CISM Practice Test 23 — 15 Questions

Question 1

During a major incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the communications lead on the CMT?

Accepted Answer

Coordinating all external and internal communications. The communications lead manages external and internal messaging, including media and customer notifications.

Answer

Authorizing financial expenditures for incident response

Answer

Directing technical containment efforts

Answer

Preserving digital evidence for litigation

Question 2

An organization is developing a vendor risk management program. Which TWO of the following should be included in the vendor onboarding risk assessment?

Accepted Answer

Verification of security certifications (e.g., SOC 2, ISO 27001). Onboarding assessment should evaluate inherent risk (data access) and security capabilities (certifications).

Answer

Vendor's employee satisfaction surveys

Answer

Review of vendor's financial stability

Answer

Vendor's marketing materials

Question 3

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have major business impact and require immediate executive notification and round-the-clock response.

Answer

P2 — High

Answer

P3 — Medium

Answer

P4 — Low

Question 4

Following a major security incident, the lessons learned meeting is scheduled. Which of the following outcomes is MOST important to ensure the effectiveness of future incident response?

Accepted Answer

Updating the incident response plan and playbooks based on findings. The primary outcome of a lessons learned meeting is to identify improvements and update the IR plan, not just document or blame.

Answer

Conducting a new risk assessment

Answer

Creating a detailed report for senior management

Answer

Assigning blame to responsible parties

Question 5

A security manager is designing a security budget for a mid-sized company. Which TWO of the following are typical components of a security budget?

Accepted Answer

Technology costs for security tools and infrastructure.. Security budgets typically include personnel costs (salaries) and technology costs (tools, software). Training and licensing are also common but may be subsumed under personnel or technology.

Answer

Legal fees for contract reviews.

Answer

Marketing budget for security awareness campaigns.

Answer

Office renovation for security operations center.

Question 6

Which of the following BEST describes the role of a security architect in a security program?

Accepted Answer

Designing and reviewing security controls and solutions. The security architect designs security structures and ensures controls are integrated into systems and networks.

Answer

Managing user access requests

Answer

Conducting penetration tests

Answer

Monitoring security alerts and incidents

Question 7

A security manager is developing a security scorecard for the CISO. Which THREE of the following metrics are considered LEADING indicators?

Accepted Answer

Patch compliance percentage. Leading indicators predict future incidents. Patch compliance, access review completion, and phishing click rate are proactive measures.

Answer

Mean time to detect (MTTD)

Answer

Number of data breaches

Question 8

An organization is updating its incident response playbook after a ransomware attack. Which of the following should be included as a key step in the ransomware playbook?

Accepted Answer

Isolate affected systems from the network. Ransomware playbooks should include isolating infected systems to prevent spread, as containment is a priority.

Answer

Reboot all servers to clear the ransomware

Answer

Immediately pay the ransom demand

Answer

Notify all customers immediately

Question 9

An organization is conducting a root cause analysis after an insider threat incident. Which of the following tools is MOST appropriate for identifying the underlying management governance failure?

Accepted Answer

5 Whys. The 5 Whys technique is a simple but effective method to drill down from technical cause to process failure to management failure.

Answer

Risk assessment

Answer

SWOT analysis

Answer

Gap analysis

Question 10

Which role within a security team is primarily responsible for designing and reviewing security architectures to ensure alignment with business requirements and security standards?

Accepted Answer

Security architect. The security architect designs and reviews the security architecture, ensuring it meets business needs and security requirements. Other roles focus on operations, analysis, or awareness.

Answer

SOC analyst

Answer

GRC analyst

Answer

Security analyst

Question 11

An organization maintains evidence handling procedures for incident response. A forensic investigator needs to collect a hard drive from a compromised server. Which of the following is the MOST critical step to ensure admissibility in court?

Accepted Answer

Documenting the chain of custody from the moment of collection.. Chain of custody documentation is essential for evidence integrity and admissibility.

Answer

Encrypting the hard drive during transport.

Answer

Creating a forensic image of the hard drive before disconnecting it.

Answer

Ensuring the investigator has the proper certification.

Question 12

An organization's incident response team has identified that a data breach involves customer personal information. Which of the following should be done FIRST to preserve evidence for potential litigation?

Accepted Answer

Issue a legal hold to preserve relevant data. Legal hold prevents spoliation of evidence; it must be issued before any remediation that could alter data.

Answer

Notify affected customers

Answer

Begin system restoration from backups

Answer

Conduct a root cause analysis

Question 13

An organization has experienced a credential compromise incident. Which playbook should the incident response team primarily use?

Accepted Answer

Credential compromise playbook. Playbooks are tailored to incident types; credential compromise has its own specific playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 14

Which TWO of the following are essential components of an incident response plan? (Select two.)

Accepted Answer

Communication templates. Essential components include the IR team roster and contact list, and communication templates for consistent messaging.

Answer

Vendor risk assessment reports

Answer

Network architecture diagrams

Answer

Annual security awareness training schedule

Question 15

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident, such as ransomware or data breach?

Accepted Answer

Incident response playbook. Playbooks (or runbooks) provide detailed procedures for specific incident types, while the IR plan is a broader document.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication template