CISM Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. During a ransomware incident, the response team discovers that the backup server is also encrypted. Which phase of the playbook is MOST impacted?

Accepted Answer

Phase 4: Recovery. Option D is correct because the Recovery phase (Phase 4) is most impacted when the backup server is encrypted during a ransomware incident. Without clean, unencrypted backups, the organization cannot restore systems and data to a known good state, which is the primary goal of the Recovery phase. The encryption of backups directly undermines the ability to recover, forcing the team to consider alternative recovery methods such as decryption keys, offline backups, or system rebuilds.

Answer

Phase 5: Post-Incident

Answer

Phase 3: Eradication

Answer

Phase 2: Containment

Question 2

Order the steps for establishing a security incident response team (IRT).

Question 3

Arrange the steps for performing a vulnerability scan on a network segment.

Question 4

Order the steps for implementing a data classification policy in an organization.

Question 5

Which of the following is the most important factor for ensuring the long-term success of an information security program?

Accepted Answer

Strong support from top management.. Strong support from top management is the most important factor because it ensures the information security program receives adequate budget, organizational authority, and strategic alignment with business objectives. Without executive sponsorship, even the best technical controls can be undermined by resource constraints, policy non-compliance, or lack of cross-departmental cooperation. The CISM framework emphasizes that governance and leadership commitment are foundational to sustaining a security program over time.

Answer

Deployment of advanced security technologies.

Answer

Comprehensive security awareness training.

Answer

Regular penetration testing.

Question 6

Which document should be created FIRST when establishing an information security program?

Accepted Answer

Information security policy. The information security policy is the foundation document that sets the direction, principles, and responsibilities. All other standards, procedures, and guidelines are derived from it.

Answer

Risk assessment report

Answer

Incident response plan

Answer

Business continuity plan

Question 7

An organization has a security program that is aligned with ISO 27001. During an internal audit, it is discovered that several controls are not being applied consistently across all departments. The MOST effective corrective action is to:

Accepted Answer

Establish a centralized security oversight function. The core issue is inconsistent control application across departments, which indicates a lack of governance and oversight rather than a policy or awareness deficiency. Establishing a centralized security oversight function directly addresses this by creating a single authority to enforce, monitor, and standardize control implementation, ensuring alignment with ISO 27001 requirements for management commitment and resource allocation (Clause 5.1 and 7.1). This corrective action provides the necessary organizational structure to drive consistent execution, which is the most effective long-term solution.

Answer

Update the information security policy

Answer

Increase security awareness training frequency

Answer

Conduct a risk assessment for each department

Question 8

An information security manager is developing a program metric to report to senior management. Which metric best demonstrates the effectiveness of the information security program?

Accepted Answer

Mean time to detect (MTTD) security incidents. Mean time to detect (MTTD) is a key indicator of detection capability, directly reflecting program effectiveness. Senior management cares about how quickly threats are identified.

Answer

Number of security incidents reported

Answer

Percentage of systems with up-to-date patches

Answer

Number of security awareness training sessions held

Question 9

Which of the following are key components of a mature information security program? (Select 2)

Accepted Answer

Comprehensive risk management process. A comprehensive risk management process is a foundational component of a mature information security program because it ensures that security controls are aligned with business objectives through systematic identification, assessment, and treatment of risks. This process, often guided by frameworks like ISO 31000 or NIST SP 800-39, enables prioritization of resources based on risk appetite and tolerance, rather than relying on ad-hoc or reactive measures. Without this, the program lacks the structured governance needed to adapt to evolving threats and regulatory requirements.

Answer

Adoption of cloud security tools

Answer

Single point of failure for security decisions

Question 10

Match each information security program component to its primary focus area.

Component: 1. Risk Assessment, 2. Security Awareness Training, 3. Incident Response Plan, 4. Policy Framework

Focus Areas:
A. Human factors and behavior
B. Structured response to events
C. Identification and analysis of threats
D. Governance and compliance requirements

Drag each component to its matching focus area.

Answer

B. Structured response to events

Answer

D. Governance and compliance requirements

Answer

C. Identification and analysis of threats

Answer

A. Human factors and behavior

Question 11

Which of the following is the PRIMARY reason for an information security manager to integrate risk management into the organization's enterprise risk management (ERM) framework?

Accepted Answer

To support informed decision-making by aligning security risks with business objectives. Integrating information security risk into ERM ensures that security risks are considered alongside business risks, enabling better prioritization and resource allocation. This alignment helps the organization make informed decisions that balance risk appetite and business objectives. The primary driver is to support strategic decision-making, not just compliance or reporting.

Answer

To ensure compliance with regulatory requirements

Answer

To provide a consistent risk reporting structure across the enterprise

Answer

To reduce the cost of risk management through shared resources

Question 12

A security analyst reviews the following alert from the SIEM: 'Multiple failed login attempts from IP 10.0.0.5 to the domain controller within 5 minutes.' Which TWO actions should the analyst take as part of initial incident response?

Accepted Answer

Review authentication logs from other servers for similar patterns.. Option B is correct because reviewing authentication logs from other servers for similar patterns helps determine if the failed login attempts are part of a broader brute-force or password-spraying attack targeting multiple systems, not just the domain controller. This lateral analysis is a key initial step in incident response to assess the scope and identify compromised accounts or additional indicators of compromise (IoCs). Option E is correct because verifying whether the source IP belongs to an internal asset is critical to distinguish between an external attacker and a misconfigured internal service or user, which directly impacts the response strategy (e.g., internal remediation vs. external threat containment).

Answer

Block the IP address in the firewall immediately.

Answer

Escalate the alert to the incident response team.

Answer

Reset the password of the targeted account.

Question 13

Which TWO of the following are key components of an information risk management program, as defined by ISACA? (Select exactly two.)

Accepted Answer

Risk appetite and tolerance. Options A and D are correct. Risk appetite and risk assessment are core components. Option B is incorrect: data classification is part of information security governance, not specifically risk management program components. Option C is incorrect: vulnerability scanning is a technical control, not a program component. Option E is incorrect: business continuity planning is a related but separate domain.

Answer

Business continuity plan

Answer

Data classification scheme

Answer

Vulnerability scanning process

Question 14

A security manager is evaluating risk treatment options for a high-risk vulnerability. Drag each option to the correct risk treatment category.

Options:
- Apply a vendor patch
- Purchase cyber insurance
- Decommission the system
- Accept the risk with formal sign-off
- Install a WAF (Web Application Firewall)

Categories:
- Mitigate
- Transfer
- Avoid
- Accept

Question 15

A company is evaluating its risk management process. The CISM notices that risks are being assessed based on qualitative scales (low, medium, high) but decisions require quantitative data. What is the most effective action to improve the process?

Accepted Answer

Use a hybrid approach that includes both qualitative and quantitative assessments.. A hybrid approach (Option B) is most effective because it leverages qualitative scales for initial, rapid risk identification and prioritization, while quantitative data (e.g., ALE, SLE, ARO) provides the monetary rigor needed for cost-benefit analysis and management decisions. This aligns with ISACA's guidance that risk assessment should be tailored to the decision context, not purely one method.

Answer

Switch to a fully quantitative risk assessment methodology.

Answer

Replace qualitative scales with precise monetary values.

Answer

Continue using qualitative method since it is simpler.

CISM Practice Test 11 — 15 Questions

Exhibit

CISM Practice Test 11 — 15 Questions

Exhibit