CISM Practice Test 1 — 10 Questions

Question 1

An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)

Accepted Answer

Notify the relevant data protection authority within the required timeframe.. Data breach notification laws (e.g., GDPR Article 33, CCPA) require organizations to notify the relevant data protection authority within a specified timeframe (e.g., 72 hours under GDPR) once the breach is confirmed. This is a mandatory legal obligation in incident response to avoid penalties and demonstrate regulatory compliance.

Answer

Immediately issue a press release without consulting legal.

Answer

Ignore the incident if no customers have complained.

Answer

Delete all system logs to prevent further exposure.

Question 2

When selecting security controls based on NIST SP 800-53, which control family is MOST directly related to protecting the confidentiality of data?

Accepted Answer

Access Control (AC). Access control (AC) family includes controls that restrict access to data, directly protecting confidentiality.

Answer

Identification and Authentication (IA)

Answer

System and Communications Protection (SC)

Answer

Audit and Accountability (AU)

Question 3

Which of the following best describes the primary purpose of an information security program?

Accepted Answer

To manage security risks in alignment with business strategy. The primary purpose of an information security program is to manage security risks in alignment with business strategy, ensuring that security controls and investments support organizational objectives while balancing risk acceptance, mitigation, transfer, and avoidance. This aligns with the CISM framework, which emphasizes that security is a business enabler, not a technical silo. A program that fails to align with business strategy may over-prioritize technical controls, leading to wasted resources or misaligned risk tolerance levels.

Answer

To ensure 100% system availability

Answer

To eliminate all security risks

Answer

To achieve compliance with all applicable regulations

Question 4

Following containment of a ransomware incident, the incident response team is conducting a root cause analysis. Which method involves repeatedly asking 'why' to drill down to underlying causes?

Accepted Answer

5 Whys. The 5 Whys technique is a simple root cause analysis method that iteratively asks 'why' to move from symptoms to root causes.

Answer

Pareto analysis

Answer

SWOT analysis

Answer

Fishbone diagram

Question 5

After a data breach incident, the incident response team must preserve evidence for potential litigation. Which of the following actions should be taken FIRST?

Accepted Answer

Issue a legal hold. Issuing a legal hold ensures that all relevant data is preserved and not deleted, which is the first step in evidence preservation.

Answer

Update the IR plan

Answer

Begin remediation

Answer

Notify law enforcement

Question 6

Which document outlines the overall strategy, roles, and responsibilities for incident response across the organization?

Accepted Answer

Incident response plan. The incident response plan provides the high-level strategy and coordination framework.

Answer

Communication plan

Answer

Incident response policy

Answer

Incident response playbook

Question 7

An organization has just experienced a P1 incident. Which of the following communication steps should occur FIRST?

Accepted Answer

Notify executive leadership. Internal communication, especially to executives, is typically the first priority to ensure leadership is informed.

Answer

Inform customers

Answer

Notify law enforcement

Answer

Issue a media statement

Question 8

Which THREE of the following are typical roles in an incident response team?

Accepted Answer

Security analyst. The IR team includes security analysts, forensic investigators, and legal counsel; the CMT includes executives like CEO; HR is not a standard IR role.

Answer

Human resources manager

Answer

Chief executive officer (CEO)

Question 9

Which TWO of the following are incident categories in an incident management programme?

Accepted Answer

Insider threat. Ransomware and insider threat are defined incident categories; phishing is a technique, not a category; vulnerability is a condition; theft is too broad.

Answer

Theft

Answer

Vulnerability

Answer

Phishing

Question 10

An organization has experienced a ransomware attack that has encrypted critical servers and is causing major business disruption. According to incident severity levels, which priority should this incident be assigned?

Accepted Answer

P1 — Critical. A ransomware attack with major business impact is a critical incident (P1), requiring executive notification and 24/7 response.

Answer

P2 — High

Answer

P4 — Low

Answer

P3 — Medium