CISM Practice Test 3 — 25 Questions

Question 1

A risk assessment identifies that the organization's email system has a high likelihood of phishing attacks. The current controls include spam filtering and user awareness training. What should the organization do NEXT to manage this risk effectively?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Evaluate the residual risk and decide on additional controls. After implementing initial controls (spam filtering and user awareness training), the organization must evaluate the residual risk—the risk that remains after controls are applied. This step is required by the CISM risk management process to determine whether the residual risk level is acceptable or if additional controls are needed. Option B correctly follows the risk assessment lifecycle: identify risk, apply controls, assess residual risk, then decide on further action.

Answer

Accept the risk as it is already controlled

Answer

Transfer the risk to a cyber insurance provider

Answer

Conduct another round of user awareness training

Question 2

A security manager is preparing a risk report for the board of directors. Which of the following should be included to best support strategic risk-based decisions?

Accepted Answer

Summary of top risks, risk appetite alignment, and treatment status. The board requires strategic-level information to make risk-based decisions. Option D provides a summary of top risks, alignment with risk appetite, and treatment status, which directly supports strategic oversight. Operational details like firewall counts or patch levels are tactical and do not convey the business impact or risk posture needed for board-level decisions.

Answer

Operational metrics such as number of firewalls and intrusion detection alerts

Answer

List of all past security incidents and their root causes

Answer

Detailed vulnerability scan results and patch levels

Question 3

Which of the following best describes the difference between risk appetite and risk tolerance?

Accepted Answer

Risk appetite is the amount of risk an organization is willing to accept, while risk tolerance is the acceptable variation around that appetite for specific objectives. Ly distinguishes risk appetite as the broad, strategic level of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance is the specific, measurable deviation allowed from that appetite for individual objectives or risks. This aligns with the ISACA CISM Review Manual, which defines risk appetite as the 'amount of risk an entity is willing to accept in pursuit of its mission' and risk tolerance as the 'acceptable level of variation relative to the achievement of objectives.' Understanding this distinction is critical for establishing proper risk management thresholds and ensuring that security controls are aligned with business goals.

Answer

Risk appetite is the maximum risk tolerance

Answer

Risk tolerance is the total risk, and risk appetite is the residual risk

Answer

Risk appetite is qualitative, and risk tolerance is quantitative

Question 4

A risk manager is establishing risk appetite for a new product line. Which of the following best describes the relationship between risk appetite and risk tolerance?

Accepted Answer

Risk appetite is the general approach to risk; tolerance defines acceptable variation in performance. Risk appetite is the broad, high-level amount of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance translates that appetite into specific, measurable boundaries for individual risks. Option D correctly captures this relationship: appetite is the general approach, and tolerance defines the acceptable variation in performance metrics (e.g., a 5% deviation in revenue targets). This distinction is critical for aligning risk management with business strategy in information security risk management.

Answer

Risk appetite and tolerance are interchangeable terms

Answer

Risk appetite is set by regulatory bodies; tolerance is set by the board

Answer

Risk appetite is the specific limit for each risk; tolerance is the overall willingness to accept risk

Question 5

Which of the following is the PRIMARY reason for including communication templates in the incident response plan?

Accepted Answer

To ensure consistent and timely messaging to stakeholders.. Communication templates ensure that notifications are consistent, accurate, and timely during the stress of an incident, reducing the risk of errors or omissions.

Answer

To reduce the workload on the communications lead.

Answer

To comply with regulatory requirements for breach notification.

Answer

To avoid legal liability by using approved language.

Question 6

Which incident category involves unauthorized access to systems or data by an individual within the organization?

Accepted Answer

Insider threat. Insider threat incidents are caused by employees, contractors, or other trusted insiders.

Answer

DDoS

Answer

Data breach

Answer

Ransomware

Question 7

A multinational corporation is implementing a new information security program. The program manager needs to ensure that security requirements are integrated into the procurement process for third-party services. Which of the following is the most effective approach?

Accepted Answer

Embed security clauses in request for proposals (RFPs). Embedding security clauses in RFPs ensures that security requirements are formally communicated to potential vendors before any contractual agreement, making them a mandatory part of the procurement process. This proactive approach aligns with the CISM principle of integrating security into business processes from the outset, rather than retrofitting controls after contracts are signed. By specifying requirements such as encryption standards (e.g., AES-256), incident response SLAs, and compliance with frameworks like ISO 27001 in the RFP, the organization can evaluate vendor capabilities upfront and avoid costly renegotiations.

Answer

Include security requirements after contract signing

Answer

Require third parties to self-attest compliance

Answer

Conduct periodic security audits of third parties

Question 8

A security manager is measuring the security culture of the organization. Which three metrics are most appropriate?

Accepted Answer

Phishing simulation click rate. Phishing simulation click rate (A) is a direct behavioral metric that reveals how susceptible employees are to real-world social-engineering attacks, making it a strong indicator of security awareness culture. Training completion rate (B) measures how consistently the workforce engages with required security education, which reflects the organization's commitment to building security knowledge. Percentage of incidents due to human error (E) quantifies how often employee mistakes contribute to breaches, directly exposing cultural weaknesses in day-to-day security behavior. Security budget as percentage of IT budget (C) is a financial resource metric, not a measure of employee attitudes or behavior, so it does not reflect security culture. Number of security policies published (D) is a documentation output metric and says nothing about whether employees understand or follow those policies.

