Isaca Updated CISM Exam Questions and Answers by ignacy

The correct answer is C because incident categorization directly influences how efficiently the organization responds immediately after detection. Categorization helps determine the type of incident, severity, priority, required resources, escalation path, communication requirements, and expected response procedure. Without quick and accurate categorization, responders may waste time deciding who should act, how urgent the situation is, and what containment actions are appropriate. Containment and mitigation are critical response activities, but they depend on proper categorization and prioritization. Root cause analysis is normally performed later to determine why the incident occurred and how to prevent recurrence. Lessons learned are also post-incident activities used to improve future response. CISM incident management emphasizes that detected incidents should be analyzed, classified, prioritized, and escalated based on impact and urgency. This allows the organization to apply the right response playbook quickly and use resources effectively. Therefore, incident categorization most directly improves response efficiency immediately after detection.

Comprehensive and Detailed Step-by-Step Explanation:

Recovering from ransomware requires backups that are unaffected by the ransomware attack. Here ' s why offline backups are most effective:

A. Online backup: These are connected to the network and may also be compromised during an attack.

B. Incremental backup: While efficient, incremental backups rely on previous backups and are typically stored online, making them vulnerable to ransomware.

C. Differential backup: Similar to incremental backups, these are not immune if stored online or on compromised systems.

D. Offline backup: This is the BEST choice as offline backups are stored in a location that is not connected to the network, preventing ransomware from encrypting them.

Complying with regulations regarding notification is the most important reason for an organization to communicate to affected parties that a security incident has occurred, as it helps to avoid legal penalties, fines, or sanctions that may result from failing to notify the relevant authorities, customers, or other stakeholders in a timely and appropriate manner. Additionally, complying with regulations regarding notification may also help to preserve the trust and reputation of the organization, as well as to facilitate the investigation and resolution of the incident.

References = CISM Review Manual 2022, page 3151; CISM Exam Content Outline, Domain 4, Task 4.5