exam questions

Exam CISM All Questions

View all questions & answers for the CISM exam

Exam CISM topic 1 question 896 discussion

Actual exam question from Isaca's CISM
Question #: 896
Topic #: 1
[All CISM Questions]

Which of the following is the PRIMARY reason to conduct a post-incident review?

  • A. To determine whether digital evidence is admissible
  • B. To notify regulatory authorities
  • C. To improve the response process
  • D. To aid in future risk assessments
Show Suggested Answer Hide Answer
Suggested Answer: С 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Soleandheel
3 months, 2 weeks ago
C. To improve the response process
upvoted 1 times
...
koala_lay
4 months, 3 weeks ago
Selected Answer: C
The correct answer is C. To improve the response process. A post-incident review, also known as a post-mortem or after-action review, is conducted after an incident or event to assess what happened, identify lessons learned, and improve future incident response. While all the options listed are important considerations after an incident, the primary reason for conducting a post-incident review is to improve the response process. During a post-incident review, the organization involved in the incident analyzes the incident's causes, response effectiveness, and any gaps or shortcomings in their procedures, systems, or training. By identifying areas for improvement, organizations can make adjustments to their incident response plans, enhance their security measures, and better prepare for future incidents.
upvoted 1 times
...
richck102
5 months, 1 week ago
Selected Answer: C
C. To improve the response process
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago