CISM Practice Test 2 — 25 Questions

Question 1

An organization has a distributed incident response team across multiple time zones. During a critical incident, communication delays occur due to different work hours. Which strategy BEST improves coordination and response time?

Accepted Answer

Implement a follow-the-sun incident response model. The follow-the-sun model aligns incident response handoffs with time zone shifts, ensuring continuous coverage without requiring all team members to work overlapping shifts. This reduces communication delays by transferring active incident ownership to the next available region, maintaining momentum and minimizing response time during critical incidents.

Answer

Require all team members to work overlapping shifts

Answer

Designate a single incident commander for the entire response

Answer

Outsource incident response to a managed security service provider

Question 2

An information security manager is designing a metrics program to report to the board. Which of the following metrics would be MOST meaningful to the board?

Accepted Answer

Percentage of systems with critical vulnerabilities. The board is primarily concerned with strategic risk posture and business impact. Percentage of systems with critical vulnerabilities directly quantifies the organization's exposure to high-severity threats, enabling informed risk acceptance or remediation decisions. This metric aligns with the board's fiduciary duty to oversee risk management, unlike operational details such as incident counts or training completions.

Answer

Number of security incidents reported

Answer

Average patch deployment time

Answer

Number of security awareness training completions

Question 3

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Accepted Answer

Business impact analysis (BIA) results.. A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Answer

Security awareness training for all employees.

Answer

Vulnerability scanning schedules.

Question 4

Which of the following best describes the primary purpose of a security program's governance framework?

Accepted Answer

To provide oversight and alignment with business objectives. The primary purpose of a security program's governance framework is to provide oversight and ensure that security activities are aligned with business objectives, risk appetite, and regulatory requirements. It establishes the policies, roles, and accountability structures that guide decision-making, rather than directly executing technical tasks. This alignment is critical for the program to be sustainable and supported by executive management.

Answer

To implement technical security controls

Answer

To conduct vulnerability assessments

Answer

To manage security incidents

Question 5

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 6

Which THREE are key performance indicators (KPIs) for an information security program?

Accepted Answer

Percentage of employees trained. The percentage of employees trained is a key performance indicator (KPI) because it directly measures the effectiveness of the security awareness program, which is a critical control to reduce human error—the leading cause of breaches. A high training completion rate correlates with lower phishing susceptibility and improved incident reporting, making it a leading indicator of program maturity.

Answer

Number of security incidents

Answer

Budget variance

Question 7

During an incident investigation, the incident response team needs to collect volatile data from a compromised server. Which of the following data should be collected FIRST?

Accepted Answer

Contents of system memory (RAM). Volatile data, such as the contents of system memory (RAM), is lost when the system is powered off. Collecting RAM first preserves evidence of running processes, network connections, and encryption keys that would otherwise be destroyed. This follows the order of volatility (RFC 3227), which mandates capturing the most volatile data first.

Answer

Network connection logs from the firewall

Answer

Contents of the hard drive

Answer

Event logs from the system

Question 8

An organization's security team detects an unusual spike in outbound traffic from a database server to an external IP address during a routine security scan. The database server contains sensitive customer data. Which of the following is the MOST appropriate initial response?

Accepted Answer

Isolate the database server from the network to stop the traffic.. Isolating the database server is the most appropriate initial response because it immediately halts the suspected data exfiltration, containing the incident and preventing further loss of sensitive customer data. In incident management, the priority is to stop the active threat before performing any investigative or notification steps, as per the NIST SP 800-61 incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery). Delaying containment to review logs or run scans allows the exfiltration to continue, increasing the potential damage.

Answer

Notify the data protection officer and legal team.

Answer

Review firewall logs to confirm data exfiltration.

Answer

Run a full antivirus scan on the database server.

Question 9

A multinational corporation is implementing a risk-based approach to information security governance. The chief information security officer (CISO) has been asked to prioritize security initiatives based on business impact. Which of the following actions should the CISO take FIRST to align security governance with business objectives?

Accepted Answer

Conduct a business impact analysis (BIA) to identify critical processes and their security requirements.. Conducting a business impact analysis (BIA) is the foundational step in a risk-based governance approach because it identifies critical business processes, their recovery time objectives (RTOs), and the specific security requirements needed to protect them. Without this analysis, the CISO cannot align security initiatives with business impact, as the BIA directly links security controls to the organization's most valuable assets and operational priorities.

Answer

Enforce multifactor authentication (MFA) for all remote access.

Answer

Implement a compliance management tool to track regulatory requirements.

Answer

Deploy a security information and event management (SIEM) system to centralize log analysis.

Question 10

Based on the exhibit, what is the MOST appropriate next step for the information security manager?

Accepted Answer

Recommend implementing multifactor authentication to reduce the risk. Multifactor authentication (MFA) directly mitigates the most likely attack vector for the identified risk—credential theft or brute-force attacks—by requiring a second factor (e.g., a one-time password from a hardware token or biometric) in addition to the password. Since the exhibit (not shown) indicates a moderate likelihood but high impact, implementing MFA reduces the likelihood to a more acceptable level without requiring a change in risk appetite or transferring the risk. This aligns with the CISM principle of applying cost-effective controls to reduce residual risk to within the organization's risk tolerance.

Answer

Accept the risk because the likelihood is only moderate

Answer

Reassess the risk with a higher risk appetite threshold

Answer

Transfer the risk by purchasing cyber insurance

Question 11

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Accepted Answer

A steering committee that includes senior management and business unit leaders.. A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Answer

An incident response plan that defines roles and procedures.

Answer

A vulnerability scanning schedule and remediation SLAs.

Answer

A firewall policy that specifies allowed and denied traffic.

Question 12

Refer to the exhibit. The security analyst observes these alerts. What is the MOST likely sequence of events?

Accepted Answer

Attacker compromised jsmith's credentials, established C2, and exfiltrated data. The correct sequence is that an attacker compromised jsmith's credentials, established command-and-control (C2) communication, and then exfiltrated data. The alerts show a brute-force or credential-stuffing attempt from an external IP (10.0.0.45) against jsmith's account, followed by an outbound C2 beacon (e.g., DNS or HTTP) from jsmith's workstation, and finally a large data transfer to an external destination. This matches the typical kill chain: initial access via compromised credentials, persistence via C2, and data exfiltration as the final objective.

Answer

Insider threat: jsmith intentionally exfiltrated data

Answer

Network scan from 10.0.0.45 triggered false positives

Answer

Malware downloaded on jsmith's workstation and exfiltrated data

Question 13

An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?

Accepted Answer

Remediate the risk by implementing parameterized queries and input validation. Option C is correct because parameterized queries (prepared statements) and input validation directly address the root cause of SQL injection by separating SQL logic from user-supplied data. This is a remediation (mitigation) strategy that reduces the likelihood of exploitation to an acceptable level, which aligns with the high-risk scenario described.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Avoid the risk by discontinuing the web application

Answer

Accept the risk because the likelihood is low after compensating controls

Question 14

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 15

After a ransomware incident, the incident response team contains the spread and begins eradication. The team discovers that the ransomware encrypted files on a file server and also deleted shadow copies. Which of the following should the team do NEXT to support recovery?

Accepted Answer

Create a forensic image of the file server and affected endpoints.. After containment and eradication, the priority is to preserve evidence for root cause analysis and potential legal action. Creating a forensic image of the file server and affected endpoints captures the ransomware artifacts, encryption keys, and system state before any recovery actions that could overwrite critical data. This aligns with the CISM incident management phase of 'lessons learned' and ensures the team can determine the attack vector and prevent recurrence.

Answer

Restore the encrypted files from the most recent backup.

Answer

Attempt to decrypt the files using available decryption tools.

Answer

Notify law enforcement immediately.

Question 16

Refer to the exhibit. A security analyst reviews the firewall configuration and identifies a potential risk. What is the most likely risk?

Accepted Answer

Risk of data exfiltration via DNS tunneling.. The exhibit shows a firewall rule that permits DNS traffic (UDP/TCP port 53) from the internal network to any external destination. This configuration allows internal hosts to perform DNS queries to external servers, which can be exploited for DNS tunneling—a technique where data is encapsulated within DNS queries and responses to bypass security controls and exfiltrate sensitive information. Since DNS traffic is typically allowed through firewalls, this creates a covert channel for data exfiltration, making option D the most likely risk.

Answer

Risk of unauthorized external access to internal services.

Answer

Risk of denial-of-service attacks from internal hosts.

Answer

Risk of IP spoofing attacks from the inside network.

Question 17

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

Accepted Answer

Accept the risk because the control is not cost-justified.. The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.

Answer

Accept the risk because ALE after control is only $2,500.

Answer

Implement the control because it reduces ALE to $2,500.

Answer

Implement the control because ALE is $10,000, and control cost is only $12,000.

Question 18

An organization is developing a new information security program and wants to ensure it aligns with business objectives. Which of the following is the MOST critical first step?

Accepted Answer

Identify business strategy and risk appetite.. Identifying business strategy and risk appetite is the most critical first step because the information security program must be designed to support the organization's objectives and operate within the risk tolerance defined by leadership. Without this alignment, subsequent security controls and investments may conflict with business goals or fail to address the risks the organization is willing to accept. This ensures that security is a business enabler rather than a technical silo.

Answer

Develop a security awareness training program.

Answer

Design the security architecture based on industry frameworks.

Answer

Conduct a comprehensive risk assessment.

Question 19

Refer to the exhibit. An analyst observes the network traffic between three internal hosts and a web server. Which of the following is the MOST likely interpretation of this traffic?

Accepted Answer

Multiple users are accessing the web server normally.. The exhibit shows multiple internal hosts (10.0.0.1, 10.0.0.2, 10.0.0.3) each establishing a normal TCP three-way handshake with the web server (192.168.1.100) on port 80, with varying source ports and no abnormal flags or packet rates. This pattern indicates legitimate concurrent user access, as each host completes the handshake and exchanges data without flooding or scanning behavior.

Answer

A SYN flood attack is in progress.

Answer

A single host is using multiple IP addresses to scan the server.

Answer

A distributed denial-of-service (DDoS) attack is occurring.

Question 20

Based on the exhibit, which of the following is the MOST likely attack vector?

Accepted Answer

Privilege escalation via a compromised account. The exhibit shows a user account with administrative privileges being used from an unusual geographic location at an anomalous time, followed by lateral movement to a domain controller. This pattern indicates that the initial access was gained through a compromised account, which was then leveraged for privilege escalation to move laterally and access sensitive systems. The attack vector is the misuse of valid credentials, not an injection or social engineering attack.

Answer

SQL injection attack

Answer

Phishing email with malicious attachment

Answer

Denial of service attack