CISM Practice Exam 2 — 20 Questions

Question 1

An organization uses a SIEM to correlate security events. The SIEM generates an alert for a possible brute-force attack against an admin account. The incident response team reviews the alert and finds that the account is a service account with a known password. What should the team do NEXT?

Accepted Answer

Change the password for the service account. The correct next step is to change the password for the service account because the alert indicates a possible brute-force attack, and a known password represents a compromised credential. Even if the account is a service account, the password must be rotated to prevent unauthorized access. This aligns with the incident response principle of containing the threat by invalidating the compromised authentication factor.

Answer

Notify the service owner

Answer

Disable the service account

Answer

Investigate the source IP addresses

Question 2

After a security incident, the incident response team identifies that the root cause was a phishing email that bypassed the email filter. The email contained a malicious macro that executed PowerShell commands. Which control would be MOST effective in preventing similar incidents in the future?

Accepted Answer

Disable macros in documents originating from external sources. Disabling macros in documents from external sources directly addresses the attack vector: the malicious macro that executed PowerShell commands. This control prevents the macro from running, regardless of the email filter's failure, by blocking the execution environment at the endpoint level. It is a preventive technical control that stops the attack before it can proceed.

Answer

Implement network segmentation for sensitive systems

Answer

Deploy additional antivirus software on endpoints

Answer

Conduct security awareness training for all employees

Question 3

A financial institution is designing an incident response plan. They want to ensure that during a ransomware incident, critical transaction systems can be restored within 4 hours. Which metric should be used to measure this requirement?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable downtime after a disaster or incident, which directly aligns with the requirement to restore critical transaction systems within 4 hours. In incident management, RTO is the metric used to set the target for system recovery, ensuring business continuity. For ransomware incidents, RTO drives the restoration strategy and resource allocation to meet the 4-hour window.

Answer

Mean Time to Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)

Question 4

An information security manager is developing a program metric to measure the effectiveness of the security awareness training. Which metric is most appropriate?

Accepted Answer

Number of security incidents caused by human error.. The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

Answer

Percentage of employees who completed the training.

Answer

Average score on post-training tests.

Answer

Time taken to complete the training modules.

Question 5

An information security manager is designing a metrics program to report to the board. Which of the following metrics would be MOST meaningful to the board?

Accepted Answer

Percentage of systems with critical vulnerabilities. The board is primarily concerned with strategic risk posture and business impact. Percentage of systems with critical vulnerabilities directly quantifies the organization's exposure to high-severity threats, enabling informed risk acceptance or remediation decisions. This metric aligns with the board's fiduciary duty to oversee risk management, unlike operational details such as incident counts or training completions.

Answer

Number of security incidents reported

Answer

Average patch deployment time

Answer

Number of security awareness training completions

Question 6

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Accepted Answer

Business impact analysis (BIA) results.. A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Answer

Security awareness training for all employees.

Answer

Vulnerability scanning schedules.

Question 7

Which of the following best describes the primary purpose of a security program's governance framework?

Accepted Answer

To provide oversight and alignment with business objectives. The primary purpose of a security program's governance framework is to provide oversight and ensure that security activities are aligned with business objectives, risk appetite, and regulatory requirements. It establishes the policies, roles, and accountability structures that guide decision-making, rather than directly executing technical tasks. This alignment is critical for the program to be sustainable and supported by executive management.

Answer

To implement technical security controls

Answer

To conduct vulnerability assessments

Answer

To manage security incidents

Question 8

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 9

During an incident investigation, the incident response team needs to collect volatile data from a compromised server. Which of the following data should be collected FIRST?

Accepted Answer

Contents of system memory (RAM). Volatile data, such as the contents of system memory (RAM), is lost when the system is powered off. Collecting RAM first preserves evidence of running processes, network connections, and encryption keys that would otherwise be destroyed. This follows the order of volatility (RFC 3227), which mandates capturing the most volatile data first.

Answer

Network connection logs from the firewall

Answer

Contents of the hard drive

Answer

Event logs from the system

Question 10

An organization's security team detects an unusual spike in outbound traffic from a database server to an external IP address during a routine security scan. The database server contains sensitive customer data. Which of the following is the MOST appropriate initial response?

Accepted Answer

Isolate the database server from the network to stop the traffic.. Isolating the database server is the most appropriate initial response because it immediately halts the suspected data exfiltration, containing the incident and preventing further loss of sensitive customer data. In incident management, the priority is to stop the active threat before performing any investigative or notification steps, as per the NIST SP 800-61 incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery). Delaying containment to review logs or run scans allows the exfiltration to continue, increasing the potential damage.

Answer

Notify the data protection officer and legal team.

Answer

Review firewall logs to confirm data exfiltration.

Answer

Run a full antivirus scan on the database server.

Question 11

A multinational corporation is implementing a risk-based approach to information security governance. The chief information security officer (CISO) has been asked to prioritize security initiatives based on business impact. Which of the following actions should the CISO take FIRST to align security governance with business objectives?

Accepted Answer

Conduct a business impact analysis (BIA) to identify critical processes and their security requirements.. Conducting a business impact analysis (BIA) is the foundational step in a risk-based governance approach because it identifies critical business processes, their recovery time objectives (RTOs), and the specific security requirements needed to protect them. Without this analysis, the CISO cannot align security initiatives with business impact, as the BIA directly links security controls to the organization's most valuable assets and operational priorities.

