Question bank
Certified Incident Manager
40 Certified Incident Manager questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Crisis Management and Communication
6 questions in this domain
- Question 1Single Choice
According to the CREST CCIM framework, what is the primary focus of crisis management compared to routine incident handling?
- ATechnical containment and restoration
- BOrganisational survival and trust preservationCorrect answer
- CImmediate deployment of additional security tools
- DEnsuring all systems are patched within 24 hours
Why this is the answer
Crisis management shifts focus from tactical resolution to strategic outcome, stakeholder trust, and leadership, as per the CCIM framework.
- Question 2Multiple Select
Which of the following are key principles of crisis management as outlined in the CREST CCIM framework? (Select two)
- ASeparate strategic decision-making from tactical executionCorrect answer
- BMaintain communication integrity across internal and external stakeholdersCorrect answer
- CAlways prioritise speed over accuracy
- DDeploy maximum technical resources immediately
Why this is the answer
Core principles include establishing a clear command structure, separating strategic from tactical, and maintaining communication integrity.
- Question 3Interactive
Referring to the code block above, which phase of the OODA loop was most critical in this rapid decision-making scenario?
- AObserve
- BOrientCorrect answer
- CDecide
- DAct
Why this is the answer
According to the document, orientation (mental model of the crisis) is the most critical phase of the OODA loop.
- Question 4Single Choice
According to crisis communication principles, what is the recommended approach for communicating bad news during an incident?
- AWait until the investigation is complete before making any statement
- BTell it all, tell it early, tell it yourselfCorrect answer
- COnly inform internal stakeholders and avoid external communication
- DDelay communication to avoid panic
Why this is the answer
The CCIM emphasises that silence creates a vacuum filled by speculation; the rule is 'Tell it all, tell it early, tell it yourself.'
- Question 5Multiple Select
Which of the following are considered key concepts in crisis communication? (Select two)
- ASingle Point of Contact (SPoC)Correct answer
- BSegmentation of AudiencesCorrect answer
- CUnlimited spokespersons to ensure message reach
- DUse of emergency broadcast systems for all internal alerts
Why this is the answer
Key concepts include designating a single point of contact and tailoring messages for different audience segments.
- Question 6Interactive
The code block shows a step in the communication process. Which step is missing from the sequence?
- ARegulatory & Contractual AssessmentCorrect answer
- BSocial Media Monitoring
- CHold Statement Drafting
- DPost-Incident Debrief
Why this is the answer
The process flow from the document includes Regulatory & Contractual Assessment between assembling the communication cell and controlled external release.
Incident Detection and Analysis
10 questions in this domain
- Question 7Single Choice
What is the primary function of a Security Information and Event Management (SIEM) system?
- ACentralised log aggregation and correlationCorrect answer
- BInline blocking of malicious network traffic
- CBehavioural monitoring of endpoints
- DSignature-based detection on endpoints
Why this is the answer
SIEM aggregates and correlates logs from multiple sources; it does not block traffic or monitor endpoints directly.
- Question 8Multiple Select
Which two detection methods are used by Intrusion Detection/Prevention Systems (IDS/IPS)?
- ASignature-based detectionCorrect answer
- BAnomaly-based detectionCorrect answer
- CBehavioural endpoint monitoring
- DLog aggregation and correlation
Why this is the answer
IDS/IPS use signature-based (known patterns) and anomaly-based (baseline deviations) detection. Log correlation is SIEM; endpoint monitoring is EDR.
- Question 9Interactive
Based on the alert shown, which component generated this event?
- AEndpoint Detection and Response (EDR)Correct answer
- BNetwork Intrusion Detection System (NIDS)
- CSecurity Information and Event Management (SIEM)
- DIntrusion Prevention System (IPS)
Why this is the answer
The alert includes process execution and parent-child relations, typical of EDR telemetry. NIDS/IPS focus on packets; SIEM correlates logs.
- Question 10Single Choice
What is the main objective of alert tuning in a SOC?
