CISM Practice Test 19 — 15 Questions

Question 1

After a major security incident, the board of directors requests a review of the information security program. Which of the following metrics would be MOST useful to demonstrate the effectiveness of the program over the past year?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Number of security incidents detected and contained within defined SLAs. The most useful metric to demonstrate the effectiveness of an information security program is the number of security incidents detected and contained within defined SLAs. This metric directly measures the program's ability to detect and respond to incidents in a timely manner, which is a key indicator of operational effectiveness. It shows how well the program is performing in real-world scenarios.

Answer

Percentage of employees who completed security awareness training

Answer

Total cost of security investments compared to industry benchmarks

Answer

Number of vulnerabilities identified in the latest penetration test

Question 2

An incident response team is dealing with a persistent threat that uses fileless malware. Which containment strategy is most effective?

Accepted Answer

Isolate affected endpoints from the network while preserving memory. Fileless malware resides in memory and often uses legitimate system tools, making traditional disk-based containment ineffective. Isolating affected endpoints from the network while preserving memory is most effective because it prevents lateral movement and exfiltration while allowing forensic analysis of volatile data to understand the attack.

Answer

Disable user accounts

Answer

Block known malicious IPs

Answer

Reimage all endpoints

Question 3

An information security manager is designing the reporting structure for the CISO. Which reporting structure is most likely to ensure independence and adequate authority for the security function?

Accepted Answer

CISO reports to the CEO or board of directors. Reporting to the board or a senior executive not directly responsible for IT operations ensures independence and reduces conflicts of interest.

Answer

CISO reports to the CFO

Answer

CISO reports to the CIO

Answer

CISO reports to the head of internal audit

Question 4

Match each business continuity term to its definition.

Accepted Answer

Business Continuity Plan: A documented set of procedures and information that helps an organization respond to a disruption and resume normal operations.. Correct matches: A-BCP, B-DRP, C-BIA. Common confusions: MTD is about downtime, RPO is about data loss.

Answer

Maximum Tolerable Downtime: The maximum amount of data loss, measured in time, that an organization can accept.

Answer

Recovery Point Objective: The maximum period of time that a system can be unavailable before causing significant harm to the business.

Question 5

An information security manager has identified a risk with a high likelihood and high impact. The cost of mitigating the risk exceeds the potential loss. What is the MOST appropriate risk treatment strategy?

Accepted Answer

Risk acceptance. When the cost of mitigating a risk exceeds the potential loss, the most appropriate strategy is risk acceptance. This means the organization acknowledges the risk and decides to bear the potential loss, as the cost of mitigation is not justified. Risk acceptance is a valid treatment when the risk is within the organization's risk appetite.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 6

An organization's incident response (IR) policy should be approved by which of the following to ensure authority and accountability?

Accepted Answer

The board of directors or executive management. The IR policy requires senior management approval to demonstrate organizational commitment and allocate necessary resources.

Answer

The incident response manager

Answer

The legal counsel

Answer

The IT director

Question 7

A security operations center (SOC) analyst receives an alert from the SIEM indicating a potential command and control (C2) communication. The alert is based on a signature that matches known C2 traffic. What is the MOST appropriate next step?

Accepted Answer

Verify the alert by correlating with other log sources. A SIEM alert based on a signature match is an indicator, not confirmed compromise; signature-based detection can produce false positives. The most appropriate next step is to verify the alert by correlating with other log sources — such as DNS logs, proxy logs, endpoint telemetry, and NetFlow — to determine whether the C2 communication is real and to understand its scope. Only after validation should the analyst escalate, block, or remediate, ensuring incident response resources are not wasted on false positives.

Answer

Block the destination IP address at the firewall

Answer

Escalate the alert to the incident response team immediately

Answer

Perform a full antivirus scan on all endpoints

Question 8

An organization's security program includes a risk assessment process. Which step should be performed FIRST?

Accepted Answer

Establish the risk assessment context. Establishing the risk assessment context (C) is the first step because it defines the scope, objectives, and criteria for the assessment, ensuring alignment with organizational goals and risk appetite. Without this foundational step, subsequent activities like asset identification or risk calculation lack direction and may produce irrelevant or misleading results. In the CISM framework, context setting precedes all technical analysis to ensure the assessment is meaningful and actionable.

