CISM Practice Test 24 — 15 Questions

Question 1

An organization has recently experienced a data breach due to an insider threat. The board has requested an update on governance improvements. Which of the following should the information security manager recommend first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Developing a formalized insider threat program with clear roles and responsibilities.. A formalized insider threat program with clear roles and responsibilities is the first governance improvement because it establishes a structured framework for detecting, preventing, and responding to insider threats. Unlike tactical controls, this program defines ownership, escalation paths, and policy integration, directly addressing the board's request for governance improvements rather than just technical fixes.

Answer

Conducting annual security awareness training for all employees.

Answer

Implementing two-factor authentication for all critical systems.

Answer

Deploying endpoint detection and response (EDR) software on all systems.

Question 2

According to the exhibit, which role is responsible for conducting forensic analysis?

Accepted Answer

Technical Lead. The Technical Lead is responsible for conducting forensic analysis because they possess the deep technical expertise required to preserve, acquire, and examine digital evidence without altering its integrity. In incident response, the Technical Lead oversees the technical team, ensuring that chain-of-custody procedures are followed and that forensic tools (e.g., FTK Imager, EnCase, or dd for disk imaging) are correctly applied to capture volatile and non-volatile data.

Answer

Incident Manager

Answer

Legal Counsel

Answer

Communication Lead

Question 3

An organization's incident response plan requires that evidence be preserved for potential litigation. Which of the following actions is MOST critical to ensure the admissibility of digital evidence?

Accepted Answer

Documenting the chain of custody for all evidence collected.. Admissibility of digital evidence in court hinges on demonstrating that the evidence has not been tampered with from the moment of collection to presentation. The chain of custody is the legally mandated documentation that tracks every person who handled the evidence, the time and date of each transfer, and the purpose of each action. Without a complete and verifiable chain of custody, the opposing counsel can successfully argue that the evidence may have been altered, making it inadmissible regardless of how securely it was stored or imaged.

Answer

Storing evidence in a secure, access-controlled location.

Answer

Creating forensic images of all affected systems before remediation.

Answer

Encrypting all evidence files to prevent unauthorized access.

Question 4

During an audit, it was found that the organization's information security policy is not being followed by business units. Which of the following is the MOST effective way for the information security manager to improve compliance?

Accepted Answer

Establish a policy review committee with business unit representatives to align policy with operational needs.. The most effective way to improve compliance is to align the policy with operational realities by involving business unit representatives in a policy review committee. When policies conflict with business processes, users will bypass them; adjusting the policy to be both secure and practical increases voluntary adherence. This addresses the root cause—policy misalignment—rather than treating symptoms like lack of awareness or enforcement.

Answer

Provide additional security awareness training focused on policy requirements.

Answer

Escalate non-compliance to senior management for disciplinary action.

Answer

Increase the frequency of automated policy compliance checks.

Question 5

An information security manager is evaluating the effectiveness of the organization's security governance. Which of the following metrics would best indicate that governance processes are functioning properly?

Accepted Answer

Percentage of risk treatment plans that have been implemented as scheduled.. The percentage of risk treatment plans implemented as scheduled directly measures whether the governance process is translating risk decisions into action. Effective governance ensures that risk owners execute agreed-upon treatments within defined timelines, reflecting accountability and process adherence. This metric aligns with the CISM governance principle that oversight should focus on outcomes of risk management activities, not just operational metrics.

Answer

Total spending on security tools compared to the approved budget.

Answer

Number of security incidents reported per quarter.

Answer

Mean time to detect (MTTD) for security incidents.

Question 6

During a cyber incident, the organization's legal counsel advises that certain information about the breach should not be shared with external partners due to ongoing law enforcement investigation. The incident response team must balance transparency with confidentiality. Which of the following is the BEST approach?

Accepted Answer

Provide only non-sensitive overview to partners. It allows the incident response team to maintain necessary transparency with external partners while respecting legal counsel's directive to withhold sensitive details due to an ongoing law enforcement investigation. Providing a non-sensitive overview—such as the general nature of the incident, affected systems (without PII), and remediation timeline—fulfills partnership obligations without jeopardizing the investigation or violating chain-of-custody requirements for digital forensics.

