CISM Practice Test 12 — 15 Questions

Question 1

Which TWO of the following are risk treatment strategies as defined in ISO 27005?

Accepted Answer

Risk avoidance. Risk avoidance is a defined risk treatment strategy in ISO 27005 where the organization decides to avoid the risk by not engaging in the activity that gives rise to it, such as discontinuing a service or choosing an alternative technology. Option C is correct because ISO 27005 explicitly lists risk avoidance as one of the four primary risk treatment options (avoidance, reduction, retention, and transfer).

Answer

Risk analysis

Answer

Risk monitoring

Answer

Risk communication

Question 2

A company is implementing a risk management program and needs to identify the most critical assets. Which of the following is the BEST approach to prioritize assets for risk assessment?

Accepted Answer

Assess the business impact of each asset's compromise. The best approach to prioritize assets for risk assessment is to assess the business impact of each asset's compromise because risk management focuses on the potential harm to business objectives, not on financial cost or technical vulnerabilities. Business impact analysis (BIA) evaluates criticality based on factors like revenue loss, regulatory penalties, and operational downtime, directly aligning asset priority with organizational risk appetite.

Answer

Use the asset's purchase value to determine priority

Answer

Perform a vulnerability scan and prioritize based on findings

Answer

Review historical incident reports for each asset

Question 3

After a data breach, the risk manager discovers that the risk assessment for the affected system had not been updated for two years. The organization's risk management policy requires annual reviews. Which of the following is the MOST significant consequence of this noncompliance?

Accepted Answer

Inaccurate risk profile leading to uninformed decisions. C is correct because the primary purpose of a risk assessment is to provide an accurate, current risk profile that informs security decisions and resource allocation. When the assessment is two years out of date, the organization lacks visibility into new threats, vulnerabilities, and changes in the threat landscape, leading to uninformed decisions that can result in security gaps and increased exposure. This directly undermines the risk management process, making it the most significant consequence of noncompliance with the annual review policy.

Answer

Increased audit findings

Answer

Regulatory fines for noncompliance

Answer

Higher insurance premiums

Question 4

An organization is developing a new information security program and wants to ensure it aligns with business objectives. Which of the following is the MOST critical first step?

Accepted Answer

Identify business strategy and risk appetite.. Identifying business strategy and risk appetite is the most critical first step because the information security program must be designed to support the organization's objectives and operate within the risk tolerance defined by leadership. Without this alignment, subsequent security controls and investments may conflict with business goals or fail to address the risks the organization is willing to accept. This ensures that security is a business enabler rather than a technical silo.

Answer

Develop a security awareness training program.

Answer

Design the security architecture based on industry frameworks.

Answer

Conduct a comprehensive risk assessment.

Question 5

Which THREE of the following are best practices for handling evidence during an incident investigation?

Accepted Answer

Document all actions taken during evidence collection.. Documenting all actions taken during evidence collection ensures the integrity and admissibility of evidence in legal proceedings. This documentation, often referred to as a 'paper trail' or 'audit log,' must include timestamps, personnel involved, tools used, and any deviations from standard procedures. Without this, the chain of custody is weakened, and the evidence may be challenged as unreliable or tampered with.

Answer

Analyze evidence directly on live systems to avoid delays.

Answer

Store evidence in its original location to avoid disturbance.

Question 6

An auditor reviews the BYOD policy and notes that mobile device management (MDM) logs show several devices without encryption. The policy has been in effect for 6 months. Which of the following is the most likely reason for this non-compliance?

Accepted Answer

MDM is not configured to enforce encryption automatically. MDM systems can enforce encryption policies automatically by requiring devices to comply before granting access to corporate resources. If the MDM is not configured to enforce encryption, devices will remain non-compliant even if the policy requires encryption. The logs showing several devices without encryption after six months strongly indicate that the MDM is not actively enforcing the encryption requirement, making D the most likely reason.

