CISM Practice Test 14 — 15 Questions

Question 1

A CISO is presenting security metrics to the board. Which of the following metrics would be MOST relevant for a one-page executive dashboard?

Accepted Answer

Breach count and associated financial impact. For a one-page executive dashboard, the board needs metrics that communicate business risk and financial impact in a language they understand. Breach count and associated financial impact (A) directly translates security performance into business terms — number of breaches and their monetary cost — which is what boards care about for fiduciary oversight. This metric ties security directly to organizational risk and financial exposure, making it the most relevant for executive-level reporting.

Answer

Mean time to detect (MTTD) for incidents

Answer

Number of firewall rule changes per month

Answer

Percentage of employees who completed training

Question 2

Which TWO of the following are key responsibilities of the crisis management team (CMT) during a major cybersecurity incident?

Accepted Answer

Approving external communications and public statements. Option B is correct because the crisis management team owns the incident's external-facing messaging, ensuring that all press releases, customer notifications, and regulatory disclosures are reviewed and approved before release to protect the organization's reputation and legal standing. Option E is correct because the CMT is a strategic decision-making body that determines whether to invoke business continuity or disaster recovery plans, weighing operational impact, safety, and financial consequences rather than performing hands-on technical work. Options A, C, and D are incorrect because restoring backups, analyzing logs to find the attack vector, and conducting forensic analysis of compromised systems are tactical, technical tasks performed by incident response handlers, forensic analysts, and system administrators, not by the strategic CMT.

Answer

Restoring backups of affected servers

Answer

Analyzing log files to identify the attack vector

Answer

Conducting technical forensic analysis of compromised systems

Question 3

Which TWO of the following are primary responsibilities of the board of directors in information security governance?

Accepted Answer

Approving the organization's information security risk appetite.. Option A is correct because setting and approving the organization's information security risk appetite is a core governance responsibility of the board, which defines how much risk the enterprise is willing to accept in pursuit of its objectives. Option D is correct because the board provides oversight by holding executive management accountable for the effectiveness of the security program, ensuring security aligns with business strategy and risk tolerance. Options B, C, and E are incorrect because implementing security controls, designing technical security architecture, and conducting internal security audits are operational and technical activities delegated to management, security architects, and internal audit or assurance functions, not the board itself.

Answer

Implementing security controls to mitigate identified risks.

Answer

Designing the technical security architecture for the organization.

Answer

Conducting internal security audits of the information systems.

Question 4

Which THREE elements are essential for an effective information security governance framework?

Accepted Answer

Clear accountability structure. A clear accountability structure is essential because it defines who is responsible for specific security decisions and actions, ensuring that no critical task falls through the cracks. Without defined roles, security gaps emerge, and incident response becomes chaotic. This aligns with the CISM principle that governance requires unambiguous ownership of security outcomes.

Answer

Free and open-source security tools

Answer

Formal risk appetite statement

Question 5

After a merger, the combined organization has two different risk tolerance levels: one entity is risk-averse, the other is risk-taking. What is the best governance action?

Accepted Answer

Reassess risk appetite and approve a single unified statement. After a merger, maintaining two separate risk tolerance levels creates governance fragmentation and prevents a unified security posture. The correct action is to reassess the combined organization's risk appetite and approve a single unified statement, as this aligns with the CISM principle that risk governance must be cohesive across the entire enterprise. This ensures consistent risk management decisions, resource allocation, and policy enforcement, avoiding conflicts that could lead to security gaps or regulatory non-compliance.

Answer

Adopt the less restrictive risk tolerance

Answer

Maintain separate risk tolerance levels for each legacy entity

Answer

Adopt the more conservative risk tolerance across the board

Question 6

Which THREE of the following are key performance indicators (KPIs) for an information security program?

Accepted Answer

Number of security awareness training completions per quarter.. The number of security awareness training completions per quarter directly measures the reach and effectiveness of the human-centric security program, which is a key driver for reducing phishing and social engineering risks. This KPI aligns with the NIST SP 800-50 framework for security awareness and training metrics, as it tracks behavioral adoption rather than just policy existence.

Answer

Total number of security staff.

Answer

Average number of firewall rules per device.

Question 7

A security manager is designing a security budget for a mid-sized company. Which TWO of the following are typical components of a security budget?

Accepted Answer

Technology costs for security tools and infrastructure.. Option A is correct because a security budget must include technology costs for security tools and infrastructure such as firewalls, IDS/IPS, SIEM, endpoint protection, and related hardware/software licensing and maintenance. Option E is correct because personnel costs for security staff salaries and benefits are a core, recurring component of any security budget, covering roles like security analysts, engineers, and managers. Legal fees for contract reviews (B) are typically part of general legal or procurement budgets, not the security budget, unless tied to a specific security incident or compliance matter. A marketing budget for security awareness campaigns (C) is usually categorized under marketing or HR/training, though awareness is security-related, it is not a standard security budget line. Office renovation for a security operations center (D) is a capital facilities expense, not a typical recurring security budget component.

