CISM Practice Test 12 — 15 Questions

Question 1

Which control framework is most appropriate for an organization that wants a prioritized set of controls based on implementation groups (IG1, IG2, IG3)?

Accepted Answer

CIS Controls v8. CIS Controls v8 is uniquely structured around Implementation Groups (IG1, IG2, IG3), which prioritize safeguards based on organizational size, resources, and risk. No other major framework uses this exact IG tiering model. The question's mention of 'prioritized set of controls based on implementation groups' is a direct signature of CIS Controls v8.

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Question 2

Which of the following best describes the primary purpose of an Information Security Program?

Accepted Answer

To align security efforts with business objectives and manage risk.. The primary purpose of an Information Security Program is to align security efforts with business objectives and manage risk to an acceptable level. This ensures that security investments and activities directly support the organization's mission, rather than operating in isolation. A program focused solely on compliance or technical controls may fail to address the dynamic risk landscape and business needs.

Answer

To reduce the number of security incidents to zero.

Answer

To ensure compliance with all relevant laws and regulations.

Answer

To implement technical security controls across all systems.

Question 3

An organization is updating its incident response playbook after a ransomware attack. Which of the following should be included as a key step in the ransomware playbook?

Accepted Answer

Isolate affected systems from the network. Ransomware playbooks should include isolating infected systems to prevent spread, as containment is a priority.

Answer

Reboot all servers to clear the ransomware

Answer

Immediately pay the ransom demand

Answer

Notify all customers immediately

Question 4

Which role in the incident response team structure is responsible for coordinating all response activities and making decisions about incident severity classification?

Accepted Answer

Incident response manager. The IR manager leads the team, coordinates activities, and classifies incidents based on severity.

Answer

Communications lead

Answer

Security analysts

Answer

Forensic investigators

Question 5

An incident response team is handling a supply chain compromise that has affected a critical business process. The estimated recovery time exceeds the maximum tolerable downtime (MTD). What should the incident manager do NEXT?

Accepted Answer

Escalate to the BC/DR team and the authority who can declare a disaster. When MTD is exceeded, the incident escalates to business continuity/disaster recovery activation. The BC/DR decision authority should be notified to declare a disaster and activate recovery plans.

Answer

Notify affected customers of the expected delay

Answer

Continue containment efforts and hope for a faster recovery

Answer

Shut down the affected system to prevent further impact

Question 6

A security analyst detects a series of failed login attempts followed by a successful login from an unusual geographic location. The account is a standard user account. Which incident category best describes this scenario?

Accepted Answer

Account compromise. The scenario describes an account compromise where credentials are likely stolen and used to gain unauthorized access.

Answer

Data breach

Answer

Supply chain attack

Answer

Insider threat

Question 7

An organization has just experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification within 72 hours of becoming aware of the breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 8

Which of the following is the primary reason for conducting a lessons learned meeting after an incident?

Accepted Answer

To update the IR plan and playbooks. The lessons learned meeting aims to identify improvements to the incident response process.

Answer

To document the incident for insurance

Answer

To satisfy regulatory requirements

Answer

To assign blame

Question 9

An organization is required to report a material cybersecurity incident to the SEC within 4 business days (proposed rule). However, the incident is still under investigation. What is the BEST course of action?

Accepted Answer

File a report with the information available and provide updates as the investigation progresses.. Regulatory deadlines must be met even if information is incomplete; disclose what is known and update later.

Answer

Request an extension from the SEC because the investigation is ongoing.

Answer

Delay reporting until the investigation is complete to ensure accuracy.

Answer

Report the incident only if materiality is confirmed at the end of the investigation.

Question 10

Which THREE of the following are objectives of a lessons learned meeting after an incident? (Select three.)

Accepted Answer

Determine what worked well and what did not. Option A is correct because a lessons learned (post-incident) meeting evaluates the incident response to determine what worked well and what did not, so successful practices can be reinforced and gaps addressed. Option D is correct because the meeting's output includes recommendations for improvement, such as updating procedures, controls, or training to prevent recurrence or improve future response. Option E is correct because identifying what happened during the incident — reconstructing the timeline, root cause, and scope — is a core objective that grounds the analysis and subsequent recommendations. Option B is not an objective; lessons learned meetings are blameless and focus on process improvement rather than assigning fault. Option C is not an objective of the meeting itself; sharing indicators of compromise with an ISAC is a separate threat-intelligence activity that may occur, but it is not a stated goal of the lessons learned session.

Answer

Assign blame for the incident

Answer

Share indicators of compromise with an ISAC

Question 11

Which of the following is typically a member of the crisis management team (CMT) during a major cybersecurity incident?

Accepted Answer

Chief executive officer (CEO). The CMT includes senior leaders such as the CEO, CFO, CISO, General Counsel, and Communications head to handle strategic decisions and external communications.

Answer

Security operations center (SOC) analyst

Answer

Help desk manager

Answer

External forensics investigator

Question 12

Which capability maturity model (CMM) level indicates that security processes are proactively measured and optimized?

Accepted Answer

Level 5 (Optimizing). Level 5 (Optimizing) focuses on continuous improvement through quantitative measurement.

Answer

Level 4 (Managed)

Answer

Level 2 (Repeatable)

Answer

Level 3 (Defined)

Question 13

An organization has implemented a new security policy requiring multi-factor authentication for all remote access. Several users complain about the inconvenience. What is the BEST course of action for the security manager?

Accepted Answer

Provide training on the importance of MFA. Providing training helps users understand the necessity of MFA for security, addressing their concerns and gaining buy-in. Allowing exceptions (A) weakens security, delaying implementation (B) postpones protection, and revoking access (C) is too punitive as a first step.

Answer

Allow exceptions for senior executives

Answer

Delay implementation until user acceptance improves

Answer

Revoke remote access for non-compliant users

Question 14

Which THREE of the following are common challenges in implementing an information security program across a large enterprise?

Accepted Answer

Cultural resistance to security controls from business units.. Cultural resistance to security controls from business units is a common challenge because security teams must balance risk mitigation with operational efficiency. Business units often perceive controls like mandatory encryption or access restrictions as hindrances to productivity, leading to shadow IT or workarounds that undermine the program's effectiveness.

Answer

Overreliance on automated security tools.

Answer

Lack of security awareness training for end users.

Question 15

A CISO is building a business case for a new security tool. Which approach BEST quantifies the value of the investment?

Accepted Answer

Risk reduction value and breach cost avoidance. Quantifying security investment value requires translating risk reduction into financial terms — expected breach cost avoidance. This aligns security spending with business risk appetite and demonstrates ROI in language executives understand. It is the most rigorous, business-aligned approach for a CISO's business case.

Answer

Industry analyst recommendations

Answer

Number of features compared to competitors

Answer

Total cost of ownership (TCO) analysis