actions should be taken when an online
trading company discovers a network attack in progress?
A. Shut off all network access points
B. Dump all event logs to removable media
C. Isolate the affected network segment
D. Enable trace logging on all events - C is the correct answer.
Justification:
A. Shutting off all network access points would create a denial of
service that could result in loss
of revenue.
B. Dumping event logs, while useful, would not mitigate the
immediate threat posed by the network attack.
C. Isolating the affected network segment will mitigate the
immediate threat while allowing unaffected portions of the
business to continue processing.
D. Enabling trace logging, while useful, would not mitigate the
immediate threat posed by the network attack.
, CISM Domain 4 - Information Security
Incident Management Exam Questions
& Answers (Grade A+)
4 Which of the following choices should be assessed after the
likelihood of a loss event has been determined?
A. The magnitude of impact
B. Risk tolerance
C. The replacement cost of assets
D. The book value of assets - A is the correct answer.
Justification:
A. Disaster recovery is driven by risk, which is a combination of
likelihood and consequences. Once
likelihood has been determined, the next step is to determine the
magnitude of impact.
B. Risk tolerance is the acceptable deviation from acceptable risk.
This is taken into account once risk has been quantified, which is
dependent on determining the magnitude of impact.
C. Replacement cost is needed only when replacement is required.
D. Book value does not represent actual asset value and cannot be
used to measure magnitude of impact.
Incident Management Exam Questions
& Answers (Grade A+)
1 Which of the following should be determined FIRST when
establishing a business continuity program?
A. Cost to rebuild information processing facilities
B. Incremental daily cost of the unavailability of systems
C. Location and cost of offsite recovery facilities
D. Composition and mission of individual recovery teams - B is the
correct answer.
Justification:
A. The cost to rebuild information processing facilities would not be
the first thing to determine.
B. Prior to creating a detailed business continuity plan, it is
important to determine the incremental daily cost of losing
different systems. This will allow recovery time objectives to be
determined.
C. Location and cost of a recovery facility cannot be addressed until
the potential losses are calculated, which will determine the type of
recovery site that is needed-and this will affect cost.
D. Individual recovery team requirements will occur after the
requirements for business continuity are determined.
,CISM Domain 4 - Information Security
Incident Management Exam Questions
& Answers (Grade A+)
2 A company has a network of branch offices with local file/print
and mail servers; each branch individually contracts a hot site.
Which of the following would be the GREATEST weakness in
recovery capability?
A. Exclusive use of the hot site is limited to six weeks.
B. The hot site may have to be shared with other customers.
C. The time of declaration determines site access priority.
D. The provider services all major companies in the area. - D is the
correct answer.
Justification:
A. Access to a hot site is not indefinite; the recovery plan should
address a long-term outage.
B. Sharing a hot site facility is common practice and sometimes
necessary in the case of a major disaster and not a significant
weakness.
C. First come, first served is a standard practice in hosted facilities
and does not constitute a major weakness.
D. In case of a disaster affecting a localized geographical area, the
vendor's facility and capabilities could be insufficient for all of its
clients, which will all be competing for the same resource.
Preference will likely be given to the larger corporations, possibly
,CISM Domain 4 - Information Security
Incident Management Exam Questions
& Answers (Grade A+)
delaying the recovery of a branch that will likely be smaller than
other clients based locally.
3 Which of the following actions should be taken when an online
trading company discovers a network attack in progress?
A. Shut off all network access points
B. Dump all event logs to removable media
C. Isolate the affected network segment
D. Enable trace logging on all events - C is the correct answer.
Justification:
A. Shutting off all network access points would create a denial of
service that could result in loss
of revenue.
B. Dumping event logs, while useful, would not mitigate the
immediate threat posed by the network attack.
C. Isolating the affected network segment will mitigate the
immediate threat while allowing unaffected portions of the
business to continue processing.
D. Enabling trace logging, while useful, would not mitigate the
immediate threat posed by the network attack.
, CISM Domain 4 - Information Security
Incident Management Exam Questions
& Answers (Grade A+)
4 Which of the following choices should be assessed after the
likelihood of a loss event has been determined?
A. The magnitude of impact
B. Risk tolerance
C. The replacement cost of assets
D. The book value of assets - A is the correct answer.
Justification:
A. Disaster recovery is driven by risk, which is a combination of
likelihood and consequences. Once
likelihood has been determined, the next step is to determine the
magnitude of impact.
B. Risk tolerance is the acceptable deviation from acceptable risk.
This is taken into account once risk has been quantified, which is
dependent on determining the magnitude of impact.
C. Replacement cost is needed only when replacement is required.
D. Book value does not represent actual asset value and cannot be
used to measure magnitude of impact.
