CISM Question 77

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A3

  This option is correct because the primary purpose of assessing existing incident response processes is to evaluate how well the organization can detect, respond to, and recover from security incidents. It helps identify any gaps, weaknesses, or inefficiencies in the current processes, validating the organization's preparedness and capabilities in handling security incidents effectively.

• Chose A1

  While all the options are valuable aspects of incident response assessments, the primary purpose is to validate and understand the current capabilities of the organization's incident response processes. This involves evaluating the effectiveness of the existing incident response plan, procedures, and team in detecting, responding to, and mitigating security incidents. The assessment may involve benchmarking against industry peers (Option B), prioritizing action plans (Option C), and identifying threats and vulnerabilities (Option D) as part of the overall process. However, the primary goal is to ensure that the organization's incident response processes are effective and aligned with its security objectives. This helps in identifying areas for improvement, addressing gaps, and enhancing the overall incident response capability.

• Chose A2

  A. Validation of current capabilities