Answer

Enforce multifactor authentication (MFA) for all remote access.

Answer

Implement a compliance management tool to track regulatory requirements.

Answer

Deploy a security information and event management (SIEM) system to centralize log analysis.

Question 12

Based on the exhibit, what is the MOST appropriate next step for the information security manager?

Accepted Answer

Recommend implementing multifactor authentication to reduce the risk. Multifactor authentication (MFA) directly mitigates the most likely attack vector for the identified risk—credential theft or brute-force attacks—by requiring a second factor (e.g., a one-time password from a hardware token or biometric) in addition to the password. Since the exhibit (not shown) indicates a moderate likelihood but high impact, implementing MFA reduces the likelihood to a more acceptable level without requiring a change in risk appetite or transferring the risk. This aligns with the CISM principle of applying cost-effective controls to reduce residual risk to within the organization's risk tolerance.

Answer

Accept the risk because the likelihood is only moderate

Answer

Reassess the risk with a higher risk appetite threshold

Answer

Transfer the risk by purchasing cyber insurance

Question 13

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Accepted Answer

A steering committee that includes senior management and business unit leaders.. A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Answer

An incident response plan that defines roles and procedures.

Answer

A vulnerability scanning schedule and remediation SLAs.

Answer

A firewall policy that specifies allowed and denied traffic.

Question 14

Refer to the exhibit. The security analyst observes these alerts. What is the MOST likely sequence of events?

Accepted Answer

Attacker compromised jsmith's credentials, established C2, and exfiltrated data. The correct sequence is that an attacker compromised jsmith's credentials, established command-and-control (C2) communication, and then exfiltrated data. The alerts show a brute-force or credential-stuffing attempt from an external IP (10.0.0.45) against jsmith's account, followed by an outbound C2 beacon (e.g., DNS or HTTP) from jsmith's workstation, and finally a large data transfer to an external destination. This matches the typical kill chain: initial access via compromised credentials, persistence via C2, and data exfiltration as the final objective.

Answer

Insider threat: jsmith intentionally exfiltrated data

Answer

Network scan from 10.0.0.45 triggered false positives

Answer

Malware downloaded on jsmith's workstation and exfiltrated data

Question 15

An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?

Accepted Answer

Remediate the risk by implementing parameterized queries and input validation. Option C is correct because parameterized queries (prepared statements) and input validation directly address the root cause of SQL injection by separating SQL logic from user-supplied data. This is a remediation (mitigation) strategy that reduces the likelihood of exploitation to an acceptable level, which aligns with the high-risk scenario described.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Avoid the risk by discontinuing the web application

Answer

Accept the risk because the likelihood is low after compensating controls

Question 16

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 17

After a ransomware incident, the incident response team contains the spread and begins eradication. The team discovers that the ransomware encrypted files on a file server and also deleted shadow copies. Which of the following should the team do NEXT to support recovery?

Accepted Answer

Create a forensic image of the file server and affected endpoints.. After containment and eradication, the priority is to preserve evidence for root cause analysis and potential legal action. Creating a forensic image of the file server and affected endpoints captures the ransomware artifacts, encryption keys, and system state before any recovery actions that could overwrite critical data. This aligns with the CISM incident management phase of 'lessons learned' and ensures the team can determine the attack vector and prevent recurrence.

Answer

Restore the encrypted files from the most recent backup.

Answer

Attempt to decrypt the files using available decryption tools.

Answer

Notify law enforcement immediately.

Question 18

Refer to the exhibit. A security analyst reviews the firewall configuration and identifies a potential risk. What is the most likely risk?

Accepted Answer

Risk of data exfiltration via DNS tunneling.. The exhibit shows a firewall rule that permits DNS traffic (UDP/TCP port 53) from the internal network to any external destination. This configuration allows internal hosts to perform DNS queries to external servers, which can be exploited for DNS tunneling—a technique where data is encapsulated within DNS queries and responses to bypass security controls and exfiltrate sensitive information. Since DNS traffic is typically allowed through firewalls, this creates a covert channel for data exfiltration, making option D the most likely risk.

Answer

Risk of unauthorized external access to internal services.

Answer

Risk of denial-of-service attacks from internal hosts.

Answer

Risk of IP spoofing attacks from the inside network.

Question 19

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

Accepted Answer

Accept the risk because the control is not cost-justified.. The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.

Answer

Accept the risk because ALE after control is only $2,500.

Answer

Implement the control because it reduces ALE to $2,500.

Answer

Implement the control because ALE is $10,000, and control cost is only $12,000.

Question 20

An organization is developing a new information security program and wants to ensure it aligns with business objectives. Which of the following is the MOST critical first step?

Accepted Answer

Identify business strategy and risk appetite.. Identifying business strategy and risk appetite is the most critical first step because the information security program must be designed to support the organization's objectives and operate within the risk tolerance defined by leadership. Without this alignment, subsequent security controls and investments may conflict with business goals or fail to address the risks the organization is willing to accept. This ensures that security is a business enabler rather than a technical silo.

Answer

Develop a security awareness training program.

Answer

Design the security architecture based on industry frameworks.

Answer

Conduct a comprehensive risk assessment.