CISM Practice Exam 3 — 20 Questions

Question 1

A large enterprise is implementing a new governance framework. The board has approved a risk appetite statement. What is the MOST important next step for the information security manager?

Accepted Answer

Define risk acceptance criteria and thresholds. Once the board has approved a risk appetite statement, the information security manager must translate that high-level appetite into actionable risk acceptance criteria and thresholds. This step is critical because it defines the specific boundaries (e.g., maximum acceptable monetary loss per incident, maximum tolerable downtime) that guide all subsequent risk treatment decisions. Without these criteria, technical controls (Option A) and training (Option D) cannot be properly scoped, and audit plans (Option B) would lack measurable benchmarks.

Answer

Implement technical controls to reduce risks

Answer

Develop an audit plan to monitor risk levels

Answer

Conduct security awareness training for employees

Question 2

A security analyst receives an alert from the SIEM indicating a high number of failed login attempts from a single external IP address targeting a public-facing web server. The analyst checks the logs and sees that the attempts are using common usernames. What is the MOST appropriate immediate response?

Accepted Answer

Block the IP address at the firewall.. The immediate response to a brute-force attack from a single external IP is to block that IP at the firewall. This stops the attack at the network perimeter, preventing further authentication attempts without affecting legitimate users (assuming the IP is not a known legitimate source). Delaying action could allow the attacker to compromise an account via password guessing, especially since common usernames are being targeted.

Answer

Ignore the alert as it is likely a false positive.

Answer

Disable the web server.

Answer

Notify law enforcement.

Question 3

After an incident is contained and eradicated, the incident response team conducts a post-incident review. Which of the following is the PRIMARY objective of this review?

Accepted Answer

Identify process improvements. The primary objective of a post-incident review is to identify process improvements that enhance the organization's incident response capabilities. This aligns with the CISM focus on continuous improvement, ensuring that lessons learned are captured and applied to prevent recurrence or improve future response efficiency.

Answer

Update security policies

Answer

Determine the financial impact

Answer

Assign blame to the responsible parties

Question 4

A company's IDS alerts on a potential breach. The incident response team is called. What should they do immediately?

Accepted Answer

Verify the alert and assess scope. The immediate priority upon receiving an IDS alert is to verify the alert's validity and assess the scope of the potential breach. This ensures the incident response team does not waste resources on false positives and can accurately determine the affected systems, data, and network segments before taking containment actions. Verification typically involves correlating the IDS signature with actual packet captures, logs, and system telemetry to confirm malicious activity.

Answer

Disconnect all network cables

Answer

Notify law enforcement

Answer

Reimage affected systems

Question 5

Arrange the steps for responding to a data breach involving personally identifiable information (PII).

Accepted Answer

Step 1: Containment, Step 2: Evidence Preservation, Step 3: Internal Notification, Step 4: Impact Assessment, Step 5: External Notification. Incident response begins with containment, then evidence preservation, internal notification, impact assessment, and external notification.

Answer

Step 1: Impact Assessment, Step 2: Containment, Step 3: Evidence Preservation, Step 4: Internal Notification, Step 5: External Notification

Answer

Step 1: External Notification, Step 2: Internal Notification, Step 3: Containment, Step 4: Evidence Preservation, Step 5: Impact Assessment

Answer

Step 1: Evidence Preservation, Step 2: Containment, Step 3: Internal Notification, Step 4: Impact Assessment, Step 5: External Notification

Question 6

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

Accepted Answer

The impact of losing both primary and backup data is unacceptably high. The core principle of risk acceptance requires that the residual risk be within the organization's risk appetite. In this scenario, the backup data is stored onsite without encryption, meaning a single physical breach (e.g., fire, theft, or natural disaster) could destroy both primary and backup data simultaneously. The impact of losing all data—potentially leading to business failure—is unacceptably high, outweighing the low likelihood of a physical breach. The risk owner's acceptance is invalid because the risk exceeds the organization's risk tolerance, as per CISM's risk management framework.

