CISM Practice Test 13 — 15 Questions

Question 1

A user reports that their computer is behaving oddly, and an IT technician finds a suspicious file in the startup folder. The technician is not sure if this is an incident. What should the technician do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Escalate to the security team. When unsure, the best practice is to escalate to the security team to investigate further. Deleting the file could destroy evidence, and scanning may not be sufficient. Option B is correct.

Answer

Document the findings and continue monitoring

Answer

Run an antivirus scan

Answer

Delete the suspicious file

Question 2

An organization is subject to GDPR and experiences a data breach involving personal data. What is the maximum timeframe to notify the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification within 72 hours of becoming aware of the breach.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 3

Refer to the exhibit. An information security manager reviews the risk register and sees that Risk ID R001 has a residual risk of High with a treatment of Accept. Which of the following best explains why this situation may indicate a governance failure?

Accepted Answer

Accepting a high residual risk likely exceeds the board-approved risk appetite.. Accepting a high residual risk means the organization has decided to tolerate a level of risk that likely exceeds the board-approved risk appetite. This is a governance failure because the board sets the risk appetite, and management must ensure that all accepted risks fall within that threshold. If the residual risk is high and the treatment is 'Accept,' it indicates a disconnect between the risk acceptance process and the governance framework.

Answer

The risk register should not contain risks with residual risk above low.

Answer

The control effectiveness rating of 'Partially effective' is too vague.

Answer

The risk owner should be a business unit head, not the CISO.

Question 4

An information security manager needs to justify a budget increase. Which approach would be MOST effective for gaining executive approval?

Accepted Answer

Present ROI analysis showing breach avoidance savings. Executives respond to financial justification. ROI based on breach avoidance demonstrates value in monetary terms.

Answer

List all planned technology purchases

Answer

Describe the latest cyber threats

Answer

Show industry benchmarks for security spending

Question 5

Which of the following is the PRIMARY purpose of having a pre-established contract with a digital forensics firm before an incident occurs?

Accepted Answer

To reduce the time required to engage the firm during an incident. The primary purpose of a pre-established contract with a digital forensics firm is to eliminate procurement delays during an incident. When an incident occurs, time is critical; having a signed contract in place allows the firm to be engaged immediately without waiting for legal or administrative approvals, which directly supports the incident response goal of minimizing damage and preserving evidence.

Answer

To ensure attorney-client privilege is automatically applied

Answer

To ensure the firm is available 24/7

Answer

To guarantee a discounted rate

Question 6

Which of the following are key components of an information security program? (Select TWO)

Accepted Answer

A set of security policies and standards. A set of security policies and standards is a key component because it establishes the governance framework that defines acceptable use, access control, and compliance requirements for the entire organization. Without documented policies and standards, the security program lacks the authoritative baseline to enforce controls or measure effectiveness. These documents are the foundation for all other security activities, including training, audits, and incident response.

Answer

A network architecture diagram

Answer

An incident response log

Question 7

During a major cybersecurity incident, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Accepted Answer

Declare a disaster and activate the BC/DR plan. When an incident cannot be resolved within the MTD, the organization has exceeded its tolerance for downtime, which qualifies as a disaster. The next step is to declare a disaster and activate the Business Continuity/Disaster Recovery (BC/DR) plan to restore critical operations through alternate means.

Answer

Conduct a root cause analysis

Answer

Notify the executive sponsor and continue response efforts

Answer

Increase the number of incident responders

Question 8

An organization is updating its incident response plan after a lessons learned meeting. Which of the following is the primary purpose of updating the plan based on lessons learned?

Accepted Answer

To incorporate improvements to prevent recurrence and enhance response. The primary purpose of updating an incident response plan after a lessons learned review is to feed identified gaps, control failures, and response inefficiencies back into the plan so future incidents are prevented or handled more effectively. This closes the continuous improvement loop central to frameworks like NIST SP 800-61 and ISO 27035. The update is a corrective and preventive action, not a documentation or blame exercise.

