CISM Practice Test 2 — 25 Questions

Question 1

An organization's governance framework requires regular reporting to the board. Which reporting frequency and format is MOST effective for a board with limited security expertise?

Accepted Answer

Quarterly report summarizing key risk indicators and business impact. A quarterly report summarizing key risk indicators (KRIs) and business impact is most effective for a board with limited security expertise because it aligns with the board's strategic oversight role, focusing on risk exposure and business outcomes rather than technical details. This frequency balances timeliness with the board's typical meeting cadence, ensuring actionable insights without overwhelming non-technical members.

Answer

Monthly dashboard of technical control effectiveness metrics

Answer

Annual presentation of the overall security risk register

Answer

Weekly technical briefings on incidents and vulnerabilities

Question 2

An information security manager is asked to justify an increase in the security budget. Which approach BEST demonstrates the value of the security program?

Accepted Answer

Calculating the ROI by estimating breach avoidance and compliance cost savings. Presenting the return on investment (ROI) by quantifying avoided breach costs and compliance savings provides a business case for budget increases.

Answer

Comparing the proposed budget to industry benchmarks

Answer

Highlighting the number of security tools currently in use

Answer

Listing all security certifications held by the team

Question 3

After a security incident, the incident response team prepares a report detailing the root cause, impact, and lessons learned. Who is the PRIMARY audience for this report?

Accepted Answer

Senior management and the board of directors. The primary audience for a post-incident report detailing root cause, impact, and lessons learned is senior management and the board of directors. They require this information to make strategic decisions about risk acceptance, resource allocation for remediation, and to fulfill fiduciary duties regarding cybersecurity governance. The report provides the business context and financial impact necessary for executive-level oversight, not the technical details needed by operational teams.

Answer

The affected users

Answer

The IT support team

Answer

External auditors

Question 4

A small business is developing its first information security program. Which approach is most effective?

Accepted Answer

Conduct a risk assessment to identify key assets and threats.. Conducting a risk assessment (Option C) is the foundational step in building an information security program because it identifies the specific assets, threats, vulnerabilities, and impacts unique to the small business. Without this context, any controls or frameworks applied would be misaligned with the actual risk profile, leading to wasted resources and potential security gaps. The CISM framework emphasizes that risk assessment drives the selection of cost-effective, prioritized controls tailored to the organization's needs.

Answer

Hire an external security consultant to design the entire program.

Answer

Adopt a comprehensive framework like ISO 27001 immediately.

Answer

Purchase and deploy a next-generation firewall.

Question 5

Which of the following is the PRIMARY goal of incident containment?

Accepted Answer

To prevent further damage and limit the scope of the incident.. The primary goal of incident containment is to stop the incident from spreading and to limit the scope of damage. This is the immediate priority because, without containment, the attacker may continue to compromise additional systems, exfiltrate data, or escalate privileges. Options A, B, and C are important subsequent steps but are secondary to the urgent need to halt the incident's progression.

Answer

To gather evidence for prosecution.

Answer

To recover systems to normal operation.

Answer

To identify the root cause.

Question 6

An organization has a risk appetite that allows for a maximum residual risk level of 'medium' for all operational risks. A new project introduces a risk with inherent risk level 'high' and control effectiveness rated as 'partially effective'. The risk owner proposes to accept the risk. As the CISM, what is the best course of action?

Accepted Answer

Insist on additional controls to reduce residual risk to at least 'medium'.. The organization's risk appetite mandates that residual risk must be at 'medium' or lower. With an inherent risk of 'high' and controls rated 'partially effective', the residual risk remains above the acceptable threshold. Therefore, the best course is to insist on additional controls to bring residual risk down to at least 'medium', ensuring compliance with the risk appetite.

Answer

Accept the risk since the risk owner has agreed.

Answer

Transfer the risk to an insurance company.

Answer

Recommend revising the risk appetite to accommodate this risk.

Question 7

Which TWO of the following are appropriate criteria for escalating an incident to the crisis management team (CMT)? (Select TWO.)