Answer

Seek partner input on what to share

Answer

Share all information with partners under NDA

Answer

Withhold all information until investigation ends

Question 7

An organization is implementing an identity and access management (IAM) program. Which THREE of the following are key components of a mature IAM program?

Accepted Answer

Role-based access control (RBAC) aligned with job functions.. Option B is correct because RBAC maps permissions to job functions rather than individuals, which enforces least privilege and makes entitlements manageable and auditable as roles change. Option C is correct because periodic access reviews (recertification) of critical systems ensure stale or excessive entitlements are detected and revoked, a core governance control in any mature IAM program. Option E is correct because automated provisioning and de-provisioning via lifecycle workflows (often driven by an identity governance platform or SCIM) ensures users receive and lose access promptly, especially at joiner/mover/leaver events. Option A does not belong because biometrics is only one authentication factor and is not required for all users in a mature IAM program. Option D does not belong because SSO is a valuable convenience and security enhancement, but it is not mandatory for every cloud application and is not itself a defining component of IAM maturity.

Answer

Biometric authentication for all users.

Answer

Single sign-on (SSO) for all cloud applications.

Question 8

Which TWO metrics are considered leading indicators for information security program performance?

Accepted Answer

Patch compliance percentage. Patch compliance percentage (A) is a leading indicator because it measures preventive control coverage before an incident occurs, showing how well vulnerabilities are being remediated ahead of exploitation. Phishing click rate (B) is also a leading indicator, as it quantifies user susceptibility to social engineering and predicts the likelihood of future credential compromise or malware infection. By contrast, the number of data breaches (C) is a lagging indicator, since it counts security failures only after they have already happened. Mean time to detect (D) is likewise a lagging indicator, because it measures response performance after an incident has already occurred rather than predicting future risk.

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 9

Which THREE of the following are essential components of a mature information security governance framework?

Accepted Answer

A formally defined and approved risk appetite statement.. Option A is correct because a formally defined and approved risk appetite statement is a foundational governance artifact: it expresses how much risk the organization is willing to accept, enabling consistent risk-based decisions and prioritization across the security program. Option B is correct because governance requires accountability and oversight, which are achieved through performance measurement and reporting mechanisms that give the board and executives visibility into security posture, metrics, and progress against objectives. Option D is correct because strategic alignment between security objectives and business goals ensures security is integrated into enterprise strategy rather than treated as an isolated technical function, which is a core principle of governance frameworks such as ISO/IEC 27001 and COBIT. Option C does not belong because compliance with regulatory requirements is a baseline obligation and an outcome of governance, not an essential structural component; a mature framework may exceed or go beyond mere compliance. Option E does not belong because a dedicated 24/7 SOC is an operational capability that supports detection and response, not a required element of a governance framework, and many mature governance programs operate effectively without one.

Answer

Full compliance with all relevant regulatory requirements.

Answer

A dedicated security operations center (SOC) with 24/7 monitoring.

Question 10

A security manager is developing a set of objectives and key results (OKRs) for the security program. Which THREE would be considered effective security OKRs?

Accepted Answer

Objective: Enhance incident response. Key Result: Achieve 100% of incidents logged within 1 hour of detection.. Effective security OKRs pair a qualitative Objective with measurable, outcome-focused Key Results that have a baseline, target, and timeframe. Option B is correct because 'Achieve 100% of incidents logged within 1 hour of detection' is a quantifiable, time-bound metric that directly measures improved incident response performance. Option C is correct because reducing mean time to remediate critical vulnerabilities from 30 to 7 days specifies a clear baseline (30 days), target (7 days), and metric (MTTR), making it a measurable risk-reduction outcome. Option E is correct because completing risk assessments for 100% of high-tier vendors by year-end is a specific, measurable, and time-bound result tied to reducing third-party risk. Option A is not correct because 'Deploy SIEM by Q3' is a project deliverable/milestone, not an outcome-based key result measuring security improvement. Option D is not correct because 'Conduct quarterly phishing simulations' is an activity/output rather than a measurable outcome such as reduced click rate or reporting rate.

