CISM Practice Test 25 — 15 Questions

Question 1

Which of the following best describes residual risk?

Accepted Answer

Risk that remains after implementing controls. Residual risk is defined in information security risk management as the risk that remains after management has implemented all planned controls. This concept is central to the CISM framework because it represents the exposure that must be accepted, transferred, or further mitigated by the organization. Unlike inherent risk (before controls), residual risk accounts for the effectiveness of the security measures in place.

Answer

Risk before any controls are applied

Answer

The likelihood that a control will fail

Answer

The level of risk an organization is willing to accept

Question 2

An organization's IDS logs show multiple outbound connections to an external IP address from a server that normally communicates only internally. The logs indicate the process is running under the SYSTEM account. Which of the following BEST describes the likely root cause?

Accepted Answer

A backdoor installed via a previous compromise. The SYSTEM account is the highest-privileged local account on Windows, and outbound connections from a server that normally only communicates internally strongly indicate a backdoor. A backdoor installed via a previous compromise would allow an attacker to maintain persistent remote access, often running as SYSTEM to evade detection and control the server. This matches the observed behavior of unauthorized outbound traffic from a privileged process.

Answer

A misconfigured application

Answer

An authorized administrative activity

Answer

A privilege escalation exploit

Question 3

Which of the following is the primary purpose of having a pre-established forensic retainer agreement?

Accepted Answer

To reduce the time required to engage external forensics during an incident. A pre-established retainer reduces the time to engage a forensics firm during an incident, ensuring rapid response.

Answer

To ensure the forensics firm is certified

Answer

To guarantee the lowest price for forensic services

Answer

To comply with regulatory requirements

Question 4

A financial institution is designing an incident response plan. They want to ensure that during a ransomware incident, critical transaction systems can be restored within 4 hours. Which metric should be used to measure this requirement?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable downtime after a disaster or incident, which directly aligns with the requirement to restore critical transaction systems within 4 hours. In incident management, RTO is the metric used to set the target for system recovery, ensuring business continuity. For ransomware incidents, RTO drives the restoration strategy and resource allocation to meet the 4-hour window.

Answer

Mean Time to Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)

Question 5

Which THREE of the following are responsibilities of the board of directors regarding information security governance?

Accepted Answer

Approve the information security strategy. Option A is correct because the board of directors is responsible for approving the information security strategy, ensuring it aligns with business objectives and regulatory obligations at the highest governance level. Option D is correct because authorizing the security budget is a board-level fiduciary duty that allocates resources to implement and sustain the security program. Option E is correct because setting the organization's risk appetite is a core governance responsibility of the board, defining how much risk the organization is willing to accept in pursuit of its goals. Options B and C are incorrect because responding to security incidents and conducting vulnerability scans are operational and technical tasks performed by security operations teams, not by the board of directors.

Answer

Respond to security incidents

Answer

Conduct vulnerability scans

Question 6

After a DDoS attack, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). According to best practices, what should happen next?

Accepted Answer

Escalate to the business continuity and disaster recovery teams.. If MTD cannot be met, business continuity or disaster recovery plans should be activated.

Answer

Notify customers and shut down operations.

Answer

Continue current response efforts and hope for the best.

Answer

Declare the incident as a disaster immediately without further analysis.

Question 7

An organization is implementing a security champions program to improve application security. Which THREE of the following are key success factors for such a program?

Accepted Answer

Ensuring that champions have authority to stop releases with critical vulnerabilities.. Option A is correct because giving champions the authority to halt releases containing critical vulnerabilities provides them with real enforcement power, ensuring security issues are remediated before deployment rather than merely reported. Option C is correct because champions need formally allocated time to attend training, perform threat modeling, triage findings, and mentor peers; without dedicated capacity, security work is deprioritized against delivery deadlines. Option D is correct because role-tailored advanced training (for example secure coding in the languages and frameworks the champion actually uses, plus SAST/DAST tooling) equips champions to give credible, context-specific guidance to their teams. Option B is not a success factor because quarterly rotation destroys the accumulated expertise and relationships that make champions effective, and it is not required for broad exposure. Option E is not a success factor because champions should be respected hands-on engineers embedded in development teams, not senior managers whose distance from code limits their technical influence.

Answer

Rotating champions every quarter to maximize exposure.

Answer

Selecting champions only from senior management.

Question 8

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 9

Which metric best indicates the effectiveness of a security awareness program in changing employee behavior?

Accepted Answer

Phishing simulation click rates. Phishing simulation click rates directly measure whether employees change their behaviour when confronted with a realistic social-engineering attempt, making them a behavioural outcome metric rather than an activity metric. A declining click rate over time, paired with rising report rates, demonstrates that awareness training is translating into safer actions. Completion percentages and session counts measure activity, not behaviour change.

