Isaca Updated CISM Exam Questions and Answers by tadhg

= Disconnecting the device from the network is the first step when an IoT device in an organization’s network is confirmed to have been hacked, as it prevents the attacker from further compromising the device or using it as a pivot point to attack other devices or systems on the network. Disconnecting the device also helps preserve the evidence of the attack for later forensic analysis and remediation. Disconnecting the device should be done in accordance with the incident response plan and the escalation procedures123. References =

1: CISM Review Manual 15th Edition, page 2004

2: CISM Practice Quiz, question 1072

3: IoT Security: Incident Response, Forensics, and Investigations, section “IoT Incident Response”

= Initiating the organization’s incident response process is the best course of action for the information security manager when a cloud application used by the organization is found to have a serious vulnerability. The incident response process is a set of predefined steps and procedures that aim to contain, analyze, resolve, and learn from security incidents. The information security manager should follow the incident response process to ensure that the vulnerability is properly reported, assessed, mitigated, and communicated to the relevant stakeholders. The incident response process should also involve the cloud service provider (CSP) and the business owner of the application, as they are responsible for the security and functionality of the cloud application. Instructing the vendor to conduct penetration testing, suspending the connection to the application in the firewall, and reporting the situation to the business owner of the application are all possible actions that may be taken as part of the incident response process, but they are not the best initial course of action. Penetration testing may help to identify the root cause and the impact of the vulnerability, but it may also cause further damage or disruption to the cloud application. Suspending the connection to the application in the firewall may prevent unauthorized access or exploitation of the vulnerability, but it may also affect the availability and continuity of the cloud application. Reporting the situation to the business owner of the application is an important step to inform them of the risk and the potential business impact, but it is not sufficient to address the vulnerability and its consequences. Therefore, the information security manager should initiate the incident response process as the best course of action, and then perform the other actions as appropriate based on the incident response plan and the risk assessment. References = CISM Review Manual 2023, page 211 1; CISM Practice Quiz 2

The best way to improve an organization’s ability to detect and respond to incidents is to conduct periodic awareness training (C). From a CISM incident management perspective, people are often the first line of detection. Employees, help desk staff, and operational personnel are frequently the first to notice unusual behavior, system anomalies, phishing attempts, or policy violations. Regular awareness training equips them with the knowledge to recognize indicators of compromise and escalate incidents promptly, which directly improves both detection and response times.

A security gap analysis (A) identifies deficiencies in controls but does not improve real-time detection or response capability. A business impact analysis (B) focuses on prioritizing recovery and resilience, not incident identification or handling. Network penetration testing (D) is a preventive and diagnostic activity that helps identify vulnerabilities but does not enhance operational response once an incident occurs.

CISM emphasizes that effective incident management depends on clear roles, defined escalation paths, and continuous awareness across the organization. Periodic training reinforces incident reporting criteria, response procedures, and accountability, thereby strengthening the organization’s overall incident detection and response capability.

Continuous monitoring is the most effective way to identify changes in an information security environment, as it provides ongoing awareness of the security status, vulnerabilities, and threats that may affect the organization’s information assets and risk posture. Continuous monitoring also helps to evaluate the performance and effectiveness of the security controls and processes, and to detect and respond to any deviations or incidents in a timely manner. (From CISM Review Manual 15th Edition and NIST Special Publication 800-1371)