Answer

To assign blame for failures

Answer

To share threat intelligence with ISACs

Answer

To document the incident for regulatory compliance

Question 9

During a P1 incident involving a ransomware attack, the incident response manager needs to communicate with executives. Which of the following is the most appropriate approach for executive communication?

Accepted Answer

Send hourly situation reports (sitreps) focusing on business impact and key actions. For critical incidents, hourly sitreps (situation reports) are recommended to keep executives informed. Avoiding speculation and preserving legal privilege with counsel involvement are also key.

Answer

Include speculative root causes to show thoroughness

Answer

Wait until the incident is fully resolved before communicating

Answer

Provide detailed technical analysis in every update

Question 10

A security manager is developing a security scorecard for the C-suite. Which combination of metrics would be MOST appropriate for a one-page dashboard?

Accepted Answer

Patch compliance percentage and mean time to detect incidents.. A one-page C-suite security scorecard should present a small number of high-level, outcome-oriented metrics that indicate the overall health of the security program. Patch compliance percentage and mean time to detect (MTTD) incidents are both strategic indicators of preventive and detective control effectiveness, making them ideal for executive dashboards. The other options are either too granular or not outcome-focused.

Answer

Detailed vulnerability counts by severity and system owner.

Answer

Number of security awareness training sessions completed.

Answer

List of all third-party vendors and their risk ratings.

Question 11

After a major security incident, the incident response team completes the containment, eradication, and recovery phases. The CISO is now planning the post-incident activities. Which activity is MOST critical to ensure that lessons learned are effectively incorporated?

Accepted Answer

Conducting a post-incident review and updating policies.. Conducting a post-incident review and updating policies is the most critical post-incident activity because it ensures that the root cause, response gaps, and process deficiencies are formally documented and translated into actionable improvements. This directly supports the continuous improvement cycle required by NIST SP 800-61 and ISO 27035, preventing recurrence of similar incidents.

Answer

Publishing a public disclosure of the incident.

Answer

Terminating the incident response team's engagement.

Answer

Restoring all systems to full production status.

Question 12

Which of the following is the primary purpose of conducting a root cause analysis (RCA) after a security incident?

Accepted Answer

To determine process and governance failures that allowed the incident to occur. RCA aims to identify underlying causes to prevent recurrence. While it may involve understanding the technical cause, the ultimate goal is to improve processes and controls.

Answer

To identify the technical vulnerability that was exploited

Answer

To satisfy regulatory reporting requirements

Answer

To assign blame to responsible individuals

Question 13

Acme Corp, a global manufacturer, has a decentralized security governance model. Each business unit manages its own security, resulting in inconsistent policies and repeated audit findings. The new CISO proposes a federated model where a central team sets minimum standards and each unit can add local controls. However, the European unit's head insists on full autonomy due to GDPR strictness. The board is concerned about compliance costs. What should the CISO do first?

Accepted Answer

Conduct a risk assessment to identify where local controls are truly needed. The CISO should first conduct a risk assessment to identify where local controls are truly needed, because this provides data-driven justification for the federated model and addresses the European unit's GDPR concerns. A risk assessment will reveal which business units face different regulatory or threat landscapes, allowing the CISO to tailor the federated model and demonstrate that local autonomy is only necessary where risks justify it. This approach also helps the board understand compliance costs and trade-offs.

Answer

Implement the federated model immediately and require all units to comply

Answer

Allow the European unit to keep full autonomy while others follow the model

Answer

Hire a GDPR expert for the European unit

Question 14

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have major business impact and require immediate executive notification and round-the-clock response.

Answer

P2 — High

Answer

P3 — Medium

Answer

P4 — Low

Question 15

Following a major security incident, the lessons learned meeting is scheduled. Which of the following outcomes is MOST important to ensure the effectiveness of future incident response?

Accepted Answer

Updating the incident response plan and playbooks based on findings. The primary outcome of a lessons learned meeting is to identify improvements and update the IR plan, not just document or blame.

Answer

Conducting a new risk assessment

Answer

Creating a detailed report for senior management

Answer

Assigning blame to responsible parties