- AReduce false positive rate while maintaining detection fidelityCorrect answer
- BIncrease the number of alerts to ensure coverage
- CEliminate all alerts below a certain severity threshold
- DReplace signature-based detection with anomaly detection
Why this is the answer
Tuning adjusts thresholds and whitelists to reduce noise (false positives) without missing true threats. Increasing alerts or eliminating all low-severity alerts contradicts effective tuning.
- Question 11Multiple Select
Which two factors are used to assign priority to a security alert during triage?
- AAsset criticality tierCorrect answer
- BAlert severity score
- CNumber of previous similar alerts
- DThreat actor attribution from intelCorrect answer
Why this is the answer
Priority is a business decision based on asset criticality and threat context (e.g., APT involvement). Severity alone is technical; alert volume does not directly set priority.
- Question 12Interactive
The following is a triage decision step. What is the next action after an alert is enriched with threat intelligence?
- AHuman analyst reviewCorrect answer
- BAutomated response execution
- CIncident declaration
- DRule tuning
Why this is the answer
After enrichment, the alert is queued for human review (analyst triage) unless it can be auto-closed. Automated response or incident declaration comes after human confirmation.
- Question 13Single Choice
What is the purpose of applying MITRE ATT&CK mapping to threat intelligence?
- ATo correlate alerts with specific adversary tactics and techniquesCorrect answer
- BTo automatically block all IP addresses from a feed
- CTo reduce the number of false positives
- DTo prioritise incidents by asset criticality
Why this is the answer
ATT&CK mapping allows SOC to understand the attack pattern (tactic/technique) and select appropriate response playbooks. It does not directly block IPs, reduce FPs, or set priority.
- Question 14Multiple Select
Which two aspects are essential for maintaining the admissibility of digital evidence?
- AA documented chain of custodyCorrect answer
- BEvidence collected by any team member
- CUse of software write-blockers only
- DCryptographic hash verificationCorrect answer
Why this is the answer
Chain of custody and hash verification (integrity) are key. Evidence must be collected by trained examiners; hardware write-blockers are preferred over software.
- Question 15Interactive
Based on the order of volatility, which evidence should be captured first?
- AContents of system memory (RAM)Correct answer
- BHard disk images
- CNetwork logs
- DBackup tapes
Why this is the answer
RAM is the most volatile; it must be captured before powering down or disk imaging. The standard order starts with registers, cache, then RAM.
- Question 16Single Choice
What is the primary objective of root cause analysis (RCA) in incident management?
- AIdentify the fundamental underlying cause to prevent recurrenceCorrect answer
- BAssign blame to the responsible individual
- CDocument all technical details of the incident
- DRestore services as quickly as possible
Why this is the answer
RCA seeks the deepest cause that, if fixed, prevents the incident from happening again. Blame assignment is not the goal; restoration is part of incident response, not RCA.
Incident Management Strategy and Governance
8 questions in this domain
- Question 17Single Choice
What is the primary purpose of an incident management policy?
- ADefine step-by-step containment procedures
- BProvide a high-level statement of intent and principlesCorrect answer
- CList all technical tools needed for response
- DAssign individual blame for failures
Why this is the answer
A policy is a high-level statement of intent and principles, not a detailed procedure.
- Question 18Multiple Select
Which of the following are mandatory under GDPR breach notification? (Select two)
- ANotify the supervisory authority within 72 hoursCorrect answer
- BNotify the supervisory authority within 24 hours
- CNotify only if data was encrypted
- DNotify the affected data subjects if high riskCorrect answer
Why this is the answer
GDPR Article 33 requires notification to the supervisory authority within 72 hours and to data subjects if high risk.
- Question 19Interactive
Based on the RACI matrix shown, which role is Accountable for the overall incident response?
- ASOC Analyst
- BIncident ManagerCorrect answer
- CTechnical Lead
- DLegal Counsel
Why this is the answer
The Incident Manager is Accountable for the overall response according to the RACI model.