Answer

Security budget as percentage of IT budget

Answer

Number of security policies published

Question 9

An organization is conducting a root cause analysis after an insider threat incident. Which of the following tools is MOST appropriate for identifying the underlying management governance failure?

Accepted Answer

5 Whys. The 5 Whys technique is a simple but effective method to drill down from technical cause to process failure to management failure.

Answer

Risk assessment

Answer

SWOT analysis

Answer

Gap analysis

Question 10

You are the CISO of a mid-sized e-commerce company with 500 employees. The company recently suffered a data breach where an attacker exfiltrated customer credit card data from the production database. The investigation revealed that the breach originated from a compromised developer workstation. The developer had been granted direct access to the production database for troubleshooting purposes, a practice that had been in place for years. The security governance framework currently lacks a formal process for managing privileged access. The board has asked for immediate improvements to prevent recurrence. Which course of action BEST addresses the governance gap?

Accepted Answer

Implement a privileged access management (PAM) solution with just-in-time access and session recording.. The core governance gap is the lack of a formal process for managing privileged access. Implementing a Privileged Access Management (PAM) solution with just-in-time (JIT) access and session recording directly addresses this by enforcing time-bound, auditable, and approved access to the production database, eliminating standing privileges. This aligns with the principle of least privilege and provides a governance mechanism to control, monitor, and revoke elevated access, which is the root cause of the breach.

Answer

Segment the network to isolate production databases from developer workstations.

Answer

Conduct security awareness training for all developers on password security.

Answer

Deploy endpoint protection and patch management for all workstations.

Question 11

Which TWO of the following are indicators of a potential security incident?

Accepted Answer

Multiple unexpected system reboots.. Option B is correct because multiple unexpected system reboots can indicate malicious activity such as a rootkit, bootkit, or attacker-triggered crash/restart to cover tracks or disrupt availability, and repeated reboots are a classic anomaly in incident detection. Option E is correct because unusual outbound network traffic from a server often signals command-and-control (C2) communication, data exfiltration, or malware beaconing, making it a strong indicator of compromise. Option A is not correct because low disk space is typically a capacity/performance issue, not a security incident indicator. Option C is not correct because a vendor releasing a new software version is a normal patch/update event, not an incident. Option D is not correct because a successful login by an authorized user is expected behavior and only becomes suspicious with additional context such as impossible travel or unusual time.

Answer

Low disk space on a file server.

Answer

A new version of a critical software released.

Answer

A successful login by an authorized user.

Question 12

During an incident, the incident response team needs to preserve evidence for legal proceedings. Which of the following is the MOST important action to take?

Accepted Answer

Create a forensic image of affected systems using write-blockers.. Creating a forensic image of affected systems using write-blockers is the most important action because it preserves the original data in a bit-for-bit, unaltered state, ensuring the evidence is admissible in legal proceedings. Write-blockers prevent any write operations to the source drive, maintaining the integrity of the evidence chain of custody. Without a forensically sound image, any subsequent analysis could be challenged as tampered or unreliable.

Answer

Document the incident in a free-form text.

Answer

Take screenshots of system logs.

Answer

Notify law enforcement immediately.

Question 13

Which THREE of the following are key components of an incident response plan? (Select THREE)

Accepted Answer

Communication and escalation matrix. Option C, the communication and escalation matrix, is a core component because it defines who must be notified, in what order, and through which channels (e.g., phone, email, secure messaging) during an incident, ensuring timely escalation to management, legal, and other stakeholders. Option D, incident response procedures, is essential because it provides the documented, repeatable steps for detecting, containing, eradicating, recovering from, and reviewing incidents, typically aligned with frameworks such as NIST SP 800-61. Option E, roles and responsibilities of team members, is required to establish clear ownership and accountability across the incident response team, such as incident commander, communications lead, and forensic analysts, preventing gaps or duplicated effort during an incident. Option A does not belong because a full list of all employees' contact information is not a key component of an incident response plan; only relevant escalation contacts and on-call personnel are needed. Option B does not belong because an annual budget for incident response tools is a financial or management consideration, not a structural component of the incident response plan itself.

Answer

List of all employees' contact information

Answer

Annual budget for incident response tools

Question 14

Refer to the exhibit. An organization uses these firewall rules. After a breach, the IR team finds that the attacker gained access via SSH from an external IP. Which rule is most likely misconfigured?

Accepted Answer

SSH is allowed from any source instead of only internal. The firewall rule allowing SSH from any source (0.0.0.0/0) is misconfigured because it permits external attackers to attempt brute-force or credential-based access via TCP port 22. The principle of least privilege dictates that SSH should be restricted to specific internal IP ranges or management jump hosts, not exposed to the internet. The IR team's finding that the attacker gