CISM Practice Test 16 — 15 Questions

Question 1

An organization's incident response team has contained a ransomware incident. What is the NEXT step according to the incident management program?

Accepted Answer

Eradicate the malware and restore systems. After containment, the next priority is eradication of the threat to remove all traces of the malware and restore systems securely.

Answer

Perform root cause analysis

Answer

Conduct a lessons learned meeting

Answer

Notify regulatory authorities

Question 2

What is the primary function of a Security Operations Center (SOC)?

Accepted Answer

Continuous monitoring, detection, and response to security threats. A SOC's primary mission is continuous monitoring of security telemetry, detecting threats, and coordinating response actions. It operates 24/7 using SIEM, EDR, and threat intelligence to identify and triage incidents in real time. This detection-and-response focus distinguishes the SOC from architecture, policy, or training functions.

Answer

Designing the security architecture

Answer

Developing security policies and standards

Answer

Conducting security awareness training

Question 3

A company's information security manager is tasked with ensuring that security initiatives align with business goals. Which of the following best demonstrates this alignment?

Accepted Answer

Establishing security metrics that are linked to key business performance indicators.. Aligning security metrics with key business performance indicators (KPIs) ensures that security initiatives directly support and demonstrate value to business objectives, such as revenue protection, customer trust, or operational efficiency. This is a core principle of information security governance, where security is treated as a business enabler rather than a technical silo. For example, tracking 'mean time to detect (MTTD)' and 'mean time to respond (MTTR)' as security metrics linked to business continuity KPIs shows how security investments reduce business risk.

Answer

Prioritizing security projects based solely on technical risk assessment.

Answer

Implementing all security controls required by regulatory standards.

Answer

Creating a security budget that allocates funds equally across departments.

Question 4

A security manager is developing a security scorecard for the CISO. Which THREE of the following metrics are considered LEADING indicators?

Accepted Answer

Patch compliance percentage. Leading indicators are forward-looking metrics that measure the strength of preventive and detective controls before incidents occur. B (Patch compliance percentage) is correct because it quantifies how much of the environment is protected against known vulnerabilities, predicting future exploit risk. C (Phishing simulation click rate) is correct because it measures current user susceptibility to social engineering, forecasting the likelihood of future successful phishing compromises. E (Access review completion rate) is correct because it reflects whether least-privilege and entitlement hygiene processes are being executed, reducing future unauthorized-access risk. A (MTTD) is a detective/operational metric that measures how quickly incidents are found after they occur, and D (number of data breaches) is a lagging outcome metric that reports incidents that already happened, so neither is a leading indicator.

Answer

Mean time to detect (MTTD)

Answer

Number of data breaches

Question 5

Which incident severity level requires executive notification and 24/7 response, and has major business impact?

Accepted Answer

P1 - Critical. P1 (Critical) incidents have major business impact, require executive notification, and demand a 24/7 response effort.

Answer

P3 - Medium

Answer

P2 - High

Answer

P4 - Low

Question 6

In the context of incident management, which of the following is the PRIMARY purpose of conducting lessons learned meetings within two weeks of incident resolution?

Accepted Answer

To update the incident response plan and playbooks based on findings.. The main goal is to improve future incident response by identifying what worked and what didn't.

Answer

To provide a final report to regulators and law enforcement.

Answer

To assign blame for the incident and take disciplinary action.

Answer

To calculate the total financial loss from the incident.

Question 7

Which of the following is the PRIMARY role of the executive sponsor in the incident response team structure?

Accepted Answer

To provide strategic direction, resources, and decision-making authority.. The executive sponsor provides authority, resources, and strategic direction, and ensures the IR team has the support needed to respond effectively.

Answer

To handle all media inquiries and public relations.

Answer

To serve as legal counsel and ensure compliance.

Answer

To manage the technical investigation and forensic analysis.

Question 8

An organization uses CIS Controls v8. They are a small business with limited cybersecurity resources. Which implementation group (IG) should they prioritize?

Accepted Answer

IG1. CIS Controls v8 defines Implementation Group 1 (IG1) as the foundational set of safeguards appropriate for small organizations with limited cybersecurity resources and low data sensitivity. IG1 covers essential hygiene controls (inventory, patching, access control, malware defenses) that provide the highest risk reduction per unit of effort. A small business should implement IG1 first and only progress to IG2/IG3 as resources and risk profile grow.

Answer

All IGs simultaneously

Answer

IG3

Answer

IG2

Question 9

Order the steps for a risk assessment process according to ISACA's risk management framework.

Accepted Answer

Step 1: Risk Identification, Step 2: Risk Analysis, Step 3: Risk Evaluation, Step 4: Risk Treatment, Step 5: Risk Monitoring. Risk assessment starts with identification, then analysis, evaluation, treatment, and continuous monitoring.

