CISM Practice Test 10 — 10 Questions

Question 1

An organization is implementing a vendor risk management program. A vendor that provides cloud-based HR services will have access to employee PII. According to industry best practices, what should be the first step in the vendor lifecycle?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a risk assessment of the vendor. The first step in the vendor lifecycle is to perform a risk assessment of the vendor (B). Before any contractual, audit, or documentation requests, the organization must understand the risk the vendor poses based on the data it will access (employee PII) and the criticality of the service. This risk assessment determines the appropriate level of due diligence, contractual controls, and ongoing monitoring — it drives all subsequent steps.

Answer

Include security requirements in the contract

Answer

Request the vendor's SOC 2 report

Answer

Conduct an onsite audit of the vendor

Question 2

An organization is implementing a vendor tiering program for third-party risk management. Which TWO criteria should be used to classify vendors into high, medium, or low risk tiers? (Select TWO)

Accepted Answer

Type and sensitivity of data accessed. Option B is correct because the type and sensitivity of data a vendor accesses directly determines the potential impact of a breach — vendors handling regulated data such as PII, PHI, or PCI cardholder data warrant higher risk tiers than those with no data access. Option D is correct because the criticality of the service provided reflects how much business disruption would occur if the vendor failed, making it a core input to tiering under frameworks like NIST and ISO 31000. Options A, C, and E are not primary tiering criteria: contract length does not indicate inherent risk, annual revenue reflects vendor size rather than the risk it poses to the organization, and geographic location is at most a secondary or contextual factor rather than a defining classification criterion.

Answer

Length of contract

Answer

Vendor's annual revenue

Answer

Vendor's geographic location

Question 3

During a merger, the acquiring company's CISO must integrate the security governance of the target company. The target company has no formal security governance. What is the FIRST step the CISO should take?

Accepted Answer

Perform a comprehensive risk assessment of the target company's security posture.. Without a formal security governance structure, the CISO must first understand the target company's current security posture through a comprehensive risk assessment. This step identifies vulnerabilities, threats, and gaps in controls, providing the baseline data needed to prioritize integration efforts and align with the acquirer's governance framework. Skipping this assessment risks implementing policies that are irrelevant or ineffective against the target's actual risks.

Answer

Conduct a security awareness training for the target company's employees.

Answer

Align the target company's security policies with the acquirer's policies.

Answer

Implement the acquirer's security governance framework immediately.

Question 4

Which TWO of the following are essential components of an incident response (IR) plan? (Select TWO)

Accepted Answer

Communication templates. Communication templates (C) are an essential IR plan component because during an incident responders must notify stakeholders, legal, regulators, and customers quickly and consistently, and pre-approved templates prevent delays and wording errors under pressure. The IR team roster and contact list (E) is also essential because the plan must identify who is on the incident response team and how to reach them (including after-hours and escalation contacts) so the team can be assembled immediately. Detailed network architecture diagrams (B) and vendor risk assessment reports (A) are valuable supporting artifacts for preparation and investigation, but they are not core components of the IR plan itself. A ransomware playbook (D) is a useful specialized procedure, yet it is only one scenario-specific playbook rather than a foundational element required in every IR plan.

Answer

Vendor risk assessment reports

Answer

Detailed network architecture diagrams

Answer

Playbook for ransomware incidents

Question 5

A security analyst detects unusual outbound network traffic from a database server to an unknown IP address. The traffic uses encrypted connections on port 443. Which type of attack is MOST likely occurring?

Accepted Answer

Data exfiltration. The encrypted outbound traffic on port 443 (HTTPS) from a database server to an unknown IP is a classic indicator of data exfiltration. Attackers often use encrypted channels to bypass network security controls, as the contents of the traffic cannot be inspected by DLP or IDS/IPS systems. The database server is a high-value target for sensitive data, making this the most likely attack scenario.

Answer

SQL injection

Answer

Ransomware

Answer

Denial of service

Question 6

A financial institution is restructuring its information security governance to comply with a new regulatory requirement that mandates a formal risk appetite statement. The board has conflicting views on the level of risk to accept. Which of the following should the information security manager do to facilitate the definition of risk appetite?

Accepted Answer

Facilitate a workshop with business leaders to map risk tolerance to strategic goals.. Risk appetite must be aligned with the organization's strategic objectives and business goals, not dictated by external benchmarks or technology metrics alone. Facilitating a workshop with business leaders ensures that risk tolerance is mapped to strategic goals, which is a governance requirement under frameworks like COBIT and ISO 31000. This collaborative approach directly addresses the board's conflicting views by enabling informed, consensus-driven decision-making.

Answer

Recommend adopting the risk appetite levels used by a peer financial institution.

Answer

Draft a risk appetite statement and ask the CISO to approve it on behalf of the board.

Answer

Propose a quantitative risk appetite based on the organization's technology risk metrics.

Question 7

A company's security program includes a policy that all employees must use strong passwords and change them every 90 days. However, the recent internal audit shows that 60% of employees have passwords that do not meet the strength requirements. What is the most effective corrective action?

Accepted Answer

Implement technical controls to enforce password strength. The most effective corrective action is to implement technical controls to enforce password strength. This ensures that all passwords meet the policy requirements by preventing users from setting weak passwords. Technical controls are more reliable than manual audits or training because they automatically enforce compliance and reduce the risk of human error.

Answer

Conduct quarterly password audits with manual checks

Answer

Increase the frequency of security awareness training

Answer

Extend the password change interval to 180 days

Question 8

An incident response team is creating playbooks for different incident types. Which TWO incident types should have a dedicated playbook? (Select TWO.)

Accepted Answer

Ransomware. A dedicated playbook is warranted for ransomware (A) because it requires a specific, time-critical sequence of containment, isolation of encrypted hosts, identification of the ransomware strain, and recovery from known-good backups to avoid paying the ransom. A dedicated playbook is also warranted for a data breach (C) because it triggers distinct legal, regulatory, and forensic obligations such as breach notification timelines, evidence preservation, and coordination with counsel and regulators. Password expiration (B) is a routine, scheduled identity-management task handled by normal operational procedures, not an incident response playbook. Software update failure (D) is a change/problem management issue resolved through rollback or patch remediation rather than incident response. Phishing simulation (E) is a proactive security-awareness exercise, not an actual incident, so it does not require an incident response playbook.

Answer

Password expiration

Answer

Software update failure

Answer

Phishing simulation

Question 9

During a post-incident root cause analysis, the team uses the '5 Whys' technique and identifies a technical vulnerability as the cause. According to CISM best practices, what should be the NEXT level of analysis?

Accepted Answer

Determine the process failure that allowed the vulnerability to go unaddressed.. The '5 Whys' should drill deeper to uncover process and management failures that allowed the technical vulnerability to exist.

Answer

Immediately patch the vulnerability and move on.

Answer

Escalate the issue to the vendor for a software fix.

Answer

Identify the specific employee responsible for the vulnerability.

Question 10

Based on the exhibit, what is the most significant security gap in this configuration?

Accepted Answer

The intrusion detection system is set to alert-only, so it cannot block attacks.. The intrusion detection system (IDS) is configured in alert-only mode, meaning it can only generate alerts and cannot take action to block or drop malicious traffic. This is a significant security gap because, unlike an intrusion prevention system (IPS), an IDS operates out-of-band and relies on manual intervention or separate security controls to stop attacks, leaving the network vulnerable during the response delay.

Answer

The vendor baseline is CIS Level 1, which may be too permissive.

Answer

The firewall allows inbound HTTPS from any source to web servers.

Answer

The database port 3306 is exposed to web servers without encryption.