CISM Practice Test 15 — 15 Questions

Question 1

A multinational organization must comply with GDPR, CCPA, and PCI DSS. Which approach is MOST effective for managing these overlapping requirements?

Accepted Answer

Develop a unified compliance framework that maps controls to multiple regulations. A unified compliance framework maps common controls to multiple regulatory requirements (GDPR, CCPA, PCI DSS), eliminating duplicated effort, reducing gaps, and providing a single source of truth for auditors. This is the standard 'compliance harmonization' or 'control mapping' approach recommended by ISACA and industry frameworks such as the Unified Compliance Framework (UCF) and NIST SP 800-53 mappings. It allows one control implementation to satisfy several regulations simultaneously.

Answer

Outsource compliance management to a third-party consultant

Answer

Prioritize compliance based on the most stringent regulation

Answer

Assign separate teams to manage each regulation

Question 2

In a security awareness program, which training approach is most appropriate for software developers?

Accepted Answer

Secure coding practices and common vulnerabilities. Software developers need role-specific training on secure coding practices and common vulnerabilities such as OWASP Top 10 issues, injection flaws, and insecure deserialization, because they directly write and maintain code that introduces or prevents these flaws. Generic awareness training does not address their actual responsibilities.

Answer

Social engineering awareness for executives

Answer

Incident response procedures

Answer

General security awareness training covering phishing

Question 3

An organization has experienced a ransomware attack that has encrypted critical servers. The incident response team is unable to contain the incident within the maximum tolerable downtime (MTD). Who has the authority to declare a disaster and activate the business continuity plan?

Accepted Answer

The chief executive officer (CEO) or designated crisis management team. The CEO or designated crisis management team holds the authority to declare a disaster and activate the BCP because this decision has enterprise-wide impact, requiring executive-level accountability and resource allocation. The CEO is ultimately responsible for business survival, and the crisis management team is typically pre-authorized to make this call when MTD is exceeded. This aligns with CISM's governance principle that business continuity is a business decision, not an IT or security decision.

Answer

The incident response manager

Answer

The business continuity manager

Answer

The chief information security officer (CISO)

Question 4

An organization has a decentralized governance model with security teams embedded in each business unit. The CISO is concerned about inconsistent security controls across the enterprise. What is the BEST recommendation to address this?

Accepted Answer

Adopt a hybrid governance model with enterprise-wide standards and local execution. A hybrid governance model combines enterprise-wide standards, policies, and oversight from the CISO with local execution by embedded security teams in each business unit. This addresses inconsistency by establishing common controls and frameworks while preserving the agility and business alignment of decentralized teams. It is the best recommendation because it directly resolves the root cause — lack of standardized controls — without sacrificing the benefits of decentralization.

Answer

Conduct a risk assessment to prioritize controls

Answer

Implement a centralized security operations center (SOC) to monitor all units

Answer

Move to a fully centralized governance model

Question 5

Which of the following is the BEST example of a board-level security metric?

Accepted Answer

Security investment versus loss avoidance. Board-level metrics should reflect impact on business objectives and financial performance. Investment vs. loss avoidance directly ties security spending to business value.

Answer

Vulnerability scan completion rate

Answer

Number of firewall rules implemented

Answer

Percentage of employees who completed security training

Question 6

Which TWO of the following are typical components of a security awareness program?

Accepted Answer

Role-based security training. Role-based security training (A) is a core element of a security awareness program because it tailors education to the specific risks and responsibilities of different job functions, such as developers, finance staff, or executives, ensuring relevant and effective learning. Phishing simulations (C) are also typical, as they provide practical, measurable testing of employees' ability to recognize and report social-engineering attempts, reinforcing awareness training with real-world exercises. Vulnerability scanning (B) is a technical control that identifies weaknesses in systems and networks, not an awareness activity aimed at changing employee behavior. Security architecture design (D) is an engineering discipline focused on building secure systems, and penetration testing (E) is an offensive security assessment of technical controls, neither of which directly educates or measures the workforce.