Answer

Percentage of employees who completed training

Answer

Number of security posters displayed

Answer

Number of training sessions delivered

Question 10

Which of the following is a key objective of sharing threat intelligence, such as indicators of compromise (IoCs), with an Information Sharing and Analysis Center (ISAC)?

Accepted Answer

To receive timely threat information and contribute to community defense. The primary objective of sharing IoCs with an ISAC is bidirectional: the organization receives timely, sector-specific threat intelligence from peers and contributes its own observations to strengthen collective defense. ISACs are sector-based (e.g., FS-ISAC for financial services, H-ISAC for healthcare) and enable early warning of emerging threats. This mutual benefit is the core purpose of threat intelligence sharing.

Answer

To document the incident for insurance claims

Answer

To market the organization's security capabilities

Answer

To fulfill regulatory requirements for public disclosure

Question 11

An auditor reviews the BYOD policy and notes that mobile device management (MDM) logs show several devices without encryption. The policy has been in effect for 6 months. Which of the following is the most likely reason for this non-compliance?

Accepted Answer

MDM is not configured to enforce encryption automatically. MDM systems can enforce encryption policies automatically by requiring devices to comply before granting access to corporate resources. If the MDM is not configured to enforce encryption, devices will remain non-compliant even if the policy requires encryption. The logs showing several devices without encryption after six months strongly indicate that the MDM is not actively enforcing the encryption requirement, making D the most likely reason.

Answer

The grace period allows non-compliance for 7 days

Answer

Employees are unaware of the encryption requirement

Answer

The policy does not explicitly require encryption

Question 12

Which of the following is the PRIMARY responsibility of a steering committee in an information security program?

Accepted Answer

Providing strategic direction and oversight. The steering committee's primary role is to provide strategic direction and oversight for the information security program, ensuring alignment with business objectives and risk appetite. This includes approving the overall security strategy, budget, and major initiatives, rather than engaging in operational tasks like policy drafting or technical assessments.

Answer

Approving individual security policies

Answer

Conducting vulnerability assessments

Answer

Implementing security controls

Question 13

Which THREE of the following are common challenges in incident response? (Select exactly 3)

Accepted Answer

Poor coordination between teams. Poor coordination between teams (Option B) is a common challenge in incident response because security incidents often require collaboration across IT, legal, PR, and management. Without clear communication channels and predefined roles, response efforts become fragmented, leading to delays in containment and recovery. This is a well-documented issue in frameworks like NIST SP 800-61, which emphasizes the need for a coordinated incident response plan.

Answer

Over-reliance on cloud services

Answer

Difficulty in identifying the root cause

Question 14

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select exactly three.)

Accepted Answer

Risk transfer (sharing). According to ISO 31000, risk treatment options include avoiding the risk (Option C), which means deciding not to start or continue the activity that gives rise to the risk, thereby removing the exposure entirely. Option B, risk transfer (sharing), is also valid because it involves sharing the risk with another party, such as through insurance or contractual arrangements, while retaining some residual risk. Option D, risk mitigation (reduction), is correct because ISO 31000 recognizes modifying the likelihood and/or consequence of the risk to reduce it to an acceptable level. Option A, risk elimination, is not one of the standard ISO 31000 treatment categories; while avoidance can eliminate exposure, 'elimination' is not the named treatment option. Option E, risk deferral, is not a recognized ISO 31000 risk treatment option, as postponing a risk does not by itself treat it and ISO 31000 does not list deferral among its treatment choices.

Answer

Risk elimination

Answer

Risk deferral

Question 15

An organization is implementing CIS Controls v8. Which THREE of the following are implementation groups (IGs) defined in the CIS Controls?

Accepted Answer

IG1: Basic cyber hygiene for small organizations.. CIS Controls v8 defines exactly three Implementation Groups that help organizations prioritize safeguards based on their risk profile and resources. Option A (IG1: Basic cyber hygiene for small organizations) is correct because IG1 represents the foundational set of 56 safeguards essential cyber hygiene for organizations with limited IT and security expertise. Option B (IG3: Advanced controls for high-risk or regulated environments) is correct because IG3 contains all 153 safeguards and is intended for organizations facing significant risk, such as those in regulated industries or with sensitive data. Option D (IG2: Intermediate controls for organizations with moderate risk) is correct because IG2 builds on IG1 with 74 additional safeguards for organizations managing moderate risk and some dedicated security staff. Option C is incorrect because there is no IG4 in CIS Controls v8, and cloud-specific guidance is addressed through separate CIS Benchmarks rather than an implementation group. Option E is incorrect because IG0 does not exist; the implementation groups begin at IG1, and there is no 'minimal controls' tier for non-critical systems.

Answer

IG4: Cloud-specific controls for cloud-first organizations.

Answer

IG0: Minimal controls for non-critical systems.