Try 12 free ISACA CISM practice questions

Answer: D. The existence of a valid, authorized use case is the deciding factor because if the employee had a legitimate business need to access and copy the data, the transfer is an authorized activity and not an incident. Ownership, job role, and audit logs are all relevant supporting details, but none of them determines whether the act itself was authorized. A transfer that lacks a valid business justification meets the threshold for a data leakage incident regardless of the other factors.

• A: Audit logs document what occurred and support investigation, but the presence or absence of log entries does not define whether the activity was authorized or constitutes a leakage event.
• B: Data ownership determines who is responsible for classification and access decisions, but an owner's employee can still have or lack a valid use case independent of ownership status.
• C: Job role is a factor in determining what access is appropriate, but the role alone does not confirm or rule out a valid use case for this specific transfer.

Answer: C. The post-incident review is the purpose-built forum for capturing lessons learned, documenting deficiencies observed during the response, and translating them into actionable plan improvements. At this stage the incident is resolved, the team can reflect without time pressure, and all stakeholders are engaged in a structured improvement process. Updating the plan during an active incident diverts attention from containment and recovery, while waiting for a future tabletop or risk reassessment introduces unnecessary delay.

• A: Modifying the plan mid-incident risks introducing errors under pressure, distracts responders from the immediate priority of containing and recovering from the event, and may invalidate current response actions.
• B: A tabletop exercise is a useful training mechanism but occurs on a separate schedule; delaying plan improvements until the next exercise means operating with known deficiencies in the interim.
• D: A risk reassessment evaluates the risk landscape and may eventually feed into plan revisions, but it is a slower, broader process that is not designed to capture and act on specific operational gaps observed during an incident.

Answer: A. In a cloud-hosted environment the organization and the provider share incident response responsibilities across a split operational boundary. A clearly defined escalation process ensures that when an incident occurs, both parties know exactly when and how to engage each other, which authority level on each side owns which decisions, and how the handoff of information and control occurs. Without defined escalation paths, critical coordination delays occur precisely when speed matters most.

• B: Technical capabilities define what the provider can do but are only useful if there is a coordinated process for activating and directing those capabilities during an actual incident.
• C: Recovery time objectives set performance expectations but address the aftermath of an incident; they do not govern the real-time coordination needed to manage the incident itself.
• D: Audit reports and certifications provide assurance about baseline security posture during vendor selection and oversight reviews but are not a real-time incident response coordination mechanism.