CISM Practice Test 10 — 10 Questions

Question 1

A security manager is measuring the security culture of the organization. Which three metrics are most appropriate?

Accepted Answer

Phishing simulation click rate. These metrics directly reflect employee behavior and the effectiveness of the security culture program.

Answer

Security budget as percentage of IT budget

Answer

Number of security policies published

Question 2

An organization is updating its security governance framework. Which three elements are essential for ensuring board-level oversight?

Accepted Answer

Board-level risk committee review of security posture. These three elements ensure the board can fulfill its oversight role effectively.

Answer

Security awareness training for board members

Answer

CISO reporting directly to the CEO

Question 3

Which TWO actions are appropriate during the containment phase of an incident involving a malware outbreak on multiple workstations?

Accepted Answer

Isolate infected workstations from the network. Isolating infected workstations from the network is a primary containment action that prevents the malware from spreading laterally to other systems, limiting the scope of the incident. This is typically achieved by disconnecting network cables, disabling switch ports, or using network access control (NAC) to quarantine the affected hosts, which stops further propagation without destroying forensic evidence.

Answer

Contact all users to warn them about the malware

Answer

Reimage all affected workstations immediately

Answer

Notify customers about potential data breach

Question 4

Acme Corp, a global manufacturer, has a decentralized security governance model. Each business unit manages its own security, resulting in inconsistent policies and repeated audit findings. The new CISO proposes a federated model where a central team sets minimum standards and each unit can add local controls. However, the European unit's head insists on full autonomy due to GDPR strictness. The board is concerned about compliance costs. What should the CISO do first?

Accepted Answer

Conduct a risk assessment to identify where local controls are truly needed. Conducting a risk assessment will identify where local controls are truly necessary and justify the federated model. Option A ignores local concerns. Option B undermines the federation goal. Option D is a tactical fix, not strategic.

Answer

Implement the federated model immediately and require all units to comply

Answer

Allow the European unit to keep full autonomy while others follow the model

Answer

Hire a GDPR expert for the European unit

Question 5

You are the information security manager for a mid-sized e-commerce company with 500 employees. The company recently experienced a data breach where an attacker exploited a vulnerability in a third-party payment processing API, resulting in the exposure of 10,000 customer credit card numbers. The breach was detected by an external forensics team 90 days after the initial compromise. The board is concerned about the company's ability to detect and respond to incidents. Currently, the company has a part-time security team of three people who focus on firewall management and antivirus updates. There is no formal incident response plan, and security monitoring is limited to basic log review once a week. The CISO has asked you to recommend a course of action to improve the security posture, with a focus on governance and oversight. Which of the following is the BEST course of action?

Accepted Answer

Develop and implement an incident response plan, establish a security operations center (SOC) with 24/7 monitoring, and define clear roles and responsibilities.. The core governance issue is the lack of a formal incident response plan and adequate monitoring. Establishing a SOC with 24/7 monitoring directly addresses the 90-day detection gap, while defining roles and responsibilities ensures accountability and oversight, which are key governance principles. This approach aligns with the CISM focus on establishing processes and oversight rather than just deploying technology.

Answer

Immediately implement a PCI DSS compliance program to ensure all payment data handling meets industry standards.

Answer

Purchase and deploy a next-generation firewall and endpoint detection and response (EDR) tools across the network.

Answer

Outsource all security operations to a managed security service provider (MSSP) with a focus on threat intelligence.

Question 6

Which TWO of the following are common approaches to information security risk assessment?

Accepted Answer

Qualitative. Qualitative risk assessment uses subjective ratings (e.g., high, medium, low) based on expert judgment to evaluate the likelihood and impact of risks. It is a common approach because it is quick to perform and does not require precise numerical data, making it suitable for initial risk prioritization in information security management.

Answer

Penetration testing

Answer

Vulnerability assessment

Answer

Business impact analysis

Question 7

A financial institution is restructuring its information security governance to comply with a new regulatory requirement that mandates a formal risk appetite statement. The board has conflicting views on the level of risk to accept. Which of the following should the information security manager do to facilitate the definition of risk appetite?

Accepted Answer

Facilitate a workshop with business leaders to map risk tolerance to strategic goals.. Risk appetite must be aligned with the organization's strategic objectives and business goals, not dictated by external benchmarks or technology metrics alone. Facilitating a workshop with business leaders ensures that risk tolerance is mapped to strategic goals, which is a governance requirement under frameworks like COBIT and ISO 31000. This collaborative approach directly addresses the board's conflicting views by enabling informed, consensus-driven decision-making.

Answer

Recommend adopting the risk appetite levels used by a peer financial institution.

Answer

Draft a risk appetite statement and ask the CISO to approve it on behalf of the board.

Answer

Propose a quantitative risk appetite based on the organization's technology risk metrics.

Question 8

An organization is required to notify regulators of a material cybersecurity incident within 4 business days. Which regulation imposes this requirement?

Accepted Answer

SEC proposed rules. The SEC's proposed rules (now final) require publicly traded companies to report material cybersecurity incidents on Form 8-K within 4 business days of determining materiality. This is a specific U.S. securities regulation, not a privacy or payment card standard, and it directly mandates the 4-business-day notification window for material incidents.

Answer

California Consumer Privacy Act (CCPA)

Answer

GDPR

Answer

PCI DSS

Question 9

Which THREE of the following are essential elements of a forensic evidence handling procedure to ensure admissibility in court?

Accepted Answer

Placing a legal hold on relevant data. A legal hold is essential because it suspends the normal data retention and deletion policies, ensuring that potentially relevant evidence is preserved from alteration or destruction. This is a foundational step in the e-discovery process and directly supports the admissibility of evidence by demonstrating that the organization took proactive steps to prevent spoliation.

Answer

Performing analysis directly on original systems

Answer

Using automated tools without validation

Question 10

Which THREE of the following should be included in an incident communication template?

Accepted Answer

Affected systems or data. Communication templates should include the incident description, affected parties, and guidance on actions to take. Technical details and attacker attribution are not typically included in templates.

Answer

Technical indicators of compromise (IoCs)

Answer

Attribution of the attacker