CISM Practice Exam 4 — 20 Questions

Question 1

Match each business continuity term to its definition.

Question 2

Match each risk management term to its definition.

Question 3

Match each security metric to its description.

Question 4

Match each security framework to its primary purpose.

Question 5

Match each cryptographic term to its description.

Question 6

Match each incident management phase to its activity.

Question 7

Match each security role to its primary responsibility.

Question 8

Which of the following are key components of an Information Security Risk Management program? (Select TWO.)

Accepted Answer

Establishing a risk management framework. A is correct because establishing a risk management framework is the foundational component of an Information Security Risk Management program. It defines the policies, procedures, and governance structure for identifying, assessing, and treating risks, aligning with standards like ISO 31000 or NIST SP 800-39. Without a framework, risk management activities lack consistency and accountability.

Answer

Conducting vulnerability scanning

Answer

Performing internal audits

Question 9

An information security manager has identified a risk with a high likelihood and high impact. The cost of mitigating the risk exceeds the potential loss. What is the MOST appropriate risk treatment strategy?

Accepted Answer

Risk acceptance. When mitigation cost exceeds potential loss, risk acceptance is appropriate if the risk is within the organization's risk appetite. Alternatively, risk transfer (e.g., insurance) could be considered, but acceptance is often the primary choice when the cost-benefit is negative.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 10

After a major security incident, the board of directors requests a review of the information security program. Which of the following metrics would be MOST useful to demonstrate the effectiveness of the program over the past year?

Accepted Answer

Number of security incidents detected and contained within defined SLAs. The number of incidents detected and contained within defined SLAs directly measures the program's ability to detect and respond to threats, which is a key indicator of operational effectiveness. Other metrics may be useful but do not directly measure the program's performance in protecting the organization.

Answer

Percentage of employees who completed security awareness training

Answer

Total cost of security investments compared to industry benchmarks

Answer

Number of vulnerabilities identified in the latest penetration test

Question 11

During a risk assessment, a security manager discovers that the residual risk after implementing planned controls is still above the risk appetite threshold. What should the manager do NEXT?

Accepted Answer

Escalate the residual risk to senior management. When residual risk exceeds the risk appetite threshold after planned controls, the security manager cannot simply accept or ignore it; the risk must be escalated to senior management because they hold the authority to decide whether to accept the risk, allocate additional budget for further controls, or adjust the risk appetite. This aligns with the CISM domain of Information Security Risk Management, where risk acceptance is a management decision, not an operational one.

Answer

Implement additional controls immediately

Answer

Document the risk as accepted

Answer

Reassess the risk using a different methodology

Question 12

Which of the following are key components of an information security risk management program? (Select TWO)

Accepted Answer

Risk assessment. Risk assessment is a core component of an information security risk management program because it systematically identifies, analyzes, and evaluates risks to information assets. It provides the foundational understanding of threats, vulnerabilities, and impacts necessary for informed decision-making. Without a formal risk assessment, the program lacks the data needed to prioritize and justify security investments.

Answer

Vulnerability scanning

Answer

Incident response

Question 13

A security manager is presenting risk analysis results to the board. Which of the following should the manager include to effectively communicate risk? (Select THREE)

Accepted Answer

Monetary value of potential losses. Monetary value of potential losses (A) is correct because it translates technical risk into financial terms that board members understand, enabling informed decisions on resource allocation for risk mitigation. This aligns with the CISM focus on business-aligned risk communication, where quantitative metrics like Annualized Loss Expectancy (ALE) directly support cost-benefit analysis.

Answer

Detailed technical vulnerabilities

Answer

Anecdotal stories of past incidents

Question 14

An organization's information security program includes a formal exception process. When reviewing an exception request to bypass a critical control, what is the MOST important factor for the information security manager to consider?

Accepted Answer

The residual risk after compensating controls. The most important factor when reviewing an exception request to bypass a critical control is the residual risk after compensating controls. This ensures that the organization's risk appetite is not exceeded and that the compensating controls adequately mitigate the risk to an acceptable level, as required by frameworks like ISO 27001 and NIST SP 800-53.

Answer

The cost of implementing the control

Answer

The number of users affected by the exception

Answer

The duration of the exception

Question 15

Which of the following are key components of an effective information security program? (Select TWO.)

Accepted Answer

A risk management framework. A risk management framework is a key component because it provides a structured, repeatable process for identifying, assessing, and mitigating information security risks. It ensures that security investments and controls are aligned with business objectives and risk appetite, rather than being ad hoc or technology-driven. Without a risk management framework, an information security program lacks the foundational governance to prioritize threats and allocate resources effectively.

Answer

State-of-the-art security tools and technologies

Answer

A large security operations center

Answer

Compliance with all applicable laws

Question 16

An information security manager is evaluating the maturity of the organization's security program. Which of the following indicators suggest a high level of maturity? (Select TWO.)

Accepted Answer

Security metrics are included in regular executive reports. Option B is correct because including security metrics in regular executive reports demonstrates that security performance is being measured, tracked, and communicated to leadership as part of ongoing governance. This aligns with a mature security program where security is integrated into business decision-making, not treated as a siloed technical function.

Answer

All security incidents are resolved within 24 hours

Answer

The program uses the latest encryption standards

Answer

The security team conducts annual penetration tests

Question 17

Match the following security program components with their primary purpose by dragging each component to the correct description.

Answer

Security Policy

Answer

Incident Response Plan

Answer

Risk Assessment

Answer

Describes the organization's high-level security objectives and management commitment

Answer

Provides step-by-step actions to detect, respond, and recover from security incidents

Answer

Identifies threats, vulnerabilities, and impacts to determine risk levels

Question 18

Which of the following is the PRIMARY responsibility of a steering committee in an information security program?

Accepted Answer

Providing strategic direction and oversight. The steering committee's primary role is to provide strategic direction and oversight for the information security program, ensuring alignment with business objectives and risk appetite. This includes approving the overall security strategy, budget, and major initiatives, rather than engaging in operational tasks like policy drafting or technical assessments.

Answer

Approving individual security policies

Answer

Conducting vulnerability assessments

Answer

Implementing security controls

Question 19

An organization's information security program is based on a risk management framework. Which of the following BEST describes the role of the information security manager in this context?

Accepted Answer

Designing and managing the security program. The information security manager is responsible for designing and managing the security program based on the risk management framework. This includes translating risk assessment results into security controls, policies, and procedures, and ensuring the program aligns with the organization's risk posture. The manager does not set risk appetite (that is a board-level decision) nor own all risks (risk owners are business process owners).

Answer

Setting the organization's risk appetite

Answer

Owning all information security risks

Answer

Conducting internal audits of controls

Question 20

An organization has implemented a balanced scorecard to measure the effectiveness of its information security program. Which of the following metrics would be MOST appropriate for the 'internal processes' perspective?

Accepted Answer

Mean time to detect and respond to incidents. The 'internal processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of the operational workflows that deliver the security program. Mean time to detect (MTTD) and mean time to respond (MTTR) directly measure the performance of the incident response process, which is a core internal process. This metric reflects how quickly the organization can identify and contain threats, making it the most appropriate choice for this perspective.

Answer

Percentage of systems compliant with baseline

Answer

Percentage of users who completed security awareness training

Answer

Number of security incidents reported to management