- Question 20Single Choice
What should be the initial action in a communication plan during an incident?
- ANotify all employees via email
- BContact the CEO directly
- CVerify the incident and assign severityCorrect answer
- DPrepare a press release
Why this is the answer
The first step is to verify the incident and assign severity before any communication is sent.
- Question 21Multiple Select
Which are key components of a post-incident review? (Select two)
- AAssigning blame to individuals
- BRoot cause analysisCorrect answer
- CAction plan developmentCorrect answer
- DIgnoring minor incidents
Why this is the answer
Root cause analysis and action plan development are core components; blame assignment is not a goal.
- Question 22Interactive
According to the decision tree, what must be done for a breached personal data incident with high risk to data subjects?
- ANotify the supervisory authority and the affected data subjectsCorrect answer
- BOnly notify the supervisory authority
- COnly notify law enforcement
- DTake no action as risk is assumed
Why this is the answer
If risk to data subjects is high, both the supervisory authority and data subjects must be notified under GDPR.
- Question 23Single Choice
Which type of trigger is appropriate for escalation in incident management?
- ATime-based triggersCorrect answer
- BPersonal preference of the analyst
- COnly after full containment is achieved
- DWhen the SOC analyst feels overwhelmed
Why this is the answer
Time-based triggers (e.g., 30 minutes without containment) are predefined and objective, reducing ambiguity.
- Question 24Multiple Select
Which stakeholders should be given high priority in a communication plan for a data breach? (Select two)
- AGeneral public
- BLegal counselCorrect answer
- CCompeting businesses
- DRegulatory authoritiesCorrect answer
Why this is the answer
Legal counsel and regulatory authorities are high-priority due to compliance and liability concerns.
Incident Response Execution
12 questions in this domain
- Question 25Single Choice
What are the five phases of the incident response lifecycle according to NIST SP 800-61?
- APreparation, Detection, Containment, Eradication, RecoveryCorrect answer
- BDetection, Containment, Eradication, Recovery, Lessons Learned
- CPreparation, Identification, Isolation, Removal, Restoration
- DPreparation, Analysis, Containment, Remediation, Post-Incident
Why this is the answer
NIST SP 800-61 defines the phases as Preparation, Detection, Containment, Eradication, and Recovery.
- Question 26Multiple Select
Which of the following are examples of short-term containment actions?
- ADisabling a compromised user accountCorrect answer
- BBlocking a malicious IP at the firewallCorrect answer
- CReimaging an infected workstation
- DImplementing network segmentation across the entire site
Why this is the answer
Short-term containment includes immediate actions like disabling accounts and blocking IPs; reimaging and segmentation are long-term.
- Question 27Interactive
Review the following script snippet used during eradication. What is the primary purpose of the 'Remove-Item' command?
- ADeleting malicious registry keysCorrect answer
- BCreating a system restore point
- CInitiating a network scan
- DBacking up log files
Why this is the answer
Remove-Item is a PowerShell cmdlet to delete file system objects; here it removes malicious registry persistence.
- Question 28Single Choice
Which type of incident requires GDPR notification within 72 hours?
- APersonal data breachCorrect answer
- BMalware infection without data loss
- CDDoS attack on a public website
- DInsider threat policy violation
Why this is the answer
GDPR Article 33 requires notification for personal data breaches; other incidents may not involve personal data.
- Question 29Multiple Select
Which teams should the Incident Manager coordinate with during a data breach involving customer PII?
- ALegal counselCorrect answer
- BPublic relationsCorrect answer
- CMarketing department
- DNational cybercrime unitCorrect answer
Why this is the answer
Legal, PR, and law enforcement are key; marketing is not typically part of immediate incident coordination.
- Question 30Interactive
Examine the following log entry. What phase of the incident response lifecycle does this log represent?
- ADetection and AnalysisCorrect answer
- BContainment
- CEradication
- DRecovery
Why this is the answer
The log shows an IDS alert being triggered, which is a detection activity requiring analysis.
