CISM Practice Exam 2 — 20 Questions

Question 1

Which of the following best describes residual risk?

Accepted Answer

Risk that remains after implementing controls. Residual risk is defined in information security risk management as the risk that remains after management has implemented all planned controls. This concept is central to the CISM framework because it represents the exposure that must be accepted, transferred, or further mitigated by the organization. Unlike inherent risk (before controls), residual risk accounts for the effectiveness of the security measures in place.

Answer

Risk before any controls are applied

Answer

The likelihood that a control will fail

Answer

The level of risk an organization is willing to accept

Question 2

A company experiences ransomware that encrypts critical servers. Backups are available but were taken 2 weeks ago. What is the best course?

Accepted Answer

Restore from backups after verifying no residual malware and performing security scans. Restore from backups after verifying no residual malware and performing security scans to ensure clean restoration.

Answer

Restore from backups immediately

Answer

Rebuild servers from scratch

Answer

Pay the ransom

Question 3

An organization has just experienced a ransomware attack that encrypted files on several file servers. The incident response team has contained the incident. What is the next critical step?

Accepted Answer

Restore files from clean backups.. Restore files from clean backups, as this is the most reliable recovery method after containment. Paying the ransom is discouraged and does not guarantee data recovery; notifying law enforcement can be done later; wiping and reimaging may be unnecessary if clean backups are available.

Answer

Pay the ransom to recover data.

Answer

Wipe the affected servers and reimage them.

Answer

Notify law enforcement.

Question 4

During a review of the information security program, the security manager discovers that the program's objectives are not aligned with the organization's strategic business goals. What is the best course of action?

Accepted Answer

Revise the program objectives to align with business goals.. The CISM framework emphasizes that an information security program must be directly aligned with the organization's strategic business goals to ensure that security investments support business objectives rather than hinder them. Revising the program objectives to align with business goals (Option B) is the correct course of action because it ensures that security controls, risk appetite, and resource allocation are driven by business needs, not isolated technical requirements. This alignment is a core principle of the Information Security Program domain, as misalignment can lead to wasted resources, reduced executive support, and increased business risk.

Answer

Justify the existing objectives to management to demonstrate their value.

Answer

Implement additional security controls to compensate for the misalignment.

Answer

Escalate the issue to the board of directors without changes.

Question 5

Order the steps for establishing a security incident response team (IRT).

Accepted Answer

Define roles and responsibilities, then Recruit team members, then Develop incident response procedures, then Acquire necessary tools and resources, then Test and validate the IRT plan. Building an IRT starts with defining roles, then recruiting, developing procedures, acquiring tools, and testing.

Answer

Recruit team members, then Define roles and responsibilities, then Develop incident response procedures, then Acquire tools, then Test

Answer

Define roles, then Acquire tools, then Recruit, then Develop procedures, then Test

Answer

Develop procedures, then Define roles, then Recruit, then Acquire tools, then Test

Question 6

Arrange the steps for implementing a new firewall rule in an enterprise environment.

Accepted Answer

Identify requirement, Submit change request, Test in staging, Implement on production, Verify rule operation. Firewall changes require clear objectives, change control, testing, implementation, and verification.

Answer

Test in staging, Implement on production, Identify requirement, Submit change request, Verify rule operation

Answer

Submit change request, Identify requirement, Test in staging, Implement on production, Verify rule operation

Answer

Identify requirement, Test in staging, Implement on production, Submit change request, Verify rule operation

Question 7

Refer to the exhibit. An analyst sees this alert on the network. What is the most appropriate immediate action?

Accepted Answer

Investigate the source endpoint for compromise. The alert indicates a potential command-and-control (C2) communication, likely involving a beaconing pattern to an external IP. Investigating the source endpoint for compromise is the most appropriate immediate action because it allows the incident responder to determine if the host is actively compromised, collect forensic evidence, and contain the threat before it escalates. Blocking IPs prematurely could destroy evidence or alert the attacker, while ignoring the alert risks missing a confirmed breach.

Answer

Ignore the alert as it is likely false positive

Answer

Block the source IP 10.0.1.50

Answer

Block the destination IP 203.0.113.5

Question 8

An organization is designing a policy exception management process. Which THREE elements are critical for this process to be effective?

Accepted Answer

Approval by the CISO or designated authority. Effective exception management requires formal documentation, time limits, and review by appropriate authority to prevent misuse.

Answer

Automatic approval if no response within 24 hours

Answer

Ability for any employee to request an exception

Question 9

Match each data classification level to its handling requirement.

Accepted Answer

Public: No special handling required. Data classification levels determine handling requirements: Public (no special handling), Internal (limited access), Confidential (authorized access only), Restricted (highest protection). Common confusions involve swapping handling requirements between levels.

Answer

Public: Access restricted to authorized personnel only

Answer

Internal: No special handling required

Question 10

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Accepted Answer

Business impact analysis (BIA) results.. A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Answer

Security awareness training for all employees.

Answer

Vulnerability scanning schedules.

Question 11

Order the steps for implementing a security awareness training program.

Accepted Answer

Needs Assessment, then Content Development, then Delivery, then Evaluation, then Continuous Improvement. Training programs start with needs assessment, then content development, delivery, evaluation, and continuous improvement.

