CISM Practice Test 17 — 15 Questions

Question 1

A CISO is developing an information security governance framework for a financial institution. Which of the following is the PRIMARY purpose of such a framework?

Accepted Answer

Align security with business objectives. The primary purpose of an information security governance framework is to align security initiatives with business objectives, ensuring that security investments and activities directly support the organization's strategic goals. For a financial institution, this alignment ensures that security governance drives value, manages risk in context of business priorities, and enables informed decision-making by leadership.

Answer

Minimize risks to an acceptable level

Answer

Ensure compliance with regulatory requirements

Answer

Deploy the latest security technologies

Question 2

Which of the following is the PRIMARY purpose of a security awareness program?

Accepted Answer

To reduce human-related security risks. The primary purpose of a security awareness program is to reduce human-related security risks by educating employees about threats, policies, and safe behaviors. Since humans are often the weakest link in security, awareness programs aim to change behavior and culture to prevent incidents like phishing, social engineering, and data mishandling. While compliance, visibility, and documentation are secondary benefits, the core objective is risk reduction.

Answer

To achieve compliance with regulatory requirements

Answer

To increase the security team's visibility

Answer

To document training completion for audits

Question 3

An organization is selecting security controls from NIST SP 800-53. Which TWO control families are most directly related to access control? (Select TWO)

Accepted Answer

Identification and Authentication (IA). Option E, Access Control (AC), is correct because the AC family in NIST SP 800-53 is explicitly dedicated to controlling access to systems and information, covering policies, account management, access enforcement, least privilege, and separation of duties. Option A, Identification and Authentication (IA), is correct because IA controls establish and verify user, device, and process identities, which is the prerequisite for enforcing access control decisions. Together, AC and IA form the core of logical access control in the NIST control catalog. Option B, Configuration Management (CM), addresses baselines and change control rather than who may access resources. Option C, System and Communications Protection (SC), focuses on boundary protection, cryptography, and network security mechanisms. Option D, Audit and Accountability (AU), deals with logging, monitoring, and review of activity, not with granting or denying access.

Answer

Configuration Management (CM)

Answer

System and Communications Protection (SC)

Answer

Audit and Accountability (AU)

Question 4

Which of the following is a key objective of implementing a security champions program?

Accepted Answer

To embed security advocates in development teams. Security champions are volunteers within development teams who promote security best practices and facilitate communication between security and development.

Answer

To replace the need for a formal security awareness program

Answer

To reduce the number of security tools needed

Answer

To conduct phishing simulations for all employees

Question 5

Which THREE of the following are essential elements of a forensic evidence handling procedure to ensure admissibility in court?

Accepted Answer

Placing a legal hold on relevant data. Option A is correct because a legal hold preserves potentially relevant data and prevents routine deletion or alteration, which is essential for demonstrating that evidence was not spoliated before collection. Option B is correct because a documented chain of custody records every transfer, access, and storage event for the evidence, allowing the court to verify its integrity and authenticity. Option E is correct because creating bit-for-bit forensic copies (forensic images) preserves the original media and allows analysis on a verified duplicate, typically validated with hash values such as MD5 or SHA-256. Option C is not correct because performing analysis directly on original systems can alter metadata, timestamps, and other artifacts, undermining admissibility. Option D is not correct because using automated tools without validation fails to establish that the tools produce reliable, repeatable results, which is necessary for forensic soundness.

Answer

Performing analysis directly on original systems

Answer

Using automated tools without validation

Question 6

An incident response plan should include which three key components to ensure effective response? (Choose three.)

Accepted Answer

Communication procedures for internal and external stakeholders.. Option A is correct because an incident response plan must define communication procedures for internal and external stakeholders, ensuring timely, accurate, and legally appropriate notifications during an incident. Option B is correct because clearly assigned roles and responsibilities of the response team prevent confusion, overlap, and delays by establishing who leads, who investigates, and who escalates. Option E is correct because a method for preserving and handling evidence is essential to maintain forensic integrity, chain of custody, and admissibility for potential legal or disciplinary action. Option C is not appropriate because a plan cannot feasibly contain detailed step-by-step technical instructions for all possible incidents; it should instead reference playbooks or procedures for specific incident types. Option D is not required as a key component because while pre-approved forensic vendors can be useful, they are an optional supporting resource rather than a core element of every incident response plan.

Answer

Detailed step-by-step technical instructions for all possible incidents.

Answer

A list of pre-approved vendors for forensic services.

Question 7

An organization's security monitoring system detects multiple failed login attempts from an internal IP address to a critical database server. The attempts are occurring every few seconds. What is the FIRST step the incident response team should take?

Accepted Answer

Verify whether the activity is legitimate.. The first step in incident response is to verify whether the activity is legitimate. Multiple failed login attempts could be from a misconfigured application, a user who forgot their password, or a legitimate but aggressive automated process. Before taking any disruptive action like blocking an IP or disabling a server, the team must confirm that it is indeed a security incident. This aligns with the 'Identification' phase of incident response, where you gather evidence to determine if an event is a true incident.

Answer

Block the IP address at the firewall immediately.

Answer

Disable the database server to prevent data breach.

Answer

Reset the password of the database service account.

Question 8

During a data breach investigation, legal counsel instructs the forensics team to preserve evidence under attorney-client privilege. Which of the following actions is most critical to maintain that privilege?

