Who should confirm that restored business systems are ready to return to normal operation?

The business owners, after validation of functionality and data

Why should monitoring be increased for a period after systems are restored from an incident?

To detect attacker return or missed persistence

Incident responders are communicating through the organization's email system, which may be compromised. What should be done?

Use pre-arranged out-of-band communication channels

A compromised cloud virtual machine is about to be terminated by an automated scaling process. What should responders do FIRST to preserve evidence?

Snapshot the disk, capture memory where possible and protect the instance from termination

The security team subscribes to many threat intelligence feeds and cannot keep up with the volume of indicators. What is the BEST action?

Prioritize feeds that match the organization's threat profile

Which type of incident MOST requires early involvement of legal and privacy specialists?

An incident involving possible exposure of personal data

Which document should be updated MOST directly as a result of lessons learned from a post-incident review?

The incident response plan and related playbooks

During a major incident, executives repeatedly call responders for updates, slowing the technical work. What is the BEST solution?

Designate a communications lead who gives executives scheduled updates

Free CISM Domain 4 Practice Questions with Answers

2026-10-19

These five CISM Domain 4 questions are drawn from Auditor Path's bank. Each follows ISACA's item-writing style: a scenario, four plausible options and one BEST answer. Read the explanation even when you get it right — it names the judgment the exam is testing.

Domain 4, Incident Management, is 30% (29% from 3 November 2026) of the CISM exam.

Question 1: Incident Containment Methods

A compromised public web server supports online sales and cannot be taken offline while a clean replacement is built. Which containment approach is MOST appropriate?

A. Restore the server from last night's backup and return it to service once the restore has been verified
B. Leave the server unchanged and monitor it closely until the replacement is ready
C. Shut the server down immediately and disconnect it, regardless of the impact on online sales
D. Restrict the server's inbound and outbound connections as short-term containment while a clean replacement is built

Answer: D. Containment often happens in stages: a short-term measure limits the attacker's ability to act while a longer-term solution, such as a rebuilt system, is prepared. This balances limiting damage against keeping a critical business service running.

Exam mindset: Contain in stages when the business cannot stop.

Question 2: Incident Management Tools and Techniques

Responders suspect the attacker has access to the corporate email and chat systems. Which preparation would have BEST supported coordination in this situation?

A. A policy requiring responders to meet in person for each significant containment decision
B. Additional licenses for the existing corporate chat platform
C. A pre-established out-of-band communication channel independent of corporate systems
D. Encryption of the internal email messages sent between members of the response team

Answer: C. If primary communication systems may be compromised, responders need a separate, trusted channel prepared in advance. This prevents the attacker from monitoring the response.

Exam mindset: Don't plan the defense on the attacker's network.

Question 3: Incident Response Plan

An employee reports a lost laptop containing company data. Which response playbook steps are MOST important?

A. Check encryption, wipe the device, reset credentials and assess exposure
B. File a police report and issue a replacement laptop so the employee can continue working
C. Wait a set period in case the laptop is found or handed in before taking any further action
D. Begin a disciplinary review of the employee for losing the device and breaching the asset policy

Answer: A. A defined playbook limits exposure from lost devices quickly and consistently.

Exam mindset: Contain exposure first, then investigate.

Question 4: Disaster Recovery Plan (DRP)

Disaster recovery tests have only ever covered non-critical systems because they are easier to test. What is the MOST significant concern?

A. The recovery capability for the systems that matter most remains unproven
B. Non-critical systems may be receiving more recovery investment than needed
C. Recovery time objectives for critical systems may be set too low
D. Testing may not have included the alternate site's network connections

Answer: A. Testing should prioritize critical systems, using methods that limit disruption.

Exam mindset: Test what matters most.

Question 5: Post-Incident Review Practices

What is the MOST important outcome of a post-incident review?

A. Formal closure of the incident ticket and its tasks
B. A final incident report sent to the board
C. Identifying the individuals responsible for errors during the response
D. Actionable improvements to controls, processes and the response plan

Answer: D. Lessons learned should lead to concrete changes that reduce the chance or impact of future incidents.

Exam mindset: Learn and improve.

Keep practising

The quiz below draws more questions from every CISM Domain 4 subtopic. Sign in to practise the full bank, take timed 150-question mocks and see your readiness by domain.