Free PECB Certified ISO/IEC 27035 Lead Incident Manager Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified ISO/IEC 27035 Lead Incident Manager practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A contractor reads restricted customer records without authorization. The records remain accurate and accessible. Which information security objective has been breached?

   1. A.Integrity of the records
   2. B.Availability of the records
   3. C.Confidentiality of the recordsCorrect answer: C
   4. D.Authenticity of their origin

   Explanation: NIST states, "A loss of confidentiality is the unauthorized disclosure of information." Unauthorized reading exposes the records. The facts do not establish alteration, disrupted access, or a falsified origin.

   Reference: NIST FIPS 199 — Security Objectives, CONFIDENTIALITY

2. 2A small firm is adopting the ISO/IEC 27035-1 incident-management guidance. How should it account for differences between its operations and those of a large enterprise?

   1. A.Tailor the guidance to its business and risk situationCorrect answer: A
   2. B.Use the large enterprise procedures without adjustment
   3. C.Delay preparation until it has experienced an incident
   4. D.Limit the guidance to incidents affecting large systems

   Explanation: ISO states, "Organizations can adjust the guidance according to their type, size and nature of business in relation to the information security risk situation." Tailoring preserves the process while fitting the organization; the guidance is not restricted to large organizations or post-incident use.

   Reference: ISO/IEC 27035-1:2023 publisher description — Abstract, applicability and adaptation

3. 3An incident-management policy states its objectives but leaves staff unsure whether it covers subsidiaries and cloud-hosted services. Which policy element most directly needs clarification?

   1. A.Incident performance measures
   2. B.Organizational and asset scopeCorrect answer: B
   3. C.Incident severity definitions
   4. D.Management approval authority

   Explanation: NIST lists "Scope of the policy (i.e., to whom and what it applies and under what circumstances)". Subsidiaries and hosted services are applicability boundaries. Measures, definitions and authority answer different policy questions.

   Reference: NIST SP 800-61r3 — 2.3 Incident Response Policies, Processes, and Procedures, scope element

4. 4An incident response plan must identify who oversees response, allocates funding and may authorize shutting down a critical service. Which organizational role is the direct match?

   1. A.Incident evidence custodian
   2. B.Organizational leadershipCorrect answer: B
   3. C.External vulnerability researcher
   4. D.Public communications officer

   Explanation: NIST states, "The organization’s leadership team oversees incident response, allocates funding, and may have decision-making authority on high-impact response actions, such as shutting down or rebuilding critical services.". These oversight, resource and high-impact decision responsibilities belong to leadership in the cited role description. Evidence handling, vulnerability research and communications are different functions.

   Reference: NIST SP 800-61r3 — 2.2 Incident Response Roles and Responsibilities, leader

5. 5A monitoring team is missing real attacks while also overwhelming analysts with benign alerts. What is the appropriate tuning objective?

   1. A.Minimize alert volume even if missed attacks increase
   2. B.Maximize alert volume without considering analyst capacity
   3. C.Reduce false positives and false negatives to acceptable levelsCorrect answer: C
   4. D.Suppress alerts on common activity regardless of attack context

   Explanation: NIST states, "Tune the continuous monitoring technologies to reduce false positives and false negatives to acceptable levels.". Both unnecessary alerts and missed detections matter. Optimizing only volume, or suppressing common activity without context, does not address both error types.

   Reference: NIST SP 800-61r3 — Table 3, DE.CM, R2

6. 6During an ongoing incident, responders identify a useful lesson that another team could apply immediately. How should the timing of sharing generally be handled?

   1. A.Hold all lessons until the incident’s final report is formally approved
   2. B.Wait until every affected system has completed recovery
   3. C.Share the useful lesson promptly rather than routinely deferring it until recovery endsCorrect answer: C
   4. D.Withhold the lesson until an identical incident occurs in another department

   Explanation: NIST states, "The lessons learned during incident response should often be shared as soon as they are identified, not delayed until after recovery concludes.". NIST recommends timely sharing during response when appropriate. Routine deferral until final approval, complete recovery or a repeated incident loses an opportunity to improve ongoing work.

   Reference: NIST SP 800-61r3 — Section 2.1, p.4

7. 7An intruder changes the bank-account number in a stored supplier invoice. Authorized staff can still retrieve it. Which security objective directly concerns the unauthorized change?

   1. A.Confidentiality of the invoice
   2. B.Integrity of the invoiceCorrect answer: B
   3. C.Availability of the invoice
   4. D.Non-repudiation by the supplier

   Explanation: NIST states, "A loss of integrity is the unauthorized modification or destruction of information." Changing the account number compromises integrity. Continued access does not cure the modification, and the question does not concern disclosure or proof of who sent the invoice.

   Reference: NIST FIPS 199 — Security Objectives, INTEGRITY

8. 8A company provides incident-management services to customer organizations. Which statement accurately describes the applicability of ISO/IEC 27035-1 to that company?

   1. A.It applies only to the customers, not the service provider
   2. B.It applies only if the provider owns all affected systems
   3. C.It is also applicable to external incident-management providersCorrect answer: C
   4. D.It replaces the need to agree responsibilities with customers

   Explanation: ISO states, "This document is also applicable to external organizations providing information security incident management services." External service delivery is therefore included. Neither asset ownership nor exclusion of providers follows, and applicability does not erase customer-provider responsibilities.

   Reference: ISO/IEC 27035-1:2023 publisher description — Abstract, applicability and adaptation

9. 9While designing an incident-management program, a manager uses a CSF Organizational Profile to select desired outcomes. What should guide that selection beyond the technology team’s preferences?

   1. A.The outcomes most easily counted by existing tools
   2. B.The outcomes used by the largest unrelated company
   3. C.The outcomes that minimize documentation effort
   4. D.Mission objectives, stakeholder expectations and requirementsCorrect answer: D

   Explanation: NIST says Profiles consider "mission objectives, stakeholder expectations, threat landscape, and requirements." Business context and stakeholder needs guide the selection. Convenience, another company’s size and documentation effort do not substitute for those inputs.

   Reference: NIST Cybersecurity Framework 2.0 — 3.1 CSF Organizational Profiles, purpose

10. 10A team is assigned to verify incidents, collect evidence, prioritize response actions, limit damage and identify root causes. Which role in an incident-response structure matches those duties?

    1. A.Threat intelligence analysts
    2. B.Business continuity plan owners
    3. C.Incident handlersCorrect answer: C
    4. D.Forensic evidence custodians

    Explanation: The authoritative source states, "Incident handlers verify that an incident has occurred, collect and analyze data and evidence, prioritize incident response activities, and act appropriately to limit damage, find root causes, and restore operations.". Incident handlers perform the combined verification, evidence analysis, response prioritization, damage limitation and root-cause duties. Threat intelligence, continuity ownership and evidence custody are adjacent functions with narrower or different purposes.

    Reference: NIST SP 800-61r3 — 2.2 Incident Response Roles and Responsibilities, handler