Answer

Content Development, then Needs Assessment, then Delivery, then Evaluation, then Continuous Improvement

Answer

Needs Assessment, then Content Development, then Delivery, then Continuous Improvement, then Evaluation

Answer

Needs Assessment, then Content Development, then Evaluation, then Delivery, then Continuous Improvement

Question 12

Match each security framework to its primary purpose.

Accepted Answer

COBIT: A framework for IT governance and management.. COBIT is for IT governance, ISO 27001 for ISMS, and NIST CSF for cybersecurity risk management. The distractors swap definitions between COBIT and ISO 27001.

Answer

COBIT: A standard for information security management systems.

Answer

ISO 27001: A framework for IT governance and management.

Question 13

Which THREE of the following are challenges in implementing information security governance in a decentralized organization?

Accepted Answer

Redundant security controls and tools. In a decentralized organization, each business unit often selects its own security tools and controls, leading to redundant security controls and tools across the enterprise. This redundancy increases costs, creates management complexity, and can introduce gaps in coverage due to inconsistent integration. The lack of centralized oversight means that duplicate solutions for the same function (e.g., multiple endpoint protection platforms) are common, making unified monitoring and maintenance difficult.

Answer

Unified risk reporting

Answer

Centralized incident response

Question 14

A company is evaluating its risk management process. The CISM notices that risks are being assessed based on qualitative scales (low, medium, high) but decisions require quantitative data. What is the most effective action to improve the process?

Accepted Answer

Use a hybrid approach that includes both qualitative and quantitative assessments.. A hybrid approach (Option B) is most effective because it leverages qualitative scales for initial, rapid risk identification and prioritization, while quantitative data (e.g., ALE, SLE, ARO) provides the monetary rigor needed for cost-benefit analysis and management decisions. This aligns with ISACA's guidance that risk assessment should be tailored to the decision context, not purely one method.

Answer

Switch to a fully quantitative risk assessment methodology.

Answer

Replace qualitative scales with precise monetary values.

Answer

Continue using qualitative method since it is simpler.

Question 15

After a security incident, the incident response team identifies that the root cause was a phishing email that bypassed the email filter. The email contained a malicious macro that executed PowerShell commands. Which control would be MOST effective in preventing similar incidents in the future?

Accepted Answer

Disable macros in documents originating from external sources. Disabling macros in documents from external sources directly addresses the attack vector: the malicious macro that executed PowerShell commands. This control prevents the macro from running, regardless of the email filter's failure, by blocking the execution environment at the endpoint level. It is a preventive technical control that stops the attack before it can proceed.

Answer

Implement network segmentation for sensitive systems

Answer

Deploy additional antivirus software on endpoints

Answer

Conduct security awareness training for all employees

Question 16

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 17

Which of the following is the PRIMARY goal of incident containment?

Accepted Answer

To prevent further damage and limit the scope of the incident.. The primary goal of incident containment is to stop the incident from spreading and to limit the scope of damage. This is the immediate priority because, without containment, the attacker may continue to compromise additional systems, exfiltrate data, or escalate privileges. Options A, B, and C are important subsequent steps but are secondary to the urgent need to halt the incident's progression.

Answer

To gather evidence for prosecution.

Answer

To recover systems to normal operation.

Answer

To identify the root cause.

Question 18

A company's incident response team uses a SIEM to detect security events. Which SIEM capability is MOST critical for early detection of a potential incident?

Accepted Answer

Correlation rules. Correlation rules are the most critical SIEM capability for early detection because they allow the incident response team to define specific patterns of activity (e.g., multiple failed logins followed by a successful login from a different geographic location) that indicate a potential security incident. Unlike raw log review or simple alerting, correlation rules reduce false positives by combining multiple data sources and time-based conditions, enabling the SIEM to identify complex attack chains at the earliest possible stage. Without correlation, the team would rely on manual log analysis or isolated alerts, which significantly delays detection.

Answer

Real-time alerting

Answer

User and entity behavior analytics (UEBA)

Answer

Long-term log retention

Question 19

Refer to the exhibit. The CISO wants to improve the program. Which recommendation BEST addresses the main gap shown in the dashboard?

Accepted Answer

Implement automated patching for high-risk vulnerabilities. The dashboard shows high-risk vulnerability remediation at 88%, which is below the target. Implementing automated patching for high-risk vulnerabilities would directly address this gap by ensuring faster and more consistent remediation. Option B is incorrect because reducing the compliance target does not fix the underlying issue. Option C is incorrect because critical vulnerability remediation is already high. Option D is incorrect because increasing patch frequency for all systems may not specifically target the high-risk vulnerability gap.

Answer

Reduce the compliance target for high-risk vulnerabilities to 90 days

Answer

Focus on critical vulnerability remediation

Answer

Increase patch frequency for all systems

Question 20

An organization wants to measure the effectiveness of its security awareness programme. Which metric is a leading indicator of improved security culture?

Accepted Answer

Number of phishing emails reported by employees. An increase in the number of phishing emails reported by employees indicates that they are actively recognizing and reporting suspicious activity, which is a leading indicator of improved security awareness and culture.

Answer

Number of security incidents attributed to human error

Answer

Percentage of employees who completed annual training

Answer

Average score on knowledge assessment tests