nerdexam
Isaca

CISM · Question #152

Which of the following is MOST important to verify during a test of an organization's incident response process?

The correct answer is A. Whether incident response team members know their responsibilities. During an incident response process test, it is most important to verify that incident response team members know their specific roles and responsibilities. This ensures an organized and effective response to actual security incidents.

Submitted by daniela_cl· Apr 18, 2026Incident Management

Question

Which of the following is MOST important to verify during a test of an organization's incident response process?

Options

  • AWhether incident response team members know their responsibilities
  • BWhether senior management endorses the incident response process
  • CWhether users know which numbers to call in the call tree
  • DWhether incident response team members are cross-trained

How the community answered

(25 responses)
  • A
    80% (20)
  • B
    4% (1)
  • C
    12% (3)
  • D
    4% (1)

Why each option

During an incident response process test, it is most important to verify that incident response team members know their specific roles and responsibilities. This ensures an organized and effective response to actual security incidents.

AWhether incident response team members know their responsibilitiesCorrect

The effectiveness of an incident response process heavily relies on each team member understanding their specific roles, duties, and procedures to follow during an incident. Verifying this knowledge during a test ensures that the team can execute the plan efficiently and cohesively when a real incident occurs, minimizing confusion and delays.

BWhether senior management endorses the incident response process

Senior management endorsement is crucial for plan approval and resource allocation but is not a functional aspect to verify during a test of the process itself.

CWhether users know which numbers to call in the call tree

While important for initial reporting, users knowing call tree numbers is a smaller component compared to the IR team's operational readiness, and the test is of the process, not user knowledge.

DWhether incident response team members are cross-trained

Cross-training is beneficial for resilience but is secondary to ensuring that each team member is proficient in their primary, assigned responsibilities during a test.

Concept tested: Incident response team readiness and role clarity

Source: https://learn.microsoft.com/en-us/compliance/assurance/assurance-incident-response-plan

Topics

#Incident Response Testing#Incident Response Team#Roles and Responsibilities#Process Verification

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CISM Practice