CISM Practice Test 18 — 15 Questions

Question 1

Which role is primarily responsible for developing and maintaining the organization's security architecture?

Accepted Answer

Security Architect. The Security Architect is the role explicitly chartered with designing, building, and maintaining the organization's security architecture — defining frameworks, controls, and reference designs that align with business and compliance requirements. This is a design-and-strategy role, distinct from operational or assessment roles. The other options focus on monitoring, governance, or testing rather than architecture ownership.

Answer

Security Analyst

Answer

GRC Analyst

Answer

Penetration Tester

Question 2

Which control family from NIST SP 800-53 is MOST directly associated with ensuring that users have appropriate access rights?

Accepted Answer

Access Control (AC). The Access Control (AC) family in NIST SP 800-53 addresses policies and mechanisms that govern who can access which resources and under what conditions. It includes controls like AC-2 (Account Management), AC-3 (Access Enforcement), and AC-6 (Least Privilege), which directly ensure users have appropriate access rights. This makes AC the most directly associated control family for access rights.

Answer

System and Communications Protection (SC)

Answer

Identification and Authentication (IA)

Answer

Personnel Security (PS)

Question 3

An organization has a distributed incident response team across multiple time zones. During a critical incident, communication delays occur due to different work hours. Which strategy BEST improves coordination and response time?

Accepted Answer

Implement a follow-the-sun incident response model. The follow-the-sun model aligns incident response handoffs with time zone shifts, ensuring continuous coverage without requiring all team members to work overlapping shifts. This reduces communication delays by transferring active incident ownership to the next available region, maintaining momentum and minimizing response time during critical incidents.

Answer

Require all team members to work overlapping shifts

Answer

Designate a single incident commander for the entire response

Answer

Outsource incident response to a managed security service provider

Question 4

A large retail chain with hundreds of stores uses point-of-sale (POS) systems that run an outdated operating system. The annual risk assessment identified this as a high-risk issue because the OS is no longer patched and has known vulnerabilities. The business unit manager opposes replacing all POS systems immediately due to cost and potential disruption to operations. As the risk manager, you need to recommend a risk response that balances risk reduction with business continuity. Which strategy is most appropriate?

Accepted Answer

Risk mitigation: implement compensating controls and schedule a phased upgrade. Risk mitigation with compensating controls and a phased upgrade balances risk reduction with business continuity. It acknowledges the high risk of outdated POS systems, implements immediate compensating controls (e.g., network segmentation, enhanced monitoring, virtual patching) to reduce exposure, and schedules a phased replacement to avoid operational disruption and spread costs over time.

Answer

Risk avoidance: immediately replace all POS systems with modern ones

Answer

Risk acceptance: accept the risk because the business cannot afford replacement

Answer

Risk transfer: purchase cyber insurance to cover potential losses from POS attacks

Question 5

An organization is updating its security governance framework. Which three elements are essential for ensuring board-level oversight?

Accepted Answer

Board-level risk committee review of security posture. Option C is correct because a board-level risk committee provides structured, recurring oversight by reviewing the organization's security posture against its risk appetite, ensuring cyber risk is governed alongside other enterprise risks. Option D is correct because formal board approval of the information security strategy establishes accountability at the highest level and ensures security objectives are aligned with business goals and adequately resourced. Option E is correct because regular security incident reports give the board timely visibility into material incidents, trends, and remediation status, which is a core mechanism of ongoing board-level oversight. Option A is not essential for board-level oversight, since awareness training educates directors but does not itself create governance or oversight accountability. Option B is also not essential, because while a CISO reporting to the CEO can improve escalation, reporting lines alone do not guarantee board-level oversight of security governance.

Answer

Security awareness training for board members

Answer

CISO reporting directly to the CEO

Question 6

Which of the following is a key reason to have a forensic retainer in place before an incident occurs?

Accepted Answer

To reduce the time needed to engage the firm when an incident occurs. Having a pre-negotiated contract reduces the time to engage forensic experts, which is critical during an incident.

Answer

To avoid the need for a chain of custody

Answer

To ensure the firm understands the organization's IT environment

Answer

To guarantee lower costs

Question 7

A financial institution is hit by a Distributed Denial of Service (DDoS) attack that is overwhelming their internet-facing services. The incident response team activates the plan, but the attack continues to escalate. The CEO is under pressure and asks the incident response manager whether they should pay the ransom demand (the attackers also sent an extortion note demanding payment to stop the attack). The manager must advise the CEO on the best course of action.

Accepted Answer

Engage a DDoS scrubbing service to filter malicious traffic. Engaging a DDoS scrubbing service is the best course of action because it filters malicious traffic while allowing legitimate traffic to reach the services. Scrubbing services are designed to mitigate large-scale DDoS attacks by diverting traffic through specialized centers that clean the traffic.

Answer

Implement rate limiting on the firewall

Answer

Shut down all external-facing services

Answer

Pay the ransom to stop the attack immediately

Question 8

An organization wants to measure the effectiveness of its security awareness programme. Which metric is a leading indicator of improved security culture?

Accepted Answer

Number of phishing emails reported by employees. A leading indicator measures activities or behaviors that predict future outcomes. The number of phishing emails reported by employees is a leading indicator because it reflects increased security awareness and vigilance; employees are actively identifying and reporting suspicious emails, which can prevent incidents. This indicates a positive shift in security culture.