Answer

Objective: Implement a new SIEM. Key Result: Deploy SIEM by Q3.

Answer

Objective: Increase security awareness. Key Result: Conduct quarterly phishing simulations.

Question 11

After a ransomware attack, the incident response team successfully restores systems from backups. However, the ransomware encrypts files that were modified after the last backup was taken. Which of the following is the BEST way to minimize future data loss?

Accepted Answer

Use continuous data protection (CDP) with frequent snapshots.. Continuous data protection (CDP) with frequent snapshots captures every write operation in near real-time, allowing recovery to any point before the ransomware encryption. This eliminates the gap between the last backup and the attack, ensuring that even files modified after the last full backup can be restored without data loss.

Answer

Train users to save files to network drives.

Answer

Perform full backups daily instead of weekly.

Answer

Implement a data loss prevention (DLP) system.

Question 12

Which role is primarily responsible for designing and reviewing an organization's security architecture?

Accepted Answer

Security architect. The security architect is the role accountable for designing, documenting, and reviewing the organization's security architecture, including reference models, control frameworks, and technology standards. This role translates business and risk requirements into structural security designs and validates that implementations conform to them.

Answer

Security analyst

Answer

GRC analyst

Answer

SOC analyst

Question 13

Which THREE of the following are considered key components of an incident response plan?

Accepted Answer

Post-incident review process. A post-incident review process (A) is a key component because it captures lessons learned, root-cause analysis, and corrective actions after an incident is contained and eradicated, feeding continuous improvement back into the plan. A communication escalation matrix (B) is essential because it defines who is notified, in what order, within what timeframes, and through which channels (e.g., phone, email, pager) during an incident, ensuring timely stakeholder and management engagement. Roles and responsibilities (C) are a core element because they assign clear ownership of incident response activities — such as incident commander, communications lead, and forensics analyst — preventing confusion and gaps during an active incident. Network diagrams (D) are useful reference artifacts for troubleshooting and scoping, but they are supporting documentation rather than a defining component of an incident response plan. Disaster recovery procedures (E) belong to the disaster recovery plan (DRP) and business continuity planning, which address restoring critical systems and operations after major disruptions, not the structured detection, containment, eradication, and recovery workflow of incident response.

Answer

Network diagrams

Answer

Disaster recovery procedures

Question 14

A global financial services firm with 15,000 employees has recently experienced a significant data breach due to inadequate oversight of third-party vendors. The breach originated from a cloud service provider that had been granted elevated access without a formal risk assessment or contract review. The board has directed the CISO to overhaul the information security governance framework to prevent recurrence. Currently, the organization has a decentralized security model where each business unit manages its own vendor relationships. The CISO proposes a centralized governance body. Which of the following is the BEST course of action to establish effective governance over third-party risk?

Accepted Answer

Establish a central third-party risk management program with a defined policy and vendor assessment process. Establishing a central third-party risk management program with a defined policy and vendor assessment process is the best course of action because it directly addresses the root cause: decentralized, inconsistent oversight of third-party vendors. A centralized program ensures uniform risk assessment, contract review, and ongoing monitoring, which prevents the gaps that led to the breach. This approach aligns with CISM's emphasis on governance, risk management, and compliance.

Answer

Conduct quarterly penetration tests on all third-party systems

Answer

Provide annual security awareness training for employees managing vendors

Answer

Mandate that all vendor contracts include data protection clauses

Question 15

An organization's information security program is based on a risk management framework. Which of the following BEST describes the role of the information security manager in this context?

Accepted Answer

Designing and managing the security program. The information security manager is responsible for designing and managing the security program based on the risk management framework. This includes translating risk assessment results into security controls, policies, and procedures, and ensuring the program aligns with the organization's risk posture. The manager does not set risk appetite (that is a board-level decision) nor own all risks (risk owners are business process owners).

Answer

Setting the organization's risk appetite

Answer

Owning all information security risks

Answer

Conducting internal audits of controls