Answer

Step 1: Risk Identification, Step 2: Risk Evaluation, Step 3: Risk Analysis, Step 4: Risk Treatment, Step 5: Risk Monitoring

Answer

Step 1: Risk Analysis, Step 2: Risk Identification, Step 3: Risk Evaluation, Step 4: Risk Treatment, Step 5: Risk Monitoring

Answer

Step 1: Risk Identification, Step 2: Risk Analysis, Step 3: Risk Evaluation, Step 4: Risk Monitoring, Step 5: Risk Treatment

Question 10

A CISO is preparing an executive dashboard for the board of directors. Which combination of metrics would provide the most meaningful overview of the security programme's effectiveness?

Accepted Answer

Mean time to detect (MTTD), mean time to respond (MTTR), and number of breaches. MTTD, MTTR, and number of breaches directly measure how quickly the security program detects and contains incidents and how often it fails, which is what a board needs to judge effectiveness. These are outcome-oriented metrics tied to risk, not activity counts. They translate technical operations into business-relevant resilience indicators.

Answer

Number of security architects, SOC analyst headcount, and security tool count

Answer

Number of security incidents, percentage of systems patched, and security awareness training completion rate

Answer

Phishing click rate, number of vendor assessments completed, and security budget spent

Question 11

During a major data breach investigation, legal counsel advises the incident response team to preserve attorney-client privilege over communications with external forensic investigators. Which of the following actions BEST supports this objective?

Accepted Answer

Direct the forensic investigators to report to legal counsel and mark all deliverables as privileged.. Directing forensic investigators to report directly to legal counsel and marking all deliverables as privileged establishes a clear legal framework for attorney-client privilege. This ensures that communications and work product are protected from discovery in litigation, as they are created under the direction of legal counsel for the purpose of providing legal advice.

Answer

Have all communications with the forensic firm go through the CISO.

Answer

Avoid documenting any findings related to the breach until after litigation is resolved.

Answer

Ensure the forensic engagement letter includes a clause acknowledging attorney-client privilege.

Question 12

An organization has experienced a ransomware attack that has encrypted critical servers and is causing major business disruption. According to incident severity levels, which priority should this incident be assigned?

Accepted Answer

P1 — Critical. A ransomware attack that encrypts critical servers and causes major business disruption is a critical incident, warranting a P1 priority. P1 incidents are reserved for those with severe impact on business operations, requiring immediate response and escalation. The encryption of critical servers directly threatens the organization's ability to operate, making P1 the appropriate severity level.

Answer

P2 — High

Answer

P4 — Low

Answer

P3 — Medium

Question 13

A large financial institution is updating its information security program to align with a new regulatory framework. The program currently has a decentralized governance model. Which of the following is the MOST significant risk of maintaining a decentralized model?

Accepted Answer

Inconsistent security levels across business units. In a decentralized governance model, each business unit may implement its own security controls, leading to inconsistent security levels across the organization. This is the most significant risk because it creates gaps and vulnerabilities that can be exploited, especially in a regulated financial institution. While other risks exist, inconsistency directly undermines the overall security posture.

Answer

Slower incident response

Answer

Higher cost of compliance

Answer

Duplication of controls

Question 14

Which TWO of the following are valid risk treatment options according to ISO 31000? (Choose two.)

Accepted Answer

Risk avoidance. According to ISO 31000, risk treatment options include avoiding the risk by deciding not to start or continue the activity that gives rise to it, which is why option A (Risk avoidance) is correct. ISO 31000 also recognizes retaining the risk by informed decision, which is option E (Risk retention), as a valid treatment option when the risk is accepted and no further action is taken. Options B (Risk measurement), C (Risk identification), and D (Risk communication) are not treatment options; they are elements of the risk assessment and communication processes within the ISO 31000 framework, not ways of modifying risk.

Answer

Risk measurement

Answer

Risk identification

Answer

Risk communication

Question 15

A manufacturing company has an incident response plan that includes a communication plan. However, during a recent ransomware incident, the team realized that the external legal counsel was not listed in the plan. The incident requires consultation with legal due to potential regulatory implications. The incident response manager needs to address this gap quickly. What should the manager do?

Accepted Answer

Add the legal counsel to the incident response plan immediately. The gap identified during the incident is that external legal counsel was missing from the incident response communication plan. The most direct and effective action is to immediately update the plan to include the legal counsel, ensuring they are notified and involved in the current incident as required. This addresses the root cause and prevents recurrence.

Answer

Notify legal counsel after the incident is resolved

Answer

Use only internal legal department instead of external counsel

Answer

Ignore legal counsel involvement for this incident