CISM Practice Test 22 — 15 Questions

Question 1

An organization's SOC team is measured on mean time to detect (MTTD) and mean time to respond (MTTR). The security manager notices that MTTD is low but MTTR is high. What is the most likely cause?

Accepted Answer

The incident response process lacks automation or clear procedures. Low detection time but high response time indicates that while alerts are generated quickly, the response process is slow due to inefficiencies in triage or remediation.

Answer

The team is understaffed during off-hours

Answer

The vulnerability management program is ineffective

Answer

The SIEM is generating too many false positives

Question 2

Which of the following is a key objective of a Security Operations Center (SOC)?

Accepted Answer

Monitoring and responding to security incidents. The SOC's primary objectives include monitoring, detection, and response to security incidents. Risk assessment is typically a GRC function, and policy creation is a governance function.

Answer

Conducting risk assessments

Answer

Developing security policies

Answer

Managing user access rights

Question 3

In a vendor risk assessment, a third-party vendor will have access to sensitive customer data. According to TPRM best practices, what should the organization do first?

Accepted Answer

Conduct a risk assessment. A risk assessment is performed to understand the risks before defining contract requirements and ongoing monitoring.

Answer

Include security requirements in the contract

Answer

Define exit procedures

Answer

Perform ongoing monitoring

Question 4

When designing phishing simulations, which approach best balances user learning and operational disruption?

Accepted Answer

Start with low-difficulty simulations, increase difficulty over time, and require remediation training for clickers. Progressive difficulty and remediation training for clickers helps users learn while minimizing negative impact on productivity.

Answer

Send high-difficulty simulations monthly without training

Answer

Use low-difficulty simulations quarterly with no follow-up

Answer

Send random-difficulty simulations weekly and report clickers to management

Question 5

A company is assessing nth-party risk from a critical cloud provider. Which approach should be taken to manage this risk effectively?

Accepted Answer

Require the cloud provider to contractually manage and report on their subcontractors. Managing nth-party risk requires understanding the cloud provider's supply chain. Contractual requirements for the provider to manage their subcontractors and regular audits help mitigate downstream risks.

Answer

Replace the cloud provider with an in-house solution

Answer

Conduct a direct audit of the provider's subcontractors

Answer

Ignore nth-party risk as it is out of scope

Question 6

When selecting security controls, a company must prioritize which controls first?

Accepted Answer

Controls that address the highest risks and are critical to business operations. Critical controls that address the most significant risks should be implemented first.

Answer

Controls that are least expensive

Answer

Controls that are easiest to implement

Answer

All controls from the chosen framework equally

Question 7

During a security architecture review, the security architect identifies that a new application stores sensitive customer data in plaintext in the database. The application owner argues that performance requirements prevent encryption. What is the most appropriate compensating control to reduce risk?

Accepted Answer

Database activity monitoring (DAM). Database activity monitoring (DAM) can detect unauthorized access or exfiltration attempts, providing visibility and alerting without impacting performance. Encryption at rest is preferred, but DAM is a compensating control when encryption is not feasible.

Answer

Implement strong password policies for database access

Answer

Network segmentation to isolate the database server

Answer

Conduct more frequent vulnerability scans

Question 8

A company uses a SaaS provider that processes sensitive customer data. The provider undergoes annual SOC 2 audits. Which additional step is essential to manage nth-party risk?

Accepted Answer

Require the provider to disclose and assess the security of its subcontractors. Nth-party risk requires understanding the provider's subcontractors; requiring disclosure and assessment of their vendors is key.

Answer

Include a right-to-audit clause for the provider

Answer

Conduct penetration testing on the provider's application

Answer

Review the SOC 2 report annually

Question 9

An organization is designing a security awareness program. Which TWO of the following should be included for developers?

Accepted Answer

Threat modeling techniques. Developers need secure coding and threat modeling to build secure applications.

Answer

Physical security procedures

Answer

Social engineering defense for executives

Answer

General phishing awareness

Question 10

Which TWO of the following are typical components of a security awareness program?

Accepted Answer

Role-based security training. Phishing simulations and role-based training are core components of awareness programs. Penetration testing is a technical assessment, vulnerability scanning is technical, and security architecture is a design function.

Answer

Vulnerability scanning

Answer

Security architecture design

Answer

Penetration testing

Question 11

Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?

Accepted Answer

Phishing click rate. Leading indicators are proactive measures that predict future performance; phishing click rate reflects current behavior that influences future security incidents.

Answer

Number of breaches

Answer

Number of security incidents

Answer

Mean time to detect (MTTD)

Question 12

A security manager needs to justify an increase in the security budget. Which approach provides the strongest quantitative justification?

Accepted Answer

Showing the return on investment using avoided breach costs. Quantifying the financial impact of risks avoided (e.g., using annualized loss expectancy) provides a compelling business case.

Answer

Comparing the budget to industry benchmarks

Answer

Presenting the number of vulnerabilities discovered

Answer

Listing all pending compliance requirements

Question 13

A company has implemented a security awareness program with quarterly phishing simulations. The click rate has remained at 15% for the past two quarters. What is the most effective next step?

Accepted Answer

Implement mandatory remediation training for users who click. Since the click rate is stagnating, the program needs to be adjusted. Remediation training targeted at those who click, combined with increased simulation complexity, can drive improvement.

Answer

Increase the frequency of simulations to monthly

Answer

Discontinue simulations as they are not effective

Answer

Reduce the difficulty of simulations to lower the click rate

Question 14

Which of the following metrics would be MOST useful for measuring the effectiveness of a phishing simulation program?

Accepted Answer

Phishing click rate over time. Trending click rates over time show whether user behavior is improving, directly measuring program effectiveness.

Answer

Percentage of employees who failed the simulation

Answer

Time taken to complete the simulation

Answer

Number of phishing emails reported

Question 15

A security manager is selecting controls for a new application. Which of the following is the BEST approach for prioritization?

Accepted Answer

Prioritize critical controls that address the highest risks. Prioritizing critical controls first ensures the most important risks are addressed before less critical ones.

Answer

Select controls based on vendor recommendations

Answer

Implement controls in the order of ease of deployment

Answer

Implement all controls simultaneously