Accepted Answer

The incident could cause severe reputational damage. Option A is correct because an incident with the potential to cause severe reputational damage meets the threshold for CMT escalation, since crisis management is invoked when business reputation and stakeholder trust are at stake, not merely for technical containment. Option D is correct because potential for major financial loss or regulatory penalties is a classic CMT escalation trigger, as such consequences require executive-level decision-making, legal counsel, and communications coordination beyond the incident response team's scope. Options B, C, and E are not appropriate standalone criteria: novel malware, third-party origin, and multi-vendor coordination are operational or technical factors that the incident response team can typically handle through normal procedures, and they do not by themselves imply the enterprise-wide business impact that defines a crisis warranting CMT involvement.

Answer

The incident involves a new type of malware not seen before

Answer

The incident originated from a third-party supplier

Answer

The incident requires coordination with multiple external vendors

Question 8

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Accepted Answer

A steering committee that includes senior management and business unit leaders.. A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Answer

An incident response plan that defines roles and procedures.

Answer

A vulnerability scanning schedule and remediation SLAs.

Answer

A firewall policy that specifies allowed and denied traffic.

Question 9

Which of the following is the PRIMARY role of the board of directors in information security governance?

Accepted Answer

Providing strategic direction and oversight of the security program.. The board of directors holds the ultimate fiduciary responsibility for the organization, including its information security posture. Their primary role is to provide strategic direction and oversight, ensuring that the security program aligns with business objectives, risk appetite, and regulatory requirements. This includes approving the overall security strategy, reviewing key risk indicators, and holding management accountable for security performance, not executing tactical tasks.

Answer

Managing the day-to-day security operations.

Answer

Implementing security controls and technologies.

Answer

Developing detailed security policies and procedures.

Question 10

Which THREE of the following are components of a security operations center (SOC)?

Accepted Answer

Response. A SOC is built around the core functions of detection, response, and continuous security monitoring, so options B, C, and E are correct. Detection (E) covers identifying malicious activity through tools such as SIEM correlation rules, IDS/IPS alerts, and endpoint telemetry, which is a primary SOC responsibility. Response (B) covers incident handling activities like triage, containment, eradication, and recovery, which SOC analysts perform once an incident is detected. Security monitoring (C) is the ongoing 24x7 collection and analysis of logs and alerts from firewalls, endpoints, and network devices that feeds detection and response. Vulnerability scanning (A) is typically a vulnerability management function, and security awareness training (D) is a human-risk/GRC program, so neither is a core SOC component.

Answer

Vulnerability scanning

Answer

Security awareness training

Question 11

During a suspected insider data theft, a security manager discovers that an employee copied sensitive pricing files to a personal cloud drive two weeks ago. Legal counsel has not yet decided whether to pursue legal action. The security manager must decide how to treat the forensic copies of the employee's laptop image and cloud access logs. Which action BEST aligns with evidence handling requirements?

Accepted Answer

Maintain a documented chain of custody, hash the images, and store them in a restricted evidence repository. When litigation is undecided, the safest course is to preserve evidence so it remains usable in any proceeding. Hashing the forensic images at acquisition, documenting every transfer in a chain of custody, and storing copies in a restricted repository together establish integrity and control. These steps prevent alteration, support authentication, and keep access limited. Continued monitoring without preservation, selective deletion, or broad sharing all risk destroying or contaminating evidence before legal counsel determines the organization's position.

Answer

Copy the evidence to a shared network folder so legal, HR, and IT can all review it as needed

Answer

Allow the employee to continue working normally while quietly monitoring activity to gather more evidence

Answer

Delete the laptop image after extracting only the relevant pricing files to reduce storage and privacy risk

Question 12

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident, such as ransomware or data breach?

Accepted Answer

Incident response playbook. Playbooks (or runbooks) provide detailed procedures for specific incident types, while the IR plan is a broader document.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication template

Question 13

Based on the exhibit, what is the MOST likely scenario?

Accepted Answer

An attacker brute-forced the password and then used the credentials to access a file server.. The exhibit shows multiple failed authentication attempts (Event ID 4625) from a single user account within a short time window, followed by a successful logon (Event ID 4624) and then an access event to a file share (Event ID 5140). This pattern of rapid, repeated failures culminating in a single success is characteristic of a brute-force attack, where the attacker guesses the password and then uses the compromised credentials to access a file server.

Answer

A user is performing a scheduled task that requires authentication.

Answer

A user forgot their password and successfully logged in after retrying.

Answer

A system administrator is testing password policies.

Question 14

An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?

