Isaca CISM Online Practice Questions and Exam Preparation

Isaca CISM Online Questions & Answers

• Question 1581:

  The PRIMARY objective of performing a post-incident review is to:

  A. re-evaluate the impact of incidents.
  B. identify vulnerabilities.
  C. identify control improvements.
  D. identify the root cause.
  D. identify the root cause.

  ---

  Explanation

  The primary objective of performing a post-incident review is to identify the root cause of the incident, which is the underlying factor or condition that enabled or facilitated the occurrence of the incident. Identifying the root cause helps to understand the nature and origin of the incident, and to prevent or mitigate similar incidents in the future. A post-incident review also aims to evaluate the effectiveness and efficiency of the incident response process, identify lessons learned and best practices, and recommend improvements for the incident management policies, procedures, controls, and tools. However, these are secondary objectives that depend on the identification of the root cause as the first step.

  Re-evaluating the impact of incidents is not the primary objective of performing a post-incident review, as it is already done during the incident response process. The impact of incidents is the extent and severity of the damage or harm caused by the incident to the organization's assets, operations, reputation, or stakeholders. Re- evaluating the impact of incidents may be part of the post-incident review, but it is not the main goal.

  Identifying vulnerabilities is not the primary objective of performing a post-incident review, as it is also done during the incident response process. Vulnerabilities are weaknesses or flaws in the system or network that can be exploited by attackers to compromise the confidentiality, integrity, or availability of the information or resources. Identifying vulnerabilities may be part of the post-incident review, but it is not the main goal. Identifying control improvements is not the primary objective of performing a post-incident review, as it is a result of the root cause analysis. Controls are measures or mechanisms that are implemented to protect the system or network from threats, reduce risks, or ensure compliance with policies and standards. Identifying control improvements is an important outcome of the post-incident review, but it is not the main goal.

  References:

  ISACA CISM: PRIMARY goal of a post-incident review should be to?

  CISM Exam Overview - Vinsys

  CISM Review Manual, Chapter 4, page 176 CISM Exam Content Outline | CISM Certification | ISACA, Domain 4, Task 4.3

• Question 1582:

  Which of the following is the BEST way to rigorously test a disaster recovery plan (DRP) for a mission-critical system without disrupting business operations?

  A. Parallel testing
  B. Simulation testing
  C. Checklist review
  D. Structured walk-through
  A. Parallel testing

• Question 1583:

  What should be the FIRST step when an Internet of Things (loT) device in an organization's network is confirmed to have been hacked?

  A. Monitor the network.
  B. Perform forensic analysis.
  C. Disconnect the device from the network.
  D. Escalate to the incident response team.
  C. Disconnect the device from the network.

  ---

  Explanation

  Disconnecting the device from the network is the first step when an IoT device in an organization's network is confirmed to have been hacked, as it prevents the attacker from further compromising the device or using it as a pivot point to attack other devices or systems on the network. Disconnecting the device also helps preserve the evidence of the attack for later forensic analysis and remediation. Disconnecting the device should be done in accordance with the incident response plan and the escalation procedures.