CISM Practice Test 1 — 10 Questions

Question 1

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Accept the risk because the control is not cost-justified.. The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.

Answer

Accept the risk because ALE after control is only $2,500.

Answer

Implement the control because it reduces ALE to $2,500.

Answer

Implement the control because ALE is $10,000, and control cost is only $12,000.

Question 2

A financial institution uses CIS Controls v8 and must prioritize implementation. The organization has limited resources and high exposure to ransomware. Which implementation group should be addressed FIRST?

Accepted Answer

Implementation Group 1 (IG1). CIS Controls v8 Implementation Group 1 (IG1) represents the foundational cyber hygiene controls that every organization — especially those with limited resources and high ransomware exposure — should implement first. IG1 controls are designed to be achievable with minimal expertise and cover the most impactful safeguards like inventory, patching, and access control. Prioritizing IG1 ensures the organization closes the most exploitable gaps before moving to IG2 and IG3.

Answer

All groups simultaneously

Answer

Implementation Group 3 (IG3)

Answer

Implementation Group 2 (IG2)

Question 3

A technology startup has grown rapidly and its risk management practices are informal. The CEO has a very high risk appetite and frequently overrides risk management recommendations to accelerate product launches. After a serious data breach involving customer payment information, the board of directors demands a formal risk management program. The risk manager is tasked with changing the risk culture. The startup has limited resources but must meet contractual obligations to protect customer data. What is the most effective first step?

Accepted Answer

Develop and communicate a revised risk appetite statement approved by the board. Developing and communicating a revised risk appetite statement approved by the board directly addresses the need to formalize risk management and change the risk culture. It provides clear guidance for decision-making, aligns with the board's demands, and respects the startup's limited resources by focusing on policy first. Other options are premature: deploying technical controls without policy support may be ineffective, outsourcing does not change internal culture, and terminating the CEO is an HR action that does not establish a risk program.

Answer

Outsource all information security operations to a managed service provider

Answer

Immediately deploy a suite of technical security controls

Answer

Recommend the termination of the CEO for previous risk decisions

Question 4

An organization has a mature security program with documented policies and standards. However, during a recent audit, it was found that several business units are not following the mandated data classification standard. What is the MOST likely root cause?

Accepted Answer

Lack of enforcement mechanisms. A mature security program with documented policies and standards indicates that the classification rules are already defined. The audit finding that business units are not following the mandated standard points to a failure in enforcement mechanisms—such as automated Data Loss Prevention (DLP) rules, access control policies, or mandatory labeling in SharePoint—rather than a lack of awareness or outdated policy. Without enforcement (e.g., Group Policy Objects blocking unclassified data uploads or SIEM alerts for missing classification tags), even well-trained staff may bypass the standard.

Answer

Inadequate security awareness training

Answer

Outdated data classification policy

Answer

Insufficient budget for security tools

Question 5

A financial services firm has a mature information security program but is struggling to demonstrate the value of security investments to the board. Which metric would BEST communicate the effectiveness of the security program in business terms?

Accepted Answer

Reduction in average cost per security incident over the past year.. The reduction in average cost per security incident directly translates security program outcomes into financial terms that resonate with the board. This metric demonstrates the program's effectiveness by quantifying the monetary value of improved prevention, detection, and response capabilities, aligning with the CISM focus on governance and business alignment.

Answer

Number of security alerts triaged per day.

Answer

Time to patch critical vulnerabilities.

Answer

Percentage of systems with endpoint protection installed.

Question 6

A CISO is developing a multi-year security roadmap. Which of the following should be the PRIMARY driver for prioritizing initiatives?

Accepted Answer

Alignment with business strategy and risk appetite. The primary driver for prioritizing security initiatives in a multi-year roadmap should be alignment with business strategy and risk appetite. This ensures that security investments support business objectives and address the most significant risks to the organization. Other factors like ease of implementation or cost are secondary considerations that should be evaluated within the context of strategic alignment.

Answer

Ease of implementation

Answer

Availability of new technology

Answer

Cost of the initiative

Question 7

A large financial institution is maturing its information security program and wants to move from a reactive to a proactive posture. Which of the following initiatives would best support this transition?

Accepted Answer

Establish a threat intelligence unit that analyzes adversary tactics and shares indicators across the organization.. Establishing a threat intelligence unit directly supports a proactive posture by enabling the organization to anticipate and prepare for emerging threats based on adversary tactics, techniques, and procedures (TTPs). Unlike reactive measures, this initiative shifts focus from responding to incidents to preventing them by sharing actionable indicators across the enterprise, aligning with the CISM goal of maturing the security program toward proactive risk management.

Answer

Deploy an automated compliance monitoring tool.

Answer

Implement a bug bounty program to uncover vulnerabilities.

Answer

Increase the number of security operations center (SOC) analysts.

Question 8

After a data breach involving customer PII, the incident response team is conducting a root cause analysis. Which THREE factors should be examined according to CISM best practices? (Select THREE.)

Accepted Answer

The management or governance failure that allowed the process failure.. According to CISM best practices, root cause analysis after a data breach should focus on systemic and organizational factors rather than individuals or financial impacts. Option A is correct because governance failures—such as inadequate security policies, missing oversight, or lack of executive accountability—are root causes that enable process and control breakdowns. Option D is correct because identifying the specific technical vulnerability (e.g., an unpatched CVE, misconfigured firewall rule, or weak authentication mechanism) explains how the breach was technically possible. Option E is correct because the process failure (e.g., absent patch management, ineffective change control, or missing vulnerability scanning) is the underlying reason the vulnerability was allowed to persist. Option B is not a root cause factor; cost is a business impact metric used for post-incident evaluation, not causal analysis. Option C is incorrect because blaming a specific employee who clicked a phishing email addresses a symptom, not the systemic root cause, and CISM emphasizes examining control failures rather than individual blame.

Answer

The cost of the breach to the organization.

Answer

The specific employee who clicked the phishing email.

Question 9

An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)

Accepted Answer

Notify the relevant data protection authority within the required timeframe.. Data breach notification laws (e.g., GDPR Article 33, CCPA) require organizations to notify the relevant data protection authority within a specified timeframe (e.g., 72 hours under GDPR) once the breach is confirmed. This is a mandatory legal obligation in incident response to avoid penalties and demonstrate regulatory compliance.

Answer

Immediately issue a press release without consulting legal.

Answer

Ignore the incident if no customers have complained.

Answer

Delete all system logs to prevent further exposure.

Question 10

A multinational organization handles personal data of EU residents. Which regulatory requirement must the information security program address?

Accepted Answer

GDPR. GDPR applies to any organization processing personal data of EU residents, regardless of location.

Answer

SOX

Answer

PCI DSS

Answer

HIPAA