Answer

The grace period allows non-compliance for 7 days

Answer

Employees are unaware of the encryption requirement

Answer

The policy does not explicitly require encryption

Question 7

Refer to the exhibit. What is most suspicious about this event?

Accepted Answer

The process name svchost.exe running from Temp folder. Svchost.exe is a critical Windows system process that should never run from the Temp folder. Running svchost.exe from %TEMP% is a classic indicator of malware masquerading as a legitimate process, often used to evade detection by security tools that trust the svchost.exe name. This event strongly suggests a malicious binary attempting to blend in with normal system activity.

Answer

The user jdoe is not an administrator

Answer

Event ID 4688 is unusual

Answer

The process ID is too low

Question 8

A company's security program includes a set of controls based on a risk assessment. During an audit, several controls are found to be ineffective. What should the security manager do first?

Accepted Answer

Conduct a root cause analysis to determine why controls failed.. When controls are found ineffective, the security manager must first conduct a root cause analysis to identify why the controls failed. This aligns with the CISM's emphasis on corrective action based on understanding the underlying failure, such as misconfigured firewall rules, outdated signature databases, or improper access control lists (ACLs). Without this analysis, any subsequent remediation (like implementing compensating controls or increasing testing frequency) may address symptoms rather than the actual cause, leading to recurring failures.

Answer

Increase the frequency of control testing.

Answer

Report the findings to management and accept the risk.

Answer

Implement compensating controls immediately.

Question 9

A company is designing a third-party risk management (TPRM) program. Which factor should PRIMARILY determine the tier of a vendor?

Accepted Answer

Type of data accessed and service criticality. Vendor tiering should be based on the risk they pose. Data access and service criticality directly affect organizational risk.

Answer

Vendor's annual revenue

Answer

Length of business relationship

Answer

Contract value

Question 10

An organization is implementing a security champions program. Which of the following is the primary benefit of such a program?

Accepted Answer

Embedding security expertise within development teams. Security champions are advocates embedded in development teams to help integrate security into the development lifecycle, promoting secure development practices.

Answer

Providing 24/7 security monitoring

Answer

Eliminating the need for security awareness training

Answer

Reducing the need for a dedicated security team

Question 11

Which TWO of the following are key components of a security operations center (SOC)? (Select TWO)

Accepted Answer

Incident response. A SOC focuses on monitoring, detection, and response. Vulnerability management and identity management are separate functions.

Answer

Vulnerability scanning

Answer

Identity and access management

Answer

Application security testing

Question 12

A security manager is designing a security awareness program. Which TWO metrics are leading indicators of program effectiveness?

Accepted Answer

Knowledge assessment scores from training.. Leading indicators predict future performance. Phishing click rate and knowledge assessment scores measure current behavior and knowledge, which can predict future incidents.

Answer

Number of security incidents reported by employees.

Answer

Number of phishing emails reported by users.

Answer

Mean time to detect (MTTD) a phishing attack.

Question 13

Which type of incident response exercise involves a facilitated discussion of a hypothetical scenario to review plans and procedures?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based exercise where team members walk through a scenario to identify strengths and gaps.

Answer

Full-scale exercise

Answer

Simulation

Answer

Drill

Question 14

An organization is updating its security policy framework. The current enterprise security policy has not been reviewed in three years. What is the FIRST step in the policy development lifecycle?

Accepted Answer

Conducting a gap analysis. The policy lifecycle begins with a gap analysis to identify deficiencies between current policies and business/regulatory requirements.

Answer

Obtaining legal review

Answer

Training employees on the updated policy

Answer

Drafting the revised policy language

Question 15

An organization is implementing a policy exception management process. Which THREE elements are essential for effective exception handling? (Select THREE.)

Accepted Answer

Periodic review and renewal of exceptions. Effective exception management requires documentation, approval, and periodic review to prevent exceptions from becoming permanent risks.

Answer

Publicizing the exception to all employees

Answer

Automatic expiration of the exception after a defined period