Answer

Vulnerability scanning

Answer

Security architecture design

Answer

Penetration testing

Question 7

After detecting a ransomware infection on a file server, the incident response team performs containment and eradication. Which step should be prioritized during the recovery phase to minimize business impact?

Accepted Answer

Restore data from verified clean backups. The recovery phase of incident response focuses on restoring systems and data to normal operations. Restoring from verified clean backups is the most reliable way to recover encrypted data without paying a ransom or introducing further risk. It directly minimizes business impact by enabling the fastest return to service, provided the backups are free of malware and recent enough to meet recovery objectives. Patching and reimaging are important but belong to eradication and hardening, not immediate recovery.

Answer

Contact the attackers to negotiate a decryption key

Answer

Reimage all servers in the same network segment

Answer

Identify and patch the vulnerability used for entry

Question 8

Which TWO of the following are key indicators that an organization's information security governance is effective?

Accepted Answer

High percentage of risk treatment plans implemented on time.. Option C is correct because effective governance is measured by whether the organization actually executes on its risk decisions — a high percentage of risk treatment plans implemented on time demonstrates that identified risks are being managed and that accountability and oversight processes are functioning, not just documented. Option D is correct because regular reporting of security performance metrics to the board is a defining characteristic of governance: it shows executive/board-level oversight, ensures security is aligned with business objectives, and enables informed direction-setting and resource decisions. The unmarked options do not belong: A (low budget variance) reflects financial control/accounting accuracy rather than security governance effectiveness, B (number of published policies) is a volume/output metric that says nothing about whether policies are enforced or effective, and E (security awareness training completion) is an operational control metric that indicates training delivery, not governance effectiveness.

Answer

Low variance between the approved security budget and actual spending.

Answer

The number of security policies that have been published.

Answer

High completion rate for security awareness training.

Question 9

During a security incident, the incident response team discovers that an attacker used a previously unknown vulnerability (zero-day) in a widely used software. Which action should the team take to address this vulnerability in the short term?

Accepted Answer

Implement a virtual patch through an intrusion prevention system (IPS). A virtual patch via an IPS provides immediate, temporary protection against a zero-day vulnerability by inspecting traffic for exploit patterns or anomalous behavior and blocking malicious payloads before they reach the vulnerable software. This buys time for the organization to assess the risk and plan a permanent fix without disrupting operations, as the IPS can be updated with signatures or rules specific to the newly discovered vulnerability.

Answer

Recompile the software with additional security controls

Answer

Immediately disable the software across the organization

Answer

Deploy a vendor patch as soon as it becomes available

Question 10

An organization's security strategy includes a goal to achieve CMM Level 3. What capability does the organization need to demonstrate?

Accepted Answer

Standardized and documented security processes. CMM Level 3 is defined as 'Defined' — the organization has standardized, documented processes that are communicated and followed across the enterprise, rather than relying on individual heroics. At this level, process assets exist (policies, procedures, templates) and projects tailor them from a shared organizational set. This is the capability the organization must demonstrate to claim Level 3.

Answer

Ad-hoc security processes

Answer

Quantitative measurement of process effectiveness

Answer

Continuous process optimization

Question 11

Which THREE of the following are essential components of an incident response plan? (Select exactly 3)

Accepted Answer

Communication plan for internal and external stakeholders. A communication plan is essential because it defines how the incident response team will coordinate internally and notify external stakeholders such as regulators, law enforcement, customers, and the media. Without a predefined communication plan, critical updates may be delayed or mishandled, leading to regulatory penalties or reputational damage. This aligns with NIST SP 800-61 and CISM best practices for incident management.

Answer

A list of all software licenses in the organization

Answer

Annual budget for security tools

Question 12

A financial institution is implementing a new online banking platform. The risk assessment identified that the authentication module has a high likelihood of exploitation due to weak password policies. The risk owner has decided to implement multi-factor authentication (MFA) to reduce the risk. This is an example of which risk response strategy?