Answer

The risk owner does not have authority to accept risks

Answer

Encryption is not required as the facility is secure

Answer

The cost of implementing encrypted offsite backups is minimal

Question 7

After a security incident, the incident response team prepares a report detailing the root cause, impact, and lessons learned. Who is the PRIMARY audience for this report?

Accepted Answer

Senior management and the board of directors. The primary audience for a post-incident report detailing root cause, impact, and lessons learned is senior management and the board of directors. They require this information to make strategic decisions about risk acceptance, resource allocation for remediation, and to fulfill fiduciary duties regarding cybersecurity governance. The report provides the business context and financial impact necessary for executive-level oversight, not the technical details needed by operational teams.

Answer

The affected users

Answer

The IT support team

Answer

External auditors

Question 8

A small accounting firm with 50 employees recently suffered a ransomware attack that encrypted all client data on its file server. The firm had no backup strategy, and the attackers demanded a ransom for decryption. The firm paid the ransom, but many clients left due to loss of trust. The firm’s owner has now hired you as a part-time risk manager. Your first task is to develop a risk management program. What is the most appropriate initial step?

Accepted Answer

Conduct a risk assessment to identify assets, threats, and vulnerabilities. The first step in developing a risk management program, per the CISM framework, is to conduct a risk assessment. This identifies the specific assets (e.g., client data on the file server), threats (e.g., ransomware), and vulnerabilities (e.g., lack of backups, weak access controls) that led to the incident. Without this foundational analysis, any subsequent controls—such as backups or insurance—would be misaligned with the firm's actual risk profile, potentially wasting resources on ineffective measures.

Answer

Purchase a comprehensive cyber insurance policy

Answer

Fire the IT staff responsible for the security failures

Answer

Immediately implement a backup and disaster recovery solution

Question 9

A small business is developing its first information security program. Which approach is most effective?

Accepted Answer

Conduct a risk assessment to identify key assets and threats.. Conducting a risk assessment (Option C) is the foundational step in building an information security program because it identifies the specific assets, threats, vulnerabilities, and impacts unique to the small business. Without this context, any controls or frameworks applied would be misaligned with the actual risk profile, leading to wasted resources and potential security gaps. The CISM framework emphasizes that risk assessment drives the selection of cost-effective, prioritized controls tailored to the organization's needs.

Answer

Hire an external security consultant to design the entire program.

Answer

Adopt a comprehensive framework like ISO 27001 immediately.

Answer

Purchase and deploy a next-generation firewall.

Question 10

An organization has a policy to share indicators of compromise (IoCs) with an Information Sharing and Analysis Center (ISAC). This activity is most closely associated with which phase of incident management?

Accepted Answer

Post-incident activity. Sharing IoCs with ISACs is a post-incident activity aimed at improving collective defense and preventing future incidents.

Answer

Preparation

Answer

Containment, eradication, and recovery

Answer

Detection and analysis

Question 11

An information security manager is asked to report on the effectiveness of the security program. Which metric would BEST indicate governance effectiveness?

Accepted Answer

Percentage of security initiatives directly linked to business strategy. Governance effectiveness is measured by how well the security program aligns with and supports business objectives. Option A directly reflects this alignment by showing the percentage of security initiatives tied to business strategy, which is a key indicator of strategic governance rather than operational or tactical performance.

Answer

Number of critical vulnerabilities identified

Answer

Number of audit findings per quarter

Answer

Mean time to detect and respond to incidents

Question 12

Which THREE of the following are appropriate members of a crisis management team (CMT) for a major cybersecurity incident? (Select three.)

Accepted Answer

General Counsel (GC). The General Counsel (GC) is a critical member of the CMT because a major cybersecurity incident (e.g., a data breach involving PII) triggers legal obligations under regulations like GDPR, HIPAA, or SOX. The GC provides real-time advice on legal hold, breach notification timelines, and attorney-client privilege, ensuring the organization's response does not create additional liability or waive legal protections.