Answer

Number of security incidents attributed to human error

Answer

Percentage of employees who completed annual training

Answer

Average score on knowledge assessment tests

Question 9

A security architect is selecting controls for an e-commerce platform. Which TWO of the following are examples of compensating controls?

Accepted Answer

Implementing multi-factor authentication when strong passwords cannot be enforced.. Option A is correct because multi-factor authentication acts as a compensating control when the primary control (strong password enforcement) cannot be implemented; MFA adds an additional authentication factor that mitigates the risk of weak or compromised passwords. Option E is correct because network segmentation compensates for the inability to patch a legacy system by isolating it, thereby limiting the attack surface and preventing lateral movement even though the underlying vulnerability remains. Option B is not a compensating control but a preventive/data-protection control that directly enforces confidentiality. Option C is a preventive control that directly blocks SQL injection attempts rather than compensating for a missing control. Option D is a detective control that identifies vulnerabilities after the fact and does not substitute for an absent or ineffective control.

Answer

Encrypting all data at rest.

Answer

Deploying a web application firewall (WAF) to protect against SQL injection.

Answer

Conducting quarterly vulnerability scans.

Question 10

An organization's third-party risk management program has been in place for two years. Which of the following is the MOST critical action to ensure the program remains effective?

Accepted Answer

Implementing continuous monitoring of high-risk vendors. Continuous monitoring of high-risk vendors is the most critical action because it provides real-time or near-real-time visibility into security posture changes, such as new vulnerabilities, configuration drifts, or breach indicators, which static annual assessments cannot catch. This aligns with the NIST SP 800-137 framework for continuous monitoring and is essential for adapting to evolving threats in a third-party ecosystem.

Answer

Conducting a one-time risk assessment before contract signing

Answer

Performing annual reassessments for all vendors

Answer

Maintaining a list of all vendors and their criticality

Question 11

Which THREE steps are essential in the post-incident review process?

Accepted Answer

Identify lessons learned and process improvements. Option A is correct because the post-incident review must capture lessons learned and identify concrete process improvements so the organization does not repeat the same mistakes. Option B is correct because findings from the review should be fed back into the incident response plan, updating playbooks, contact lists, and procedures to reflect what actually worked and what failed. Option D is correct because a root cause analysis is essential to determine the underlying technical or procedural cause of the incident rather than just its symptoms, enabling effective remediation. Option C is not part of the process because post-incident reviews are blameless, focusing on systemic causes rather than punishing individuals, which would discourage honest reporting. Option E is unrelated because renewing vendor contracts is a procurement activity, not a step in reviewing and learning from an incident.

Answer

Assign blame for the incident

Answer

Renew vendor contracts

Question 12

Which TWO of the following are key indicators that an organization's information security governance is inadequate?

Accepted Answer

Frequent changes to security policies without approval. Frequent changes to security policies without approval (Option B) indicate a breakdown in governance because it shows that the policy lifecycle—creation, review, approval, and communication—is not being followed. Without a formal change control process, policies become inconsistent, unenforceable, and may conflict with regulatory requirements, directly undermining the governance framework's authority and accountability.

Answer

Low budget for security awareness

Answer

High number of security incidents

Answer

Use of multiple antivirus solutions

Question 13

Based on the exhibit, which role is missing from the governance policy that would be essential for enforcing accountability?

Accepted Answer

A role with authority to enforce compliance and impose consequences. The governance policy lacks a role with explicit authority to enforce compliance and impose consequences, which is essential for accountability. Without such enforcement, policies become aspirational rather than binding, as no mechanism exists to address non-compliance or ensure corrective actions. This aligns with the CISM principle that governance requires clear accountability structures, including disciplinary measures for violations.

Answer

External auditor

Answer

Internal audit function

Answer

Chief compliance officer

Question 14

After a security incident, the board holds the CISO accountable. The CISO argues that the incident was caused by a failure in the third-party risk management process. Which of the following governance deficiencies is most likely the root cause?

Accepted Answer

There was no board-approved policy for assessing and monitoring third-party risk.. The board holds the CISO accountable because governance ultimately flows from the board's approval of policies. Without a board-approved third-party risk management policy, there is no authoritative mandate to enforce security requirements, conduct assessments, or monitor vendors. This governance gap means the organization lacks the foundational directive that drives all downstream processes, making it the most likely root cause of the incident.

Answer

The third-party contract did not specify security requirements.

Answer

The organization did not implement technical controls to monitor third-party access.

Answer

The incident response plan did not cover third-party related incidents.

Question 15

During a major cybersecurity incident classified as P1, the incident response team has been activated. The crisis management team (CMT) is also convened. Which of the following is the PRIMARY responsibility of the CMT during this incident?

Accepted Answer

Making strategic decisions, managing communications, and allocating resources.. The CMT handles strategic decisions, communication, and resource allocation, while the IR team focuses on technical response.

Answer

Notifying law enforcement and regulatory bodies immediately.

Answer

Directly managing the technical containment and eradication of the threat.

Answer

Performing forensic analysis to identify the root cause of the incident.