Answer

Legal fees for contract reviews.

Answer

Marketing budget for security awareness campaigns.

Answer

Office renovation for security operations center.

Question 8

An organization calculates that the single loss expectancy (SLE) for a server failure is $10,000, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$5,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $10,000 and an ARO of 0.5, the ALE is $10,000 × 0.5 = $5,000. This represents the expected annual financial loss from server failures based on the frequency and impact of such events.

Answer

$10,000

Answer

$20,000

Answer

$2,500

Question 9

A financial institution has an incident involving a suspected data breach of customer PII. The incident response team contains the breach. What should be the NEXT priority according to legal and regulatory requirements?

Accepted Answer

Assess the extent of the breach.. After containing a breach, the immediate next priority is to assess the extent of the breach — determining what data was exposed, how many records, which systems, and whether the breach is ongoing. This assessment is a prerequisite for every subsequent legal and regulatory obligation, including notification timelines and scope. Without knowing the extent, the organization cannot accurately notify regulators or affected parties within mandated windows.

Answer

Engage a public relations firm.

Answer

Notify affected customers.

Answer

Perform a root cause analysis.

Question 10

A company wants to establish a security champions program. What is the primary benefit of embedding security champions in development teams?

Accepted Answer

Ensuring security is considered during the design and development phases. Security champions act as liaisons, promoting secure coding practices and facilitating communication between security and development, thereby integrating security earlier.

Answer

Eliminating the requirement for a dedicated security team

Answer

Reducing the need for automated security testing tools

Answer

Reducing the frequency of penetration testing

Question 11

In the incident response team structure, who is typically responsible for coordinating communication with external stakeholders such as customers and the media?

Accepted Answer

Communications lead. The communications lead handles external messaging to ensure consistency and accuracy.

Answer

Legal counsel

Answer

Incident response manager

Answer

Executive sponsor

Question 12

An organization has multiple business units with different risk tolerances. How should the security program address this?

Accepted Answer

Develop risk-based security policies for each business unit. A is correct because risk-based security policies allow each business unit to tailor controls to its specific risk appetite, ensuring that high-risk units implement stronger safeguards (e.g., stricter access controls, enhanced logging) while low-risk units avoid unnecessary overhead. This aligns with the CISM principle that security governance must accommodate varying risk tolerances through differentiated policy frameworks rather than a one-size-fits-all approach.

Answer

Apply a single enterprise-wide security policy

Answer

Define a minimum baseline and allow units to exceed it

Answer

Decentralize security management to each unit

Question 13

An organization is updating its incident response plan after a major incident. Which post-incident activity should be performed to ensure the plan reflects lessons learned?

Accepted Answer

Updating the IR plan and playbooks based on lessons learned. Updating the IR plan and playbooks based on lessons learned is the definitive post-incident activity that directly incorporates findings from the after-action review into the operational documentation. This ensures the plan reflects actual gaps or improvements identified during the incident, making it actionable for future events. Without this update, the plan remains static and fails to evolve with the organization's threat landscape.

Answer

Sharing indicators of compromise with an ISAC

Answer

Revising the IR policy

Answer

Conducting a tabletop exercise

Question 14

Which THREE elements are essential components of a third-party risk management (TPRM) program? (Select THREE)

Accepted Answer

Contractual security requirements. Contractual security requirements (B) are essential because TPRM must codify security, privacy, breach-notification, and audit obligations in vendor agreements so that controls are legally enforceable. Vendor tiering based on data access and criticality (D) is essential because it lets the organization apply proportionate due diligence, monitoring, and reassessment to vendors according to the sensitivity of data and operational dependency. Onboarding risk assessment (E) is essential because risk must be evaluated before a vendor is engaged or given access, establishing a baseline for approval, remediation, and ongoing oversight. The unmarked options do not belong: automated patching of vendor systems (A) is an operational control the vendor itself normally performs and is not a core TPRM program element, and shared SOC services (C) are one possible assurance mechanism rather than a required component of every TPRM program.

Answer

Automated patching of vendor systems

Answer

Shared SOC services

Question 15

Which TWO of the following are essential components of an incident response plan? (Select two.)

Accepted Answer

Communication templates. Option A (Communication templates) is correct because an incident response plan must include pre-approved notification templates for internal stakeholders, customers, regulators, and media so that accurate, consistent messaging can be delivered quickly during a live incident without drafting communications under pressure. Option C (IR team roster and contact list) is correct because the plan must identify who is on the incident response team, their roles (e.g., incident commander, forensics lead, communications lead), and up-to-date 24/7 contact details so the team can be assembled immediately when an incident is declared. The remaining options are supporting or program-level artifacts rather than essential plan components: vendor risk assessment reports (B) belong to third-party risk management, network architecture diagrams (D) are useful reference documentation but not a required element of the plan itself, and an annual security awareness training schedule (E) is part of the broader security awareness program, not the incident response plan.

Answer

Vendor risk assessment reports

Answer

Network architecture diagrams

Answer

Annual security awareness training schedule