Answer

Security analyst

Answer

Forensic investigator

Question 13

Which THREE of the following are common challenges in incident response? (Select exactly 3)

Accepted Answer

Poor coordination between teams. Poor coordination between teams (Option B) is a common challenge in incident response because security incidents often require collaboration across IT, legal, PR, and management. Without clear communication channels and predefined roles, response efforts become fragmented, leading to delays in containment and recovery. This is a well-documented issue in frameworks like NIST SP 800-61, which emphasizes the need for a coordinated incident response plan.

Answer

Over-reliance on cloud services

Answer

Difficulty in identifying the root cause

Question 14

A bank detects unusual activity on a server containing sensitive financial data. The activity appears to be from a compromised vendor account that has legitimate remote access to the server for maintenance. The incident manager must decide on containment while maintaining business operations. The vendor account has elevated privileges and is used for routine updates. Disabling the account would delay critical maintenance. What is the BEST course of action?

Accepted Answer

Isolate the affected server from the network while allowing necessary access through a jump box.. The best course of action because it isolates the compromised server from the main network while still allowing legitimate vendor maintenance through a controlled jump box. This balances security and business continuity. Option A is ineffective as the vendor may be compromised or unaware. Option C is too disruptive and would halt critical updates. Option D is overly broad and could impact other necessary remote access.

Answer

Contact the vendor to ask about the unusual activity.

Answer

Disable the vendor's account immediately.

Answer

Block all remote access from external IPs.

Question 15

An information security manager is evaluating the effectiveness of the organization's security governance. Which of the following metrics would best indicate that governance processes are functioning properly?

Accepted Answer

Percentage of risk treatment plans that have been implemented as scheduled.. The percentage of risk treatment plans implemented as scheduled directly measures whether the governance process is translating risk decisions into action. Effective governance ensures that risk owners execute agreed-upon treatments within defined timelines, reflecting accountability and process adherence. This metric aligns with the CISM governance principle that oversight should focus on outcomes of risk management activities, not just operational metrics.

Answer

Total spending on security tools compared to the approved budget.

Answer

Number of security incidents reported per quarter.

Answer

Mean time to detect (MTTD) for security incidents.

Question 16

Order the steps for conducting an internal audit of an information security management system (ISMS) based on ISO 27001.

Accepted Answer

Scope definition, then Planning, then Execution, then Documentation, then Reporting. Audits start with scope definition, planning, execution, documentation, and reporting.

Answer

Planning, then Scope definition, then Execution, then Documentation, then Reporting

Answer

Scope definition, then Planning, then Reporting, then Execution, then Documentation

Answer

Scope definition, then Execution, then Planning, then Documentation, then Reporting

Question 17

Which TWO actions are essential during the detection and analysis phase of incident response?

Accepted Answer

Determine the scope of the incident. Determining the scope of the incident (C) is essential during the detection and analysis phase because it defines the boundaries of the compromise—identifying which systems, data, and users are affected. This step is critical for prioritizing response actions and preventing the incident from spreading further. Without scope determination, subsequent containment and eradication efforts may be misdirected or incomplete.

Answer

Notify law enforcement

Answer

Disconnect affected systems

Answer

Rebuild systems

Question 18

Match each CISM domain to its focus area.

Accepted Answer

Information Security Governance: Establishing and maintaining a framework to ensure information security strategies are aligned with business objectives.. The CISM domains are: Governance (strategy alignment), Risk Management (risk identification and management), Program Development (design and implementation), and Incident Management (detection and response). Common confusions include swapping program development with governance and incident management with risk management.

Answer

Information Security Governance: Designing and implementing security solutions.

Answer

Information Risk Management: Responding to security incidents.

Question 19

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Accepted Answer

A steering committee that includes senior management and business unit leaders.. A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Answer

An incident response plan that defines roles and procedures.

Answer

A vulnerability scanning schedule and remediation SLAs.

Answer

A firewall policy that specifies allowed and denied traffic.

Question 20

A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)

Accepted Answer

Employee role and job function. Employee role, past click rates, and current threat landscape help tailor simulations for effectiveness and relevance.

Answer

Employee's years of service

Answer

Number of security incidents in the past year