Answer

Identify assets and their value

Answer

Calculate the level of risk

Answer

Determine the likelihood of threats

Question 9

A data breach has occurred exposing customer personal information. The risk manager needs to select a response to reduce the likelihood of similar incidents. Which risk response is most appropriate?

Accepted Answer

Mitigate the risk by implementing stronger access controls. Mitigating the risk by implementing stronger access controls directly reduces the likelihood of a similar breach by addressing the root cause—weak or insufficient access management. This is the most appropriate response because the risk manager wants to reduce the probability of recurrence, which is the definition of risk mitigation. It is a targeted, proportionate control rather than an extreme business change or a financial transfer.

Answer

Avoid the risk by discontinuing online services

Answer

Transfer the risk through cyber insurance

Answer

Accept the risk

Question 10

Which THREE characteristics indicate a higher maturity level in a security program maturity model?

Accepted Answer

Continuous improvement. Continuous improvement (B) is a hallmark of higher maturity because it indicates the security program systematically evaluates and enhances its processes based on lessons learned, shifting from static compliance to adaptive risk management. In CISM terms, this aligns with the 'Optimizing' level (Level 5) in the Capability Maturity Model (CMM), where feedback loops drive iterative refinement of controls and policies.

Answer

Reactive approach to incidents

Answer

Ad hoc processes

Question 11

Match each risk management term to its definition.

Accepted Answer

Risk: Effect of uncertainty on objectives. Key risk management terms from CISM: Risk is the effect of uncertainty on objectives; controls are measures that modify risk; vulnerabilities are weaknesses that can be exploited; threats are potential causes of incidents. The distractor pairs swap risk with threat and control with vulnerability.

Answer

Risk: A potential cause of an unwanted incident

Answer

Control: Weakness in an asset or control

Question 12

Following containment of a ransomware incident, the incident response team is conducting a root cause analysis. Which method involves repeatedly asking 'why' to drill down to underlying causes?

Accepted Answer

5 Whys. The 5 Whys technique involves repeatedly asking 'why' to drill down from a symptom to its root cause. It was developed by Sakichi Toyoda and is widely used in incident response and quality management. By asking 'why' five times, teams can uncover underlying process failures rather than stopping at superficial causes.

Answer

Pareto analysis

Answer

SWOT analysis

Answer

Fishbone diagram

Question 13

Which of the following is the BEST metric for the board to assess the security program's effectiveness in detecting threats?

Accepted Answer

Mean time to detect (MTTD). Mean time to detect (MTTD) directly measures how quickly the security program identifies threats, which is the core of detection effectiveness. It is a quantitative metric that the board can use to assess improvement over time and benchmark against industry standards. Other metrics like patch compliance or phishing click rate are preventive or user-awareness measures, not detection performance indicators.

Answer

Patch compliance percentage

Answer

Number of security incidents

Answer

Phishing simulation click rate

Question 14

Which role is primarily responsible for ensuring that information security risks are identified, assessed, and managed within a business unit?

Accepted Answer

Risk owner. The risk owner is the individual within a business unit who is accountable for ensuring that information security risks are identified, assessed, and managed. This role owns the risk treatment plan and is responsible for implementing controls to reduce risk to an acceptable level, as defined by the organization's risk appetite.

Answer

Data owner

Answer

Chief Information Security Officer (CISO)

Answer

Board of directors

Question 15

Which TWO of the following are key components of an information risk management program, as defined by ISACA? (Select exactly two.)

Accepted Answer

Risk appetite and tolerance. ISACA defines risk appetite and tolerance (B) as key components because they establish the amount of risk an organization is willing to accept in pursuit of its objectives, providing the criteria against which risks are evaluated and prioritized. A risk assessment methodology (D) is also essential, as it defines the structured approach (e.g., identifying, analyzing, and evaluating risks per frameworks like ISO 31000 or NIST RMF) used to determine likelihood and impact consistently across the enterprise. Together, these two elements form the governance and analytical backbone of an information risk management program. By contrast, a business continuity plan (A) is a response/recovery capability, a data classification scheme (C) is a supporting control/inventory tool, and vulnerability scanning (E) is a technical detection activity — all valuable, but none are the core program components ISACA identifies.

Answer

Business continuity plan

Answer

Data classification scheme

Answer

Vulnerability scanning process