Accepted Answer

Credential compromise playbook. Credential compromise incidents, such as account takeover via phishing, are handled by the credential compromise playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 15

A security manager is designing a metrics dashboard for executive management. Which of the following metrics is MOST useful for demonstrating the value of the security program?

Accepted Answer

Mean time to detect incidents. Mean time to detect (MTTD) incidents directly measures how quickly the security program identifies threats, which is a core outcome executives care about — reduced exposure window and improved resilience. It demonstrates program effectiveness in a business-relevant way rather than just activity or spend.

Answer

Percentage of budget spent on security

Answer

Number of security patches applied

Answer

Number of security policies created

Question 16

During a risk assessment, an organization identifies that its legacy payment system has a high likelihood of exploitation due to unpatched vulnerabilities. The system is critical for daily operations. Which risk treatment option should the organization PRIMARILY consider?

Accepted Answer

Implement compensating controls to reduce the risk. Implementing compensating controls, such as network segmentation, application-layer firewalls, or intrusion detection systems (IDS), directly reduces the residual risk of exploiting unpatched vulnerabilities in the legacy payment system without disrupting its critical daily operations. This aligns with the CISM principle that when a risk cannot be remediated (e.g., due to system criticality or vendor end-of-life), compensating controls are the primary treatment to bring risk within the organization's appetite.

Answer

Accept the risk as a cost of doing business

Answer

Avoid the risk by decommissioning the system

Answer

Purchase cyber insurance to transfer the risk

Question 17

After a data breach, the risk manager discovers that the risk assessment for the affected system had not been updated for two years. The organization's risk management policy requires annual reviews. Which of the following is the MOST significant consequence of this noncompliance?

Accepted Answer

Inaccurate risk profile leading to uninformed decisions. C is correct because the primary purpose of a risk assessment is to provide an accurate, current risk profile that informs security decisions and resource allocation. When the assessment is two years out of date, the organization lacks visibility into new threats, vulnerabilities, and changes in the threat landscape, leading to uninformed decisions that can result in security gaps and increased exposure. This directly undermines the risk management process, making it the most significant consequence of noncompliance with the annual review policy.

Answer

Increased audit findings

Answer

Regulatory fines for noncompliance

Answer

Higher insurance premiums

Question 18

An organization has recently experienced a data breach due to a misconfigured database. The root cause was a lack of proper change management. As part of the risk management process, what should the organization do NEXT after implementing corrective controls?

Accepted Answer

Perform a residual risk assessment. After implementing corrective controls, the next step in the risk management process is to perform a residual risk assessment. This evaluates the remaining risk after controls are applied, ensuring that the organization's risk appetite is not exceeded. Without this assessment, the organization cannot confirm whether the implemented controls are sufficient or if additional measures are needed.

Answer

Purchase additional cyber insurance to cover future breaches

Answer

Conduct security awareness training for all employees

Answer

Update the information security policy to mandate stricter controls

Question 19

A company is implementing a risk management program and needs to identify the most critical assets. Which of the following is the BEST approach to prioritize assets for risk assessment?

Accepted Answer

Assess the business impact of each asset's compromise. The best approach to prioritize assets for risk assessment is to assess the business impact of each asset's compromise because risk management focuses on the potential harm to business objectives, not on financial cost or technical vulnerabilities. Business impact analysis (BIA) evaluates criticality based on factors like revenue loss, regulatory penalties, and operational downtime, directly aligning asset priority with organizational risk appetite.

Answer

Use the asset's purchase value to determine priority

Answer

Perform a vulnerability scan and prioritize based on findings

Answer

Review historical incident reports for each asset

Question 20

A company is developing a risk treatment plan for a set of identified risks. One risk involves a third-party vendor that hosts critical data. The risk owner recommends accepting the risk. Which of the following conditions would BEST support this decision?

Accepted Answer

The cost to mitigate is higher than the potential financial loss from a breach. Risk acceptance is justified when the cost of mitigation exceeds the potential financial loss from a breach. This aligns with the cost-benefit analysis principle in risk management: if the cost to implement controls (e.g., migrating to a more secure vendor or adding encryption) is higher than the expected loss (e.g., $50,000 in breach costs vs. $100,000 in mitigation), accepting the residual risk is economically rational. The decision must still ensure the risk is within the organization's risk appetite.

Answer

The organization has no compensating controls in place

Answer

The risk is within the organization's risk appetite but the business impact is high

Answer

The vendor has a history of security incidents