CISM Practice Test 2 — 10 Questions

Question 1

A multinational corporation is assessing the risk of data breaches from third-party vendors. The CISM is tasked with selecting a risk treatment strategy. The organization has a low risk appetite for data breaches. Which strategy should be prioritized?

Accepted Answer

Avoid the risk by not engaging vendors that cannot meet security requirements.. Given the organization's low risk appetite for data breaches, the most appropriate strategy is to avoid the risk entirely by not engaging vendors that cannot meet security requirements. This aligns with the principle that when risk exceeds the acceptable threshold, avoidance is the prioritized treatment. Avoidance eliminates the risk source, whereas other strategies like mitigation or transfer still retain some residual risk that may be unacceptable.

Answer

Mitigate the risk by conducting regular vendor audits.

Answer

Transfer the risk by requiring vendors to have cyber insurance.

Answer

Accept the risk because third-party risks are unavoidable.

Question 2

During a simulated phishing exercise, several employees clicked a link and entered their credentials on a fake login page. The security team needs to determine the impact. Which of the following should be the NEXT step?

Accepted Answer

Reset the affected employees' passwords and enable multi-factor authentication. When credentials are compromised in a phishing attack, the immediate priority is to contain the breach by invalidating the exposed credentials. Resetting the affected employees' passwords and enabling multi-factor authentication (MFA) prevents attackers from using the harvested credentials for unauthorized access, especially if the credentials are reused across other systems. This aligns with the Incident Response phase of containment before moving to eradication or recovery.

Answer

Implement a security awareness training program

Answer

Conduct a forensic analysis of the employees' workstations

Answer

Block the phishing domain at the web proxy

Question 3

Which TWO of the following are best practices for preserving digital evidence during an incident? (Select exactly 2)

Accepted Answer

Create a forensic image of the hard drive using a write blocker. Creating a forensic image with a write blocker (Option A) is a best practice because it captures an exact bit-for-bit copy of the storage media without altering the original data. The write blocker intercepts write commands at the hardware or software level, ensuring the integrity of the evidence. This preserves the original state for later analysis and admissibility in legal proceedings.

Answer

Interview witnesses before collecting data

Answer

Run antivirus scans on the affected system

Answer

Reboot the system to clear memory

Question 4

Based on the SIEM alert exhibit, which immediate action should the incident responder take?

Accepted Answer

Lock the user account 'jsmith'. The SIEM alert indicates a successful brute-force login from source IP 10.0.0.55 to the destination server using the account 'jsmith'. Locking the user account immediately stops the attacker from further exploiting the compromised credentials, which is the most direct containment action. Blocking the IP alone would not prevent re-authentication if the attacker switches IPs, and contacting the user wastes critical time during an active incident.

Answer

Block the source IP 10.0.0.55 at the firewall

Answer

Increase logging level for the destination server

Answer

Contact the user 'jsmith' to verify activity

Question 5

During an incident investigation, the security team discovers that an attacker exfiltrated sensitive customer data via encrypted DNS tunneling over a period of three months. The data loss was only noticed after a routine audit. Which of the following weaknesses MOST likely allowed the attacker to remain undetected for so long?

Accepted Answer

Inadequate monitoring of DNS traffic for anomalies. The correct answer is A because DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.

Answer

Weak password policies

Answer

Unpatched web server software

Answer

Lack of data-at-rest encryption

Question 6

During an incident, the response team collects volatile data from a compromised server. Which of the following should be collected FIRST to minimize loss of evidence?

Accepted Answer

Contents of RAM. Volatile data, such as the contents of RAM, is lost when a system is powered off. The first priority during incident response is to capture this data because it contains running processes, network connections, encryption keys, and malware that exist only in memory. Collecting RAM first ensures that this critical evidence is preserved before any other actions that might alter the system state.

Answer

Contents of hard drive

Answer

Event logs

Answer

Network configuration

Question 7

Which TWO of the following are key indicators of a potential insider threat incident? (Select exactly 2)

Accepted Answer

A user accessing large volumes of data not related to their job function. Option C is correct because a user accessing large volumes of data unrelated to their job function is a classic behavioral anomaly indicating potential data exfiltration. This pattern often precedes an insider threat incident, as the user may be collecting sensitive information for unauthorized purposes, such as selling it or using it for personal gain. Security information and event management (SIEM) systems typically flag such access based on deviations from baseline user behavior, triggering further investigation.

Answer

Multiple failed login attempts from an external IP address

Answer

An increase in network traffic to a known malicious domain

Answer

A user updating their password as required by policy

Question 8

A multinational corporation has just detected a ransomware attack that encrypted critical files on a file server. The incident response team has been activated. Which of the following should be the FIRST action taken by the team?

Accepted Answer

Isolate the affected systems from the network. The first priority in ransomware incident response is containment to prevent the encryption from spreading to other systems. Isolating the affected file server from the network (e.g., disabling the network interface or disconnecting the cable) stops the ransomware from communicating with its command-and-control server and encrypting additional shares. This aligns with the NIST SP 800-61 containment strategy and ensures that the incident response team can safely preserve forensic evidence before any remediation.

Answer

Restore encrypted files from backup

Answer

Reboot the file server to clear the encryption

Answer

Notify law enforcement

Question 9

After a security incident, the incident response team prepares a report detailing the root cause, impact, and lessons learned. Who is the PRIMARY audience for this report?

Accepted Answer

Senior management and the board of directors. The primary audience for a post-incident report detailing root cause, impact, and lessons learned is senior management and the board of directors. They require this information to make strategic decisions about risk acceptance, resource allocation for remediation, and to fulfill fiduciary duties regarding cybersecurity governance. The report provides the business context and financial impact necessary for executive-level oversight, not the technical details needed by operational teams.

Answer

The affected users

Answer

The IT support team

Answer

External auditors

Question 10

Which TWO actions are appropriate during the containment phase of an incident involving a malware outbreak on multiple workstations?

Accepted Answer

Isolate infected workstations from the network. Option C is correct because isolating infected workstations from the network is a primary containment action that prevents the malware from spreading laterally to other systems, limiting the scope of the incident. This is typically achieved by disconnecting network cables, disabling switch ports, or using network access control (NAC) to quarantine the affected hosts, which stops further propagation without destroying forensic evidence.

Answer

Contact all users to warn them about the malware

Answer

Reimage all affected workstations immediately

Answer

Notify customers about potential data breach