CISM Practice Test 2 — 10 Questions

Question 1

Which of the following is the BEST approach for sharing threat intelligence indicators of compromise (IoCs) after an incident?

Accepted Answer

Share IoCs with industry peers via the relevant ISAC.. Sharing IoCs with an ISAC (Information Sharing and Analysis Center) helps the broader community defend against similar attacks, which is a key post-incident activity.

Answer

Report IoCs to law enforcement only.

Answer

Keep IoCs confidential to protect the organization's reputation.

Answer

Publish IoCs on the organization's public website.

Question 2

An organization has implemented a data classification policy but notices that employees often mark documents as 'internal use only' even when they contain personally identifiable information (PII). Which of the following is the most effective corrective action for the information security program?

Accepted Answer

Deploy a data loss prevention (DLP) system that automatically classifies documents based on content inspection.. Deploying a data loss prevention (DLP) system that automatically classifies documents based on content inspection directly addresses the root cause of misclassification by removing reliance on user judgment. Option A (policy revision) alone does not enforce compliance. Option B (audits and reprimands) is punitive and may not change behavior. Option C (training) can help but is less effective than automation for consistent classification.

Answer

Revise the data classification policy to simplify categories.

Answer

Conduct random audits and reprimand employees who misclassify data.

Answer

Increase the frequency of data classification training for all employees.

Question 3

A company is implementing a new security program. The CISO wants to ensure alignment with business objectives. Which approach is best?

Accepted Answer

Use the COBIT framework. The COBIT framework (Control Objectives for Information and Related Technologies) is specifically designed to bridge the gap between IT governance and business goals, providing a comprehensive set of controls and processes that align security program objectives with enterprise strategy. Unlike other options, COBIT directly addresses governance, risk management, and performance measurement in a way that ensures the security program supports business objectives rather than operating in isolation.

Answer

Implement technical controls

Answer

Develop policies based on industry standards

Answer

Perform a risk assessment

Question 4

Order the steps for establishing a security incident response team (IRT).

Accepted Answer

Define roles and responsibilities, then Recruit team members, then Develop incident response procedures, then Acquire necessary tools and resources, then Test and validate the IRT plan. Building an IRT starts with defining roles, then recruiting, developing procedures, acquiring tools, and testing.

Answer

Recruit team members, then Define roles and responsibilities, then Develop incident response procedures, then Acquire tools, then Test

Answer

Define roles, then Acquire tools, then Recruit, then Develop procedures, then Test

Answer

Develop procedures, then Define roles, then Recruit, then Acquire tools, then Test

Question 5

Arrange the steps for implementing a new firewall rule in an enterprise environment.

Accepted Answer

Identify requirement, Submit change request, Test in staging, Implement on production, Verify rule operation. Firewall changes require clear objectives, change control, testing, implementation, and verification.

Answer

Test in staging, Implement on production, Identify requirement, Submit change request, Verify rule operation

Answer

Submit change request, Identify requirement, Test in staging, Implement on production, Verify rule operation

Answer

Identify requirement, Test in staging, Implement on production, Submit change request, Verify rule operation

Question 6

During a review of the information security program, the security manager discovers that the program's objectives are not aligned with the organization's strategic business goals. What is the best course of action?

Accepted Answer

Revise the program objectives to align with business goals.. The CISM framework emphasizes that an information security program must be directly aligned with the organization's strategic business goals to ensure that security investments support business objectives rather than hinder them. Revising the program objectives to align with business goals (Option B) is the correct course of action because it ensures that security controls, risk appetite, and resource allocation are driven by business needs, not isolated technical requirements. This alignment is a core principle of the Information Security Program domain, as misalignment can lead to wasted resources, reduced executive support, and increased business risk.

Answer

Justify the existing objectives to management to demonstrate their value.

Answer

Implement additional security controls to compensate for the misalignment.

Answer

Escalate the issue to the board of directors without changes.

Question 7

Which THREE are components of the Plan phase in a security program lifecycle (e.g., ISO 27001 PDCA)?

Accepted Answer

Risk assessment. Risk assessment is a core component of the Plan phase in the ISO 27001 PDCA (Plan-Do-Check-Act) security program lifecycle. During this phase, the organization identifies, analyzes, and evaluates information security risks to establish the context, scope, and risk treatment criteria that will guide the selection of controls and objectives. Without a formal risk assessment, the subsequent phases lack a risk-based foundation, making the program reactive rather than proactive.

Answer

Monitoring and review

Answer

Implementation of controls

Question 8

Order the steps for implementing a security awareness training program.

Accepted Answer

Needs Assessment, then Content Development, then Delivery, then Evaluation, then Continuous Improvement. Training programs start with needs assessment, then content development, delivery, evaluation, and continuous improvement.

Answer

Content Development, then Needs Assessment, then Delivery, then Evaluation, then Continuous Improvement

Answer

Needs Assessment, then Content Development, then Delivery, then Continuous Improvement, then Evaluation

Answer

Needs Assessment, then Content Development, then Evaluation, then Delivery, then Continuous Improvement

Question 9

An organization is updating its incident response plan. Which TWO components should be included to ensure effective evidence handling? (Select TWO.)

Accepted Answer

Evidence handling procedures. Evidence handling procedures (B) are essential because they define the step-by-step methods for identifying, collecting, preserving, and documenting digital evidence so it remains admissible and unaltered, covering actions like write-blocking drives and hashing files. Chain of custody forms (E) are equally required because they create the documented, unbroken record of who handled each piece of evidence, when, and for what purpose, which is critical for proving integrity in legal or disciplinary proceedings. Together, B and E directly address the core of evidence handling in an incident response plan. The other options, while useful in a broader IR plan, do not specifically ensure evidence handling: A (incident notification template) supports communication, C (law enforcement contacts) supports escalation, and D (list of acceptable forensic tools) supports tooling choices but does not itself govern evidence integrity or custody.

Answer

A template for incident notifications

Answer

Contact information for law enforcement

Answer

A list of acceptable forensic tools

Question 10

During a major cybersecurity incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the CEO as a member of the CMT?

Accepted Answer

Authorizing external communications and resource allocation. The CEO provides strategic direction and approves major decisions, such as activating business continuity or communicating externally, while the CISO leads the technical response.

Answer

Updating the incident response playbook

Answer

Directing the technical containment efforts

Answer

Conducting forensic analysis of affected systems