Accepted Answer

Limit distribution of forensic reports to individuals with a need-to-know and under legal direction. To maintain attorney-client privilege during a data breach investigation, it is critical to limit distribution of forensic reports to individuals with a need-to-know and under legal direction. This preserves confidentiality, which is essential for privilege to apply. Uncontrolled distribution can waive privilege, exposing sensitive information to discovery.

Answer

Use a separate, isolated network for forensic analysis

Answer

Encrypt all forensic images with a strong algorithm

Answer

Destroy all preliminary notes after the final report is issued

Question 9

Which role within a security team is primarily responsible for designing and reviewing security architectures to ensure alignment with business requirements and security standards?

Accepted Answer

Security architect. The security architect designs and reviews the security architecture, ensuring it meets business needs and security requirements. Other roles focus on operations, analysis, or awareness.

Answer

SOC analyst

Answer

GRC analyst

Answer

Security analyst

Question 10

A multinational organization is implementing a vendor risk management programme. Which THREE of the following should be included in the programme to effectively manage nth-party risk? (Select THREE.)

Accepted Answer

Include contractual clauses that require vendors to pass down security requirements to subcontractors. Option A is correct because nth-party risk arises from subcontractors, so contracts must include flow-down clauses that propagate the organization's security, privacy, and compliance requirements to those downstream parties. Option B is correct because including audit rights over subcontractors in vendor agreements gives the organization the contractual ability to verify nth-party controls directly or through the vendor, which is essential for oversight. Option D is correct because visibility into which subcontractors exist and their security posture is a prerequisite for assessing and managing nth-party risk; without disclosure, the organization cannot evaluate downstream exposure. Option C is not marked correct because conducting annual security assessments of all subcontractors is not a universally required or practical programme element; assessments should be risk-based and proportionate, not blanket annual reviews of every subcontractor. Option E is not marked correct because requiring vendors to obtain insurance for subcontractors addresses financial risk transfer only and does not by itself manage nth-party security risk.

Answer

Conduct annual security assessments of all subcontractors

Answer

Require vendors to obtain insurance for subcontractors

Question 11

An organization is implementing a quantitative risk analysis for a critical application. The asset value is $2,000,000. The exposure factor (EF) is 0.25, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$250,000. The annualized loss expectancy (ALE) is calculated as ALE = AV × EF × ARO, where AV is the asset value ($2,000,000), EF is the exposure factor (0.25), and ARO is the annualized rate of occurrence (0.5). Multiplying these gives $2,000,000 × 0.25 × 0.5 = $250,000, which represents the expected annual financial loss from this risk.

Answer

$1,000,000

Answer

$125,000

Answer

$500,000

Question 12

Which of the following incident types is MOST likely to require activation of the crisis management team (CMT) due to potential regulatory and reputational impact?

Accepted Answer

A P1 data breach involving customer personally identifiable information (PII).. A P1 data breach involving customer PII triggers mandatory breach notification laws (e.g., GDPR Article 33, HIPAA Breach Notification Rule) and often requires immediate CMT activation to manage regulatory filings, legal liability, and public relations. The CMT is designed for high-severity incidents with significant business, legal, or reputational consequences, which a P1 breach directly entails.

Answer

A P2 denial-of-service attack that is quickly mitigated.

Answer

A P4 phishing email reported by a user.

Answer

A P3 insider threat involving an employee accessing unauthorized files.

Question 13

An organization's security budget is 8% of the IT budget. Industry benchmarks suggest 10-15% for mature programs. Which of the following should the CISO do FIRST to justify an increase?

Accepted Answer

Present a cost-benefit analysis showing breach avoidance value. A cost-benefit analysis that quantifies the value of avoided breaches translates the security gap into business terms (financial risk reduction, regulatory exposure, downtime cost), which is the language executives and the board use to approve budget. It directly addresses the CISO's need to justify the increase with evidence rather than comparison or emotion. This is the FIRST step because it builds the business case that supports any subsequent request.

Answer

Reduce other IT expenses to free up funds

Answer

Request additional budget for emerging threats

Answer

Highlight the percentage gap compared to peers

Question 14

A security awareness programme is being evaluated. Which metric BEST indicates a positive security culture?

Accepted Answer

Number of security incidents reported. A rising number of security incidents reported by employees is a leading indicator of a healthy security culture, because it shows people recognize and feel safe reporting issues rather than hiding them. This metric reflects engagement and trust, not just compliance.

Answer

Number of policy violations

Answer

Percentage of employees who completed training

Answer

Phishing simulation click rate

Question 15

A security manager is designing an executive security report. Which content is most appropriate for a one-page C-suite dashboard?

Accepted Answer

Top security risks and key performance indicators with trends. Executive dashboards must communicate risk posture and program effectiveness at a glance, so top risks paired with KPIs and trend data give the C-suite actionable insight without operational noise. CISM emphasizes that security reporting to leadership should be business-aligned, forward-looking, and decision-supporting rather than technical. Trends show whether controls are improving or degrading, which is exactly what executives need for governance and budget decisions.

Answer

Detailed logs of all security incidents from the past week

Answer

List of all vulnerabilities found during the last scan

Answer

Full results of the latest phishing simulation