Accepted Answer

Risk mitigation. Implementing multi-factor authentication (MFA) reduces the likelihood or impact of a security risk by adding additional authentication factors (e.g., something you know, something you have, something you are) beyond a weak password. This directly aligns with risk mitigation, which seeks to decrease the residual risk to an acceptable level through controls. The decision does not eliminate the risk entirely (avoidance), accept it without action, or transfer it to a third party.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 13

Which TWO regulations are MOST likely to impact an organization that processes credit card payments and handles personal data of EU residents?

Accepted Answer

GDPR. Option C (GDPR) is correct because the organization handles personal data of EU residents, and the EU General Data Protection Regulation imposes requirements on any entity processing that data regardless of where the organization is located, covering lawful processing, data subject rights, breach notification, and cross-border transfers. Option E (PCI DSS) is correct because the organization processes credit card payments, and the Payment Card Industry Data Security Standard mandates controls for protecting cardholder data, including encryption, access control, and network segmentation. Option A (HIPAA) does not apply because it governs protected health information in the US healthcare context, which is not described here. Option B (SOX) does not apply because it concerns financial reporting and internal controls for publicly traded US companies, not payment card or EU personal data. Option D (CCPA) is not the best fit because it addresses California consumers' personal information, whereas the scenario specifically involves EU residents, making GDPR the relevant privacy regulation.

Answer

HIPAA

Answer

SOX

Answer

CCPA

Question 14

A security manager is building a business case for additional security budget. Which THREE justifications are most effective for obtaining executive approval? (Select THREE)

Accepted Answer

Compliance cost avoidance. Option B (Compliance cost avoidance) is correct because executives respond to quantifiable financial impact, and demonstrating how security spending prevents regulatory fines, penalties, and audit remediation costs under frameworks like PCI DSS, HIPAA, or GDPR directly ties budget to avoided losses. Option C (Breach avoidance value) is correct because it expresses security investment in business terms—expected loss from data breaches, ransomware, and downtime—using metrics such as ALE (Annualized Loss Expectancy) to show the cost-benefit of prevention versus the cost of a incident. Option D (Operational efficiency improvements) is correct because security controls that streamline processes, reduce manual effort, and lower incident response overhead deliver measurable productivity gains that justify spend beyond pure risk reduction. Option A (Number of security tools deployed) is not a strong justification because tool count is a vanity metric that does not demonstrate value or risk reduction and may even suggest inefficiency. Option E (Industry peer comparison) is not compelling on its own because peer spending benchmarks do not prove that the investment will protect this specific organization's assets or deliver a positive return.

Answer

Number of security tools deployed

Answer

Industry peer comparison

Question 15

A multinational financial services company is implementing a new regulatory requirement that mandates enhanced encryption for all customer data in transit. The organization currently uses TLS 1.2, but the regulation requires TLS 1.3. The risk owner for the data transmission system is the head of network operations, who believes the current controls are sufficient and argues that upgrading will cause significant downtime and cost. The information security manager has assessed the risk as high due to potential regulatory fines and reputational damage. The risk owner refuses to accept the risk and insists on deferring the upgrade. The organization has a risk appetite statement that accepts moderate residual risk only after explicit approval from the CRO. The escalation process involves the risk management committee. What is the BEST course of action for the information security manager?

Accepted Answer

Escalate the issue to the risk management committee for a decision on whether to accept, mitigate, or defer the risk.. When a risk owner refuses to accept a risk that exceeds the organization's stated risk appetite and the risk owner also refuses to treat it, the information security manager must escalate through the defined governance channel — here, the risk management committee. The risk appetite statement only permits moderate residual risk with explicit CRO approval, so the head of network operations cannot unilaterally defer a high-rated regulatory risk. Escalation ensures the decision is made at the appropriate authority level with full visibility of regulatory and reputational exposure.

Answer

Conduct a detailed cost-benefit analysis to convince the risk owner to upgrade, but do not escalate until the analysis is complete.

Answer

Accept the risk owner's decision and update the risk register to reflect the deferred treatment with a note of the risk owner's acceptance.

Answer

Implement a compensating control, such as strong application-layer encryption, to reduce the residual risk to an acceptable level without upgrading TLS.