- Question 31Single Choice
What is a key deliverable of the Preparation phase?
- AIncident Response Plan (IRP)Correct answer
- BForensic image of affected systems
- CRoot cause analysis report
- DPress release
Why this is the answer
The IRP is developed in the Preparation phase; forensic imaging occurs later, during detection or containment.
- Question 32Multiple Select
Which factors should the Incident Manager consider when selecting a containment strategy?
- ABusiness impact assessmentCorrect answer
- BPreservation of forensic evidenceCorrect answer
- CEase of reimaging the system
- DLegal and regulatory obligationsCorrect answer
Why this is the answer
BIA, evidence preservation, and legal obligations are key; reimaging ease is not a primary containment factor.
- Question 33Interactive
The code below is part of a data breach notification script. What does the 'notify_ico' function trigger?
- ASends a breach report to the Information Commissioner's OfficeCorrect answer
- BInitiates a system recovery
- CBlocks the attacker's IP address
- DLogs the incident in the SIEM
Why this is the answer
The function 'notify_ico' is designed to submit the mandatory GDPR breach notification to the ICO.
- Question 34Single Choice
What is the first step when handling a potential insider threat?
- AEngage Human Resources discreetlyCorrect answer
- BImmediately suspend the employee's accounts
- CNotify law enforcement
- DConduct a public announcement
Why this is the answer
HR involvement ensures proper process; immediate suspension may be premature without investigation.
- Question 35Multiple Select
Which actions are part of the eradication phase?
- ARemoving malware files and registry keysCorrect answer
- BDisabling compromised accountsCorrect answer
- CRestoring data from backups
- DConducting a vulnerability scan to confirm removalCorrect answer
Why this is the answer
Eradication includes removal of artifacts and validation; restoration belongs to recovery phase.
- Question 36Interactive
Examine the incident communication plan snippet. What does the 'LegalHold' status indicate?
- ALegal counsel has placed a preservation order on dataCorrect answer
- BThe incident has been reported to law enforcement
- CPR is preparing a public statement
- DThe technical team is holding back containment actions
Why this is the answer
LegalHold true means legal has instructed that all evidence be preserved; it is a legal preservation order.
Team Leadership and Continuous Improvement
4 questions in this domain
- Question 37Single Choice
What is the primary benefit of psychological safety in an incident response team?
- AIt encourages team members to report errors and challenge decisions without fear.Correct answer
- BIt ensures all team members follow the incident commander's orders without question.
- CIt reduces the need for post-incident reviews.
- DIt allows the team to skip debriefs and focus on technical tasks.
Why this is the answer
Psychological safety creates an environment where team members feel safe to speak up, reducing risks of groupthink and errors.
- Question 38Multiple Select
Which of the following are key steps in the Continuous Improvement Cycle for incident management? (Select two)
- AIdentify Improvement OpportunityCorrect answer
- BAssign blame for failures
- CImplement ImprovementCorrect answer
- DImmediately deploy new tools without testing
Why this is the answer
The cycle includes identifying opportunities and implementing improvements, not assigning blame or untested tool deployment.
- Question 39Interactive
Refer to the code block showing a fragment of an incident report. Which metric is missing from this report to demonstrate continuous improvement?
- AMean Time to Detect (MTTD)Correct answer
- BNumber of team members involved
- CIncident severity score
- DTotal cost of incident
Why this is the answer
MTTD is a key KPI for continuous improvement; it is missing from the report snippet.
- Question 40Single Choice
What is the main purpose of a tabletop exercise for incident management?
- ATest decision-making and communication without touching live systems.Correct answer
- BDeploy actual security patches to production systems.
- CReplace the need for any real incident response plan.
- DEvaluate the technical performance of antivirus tools.
Why this is the answer
Tabletop exercises are discussion-based, focusing on decision-making and communication, not live technical actions.
Frequently asked questions
Everything about the Certified Incident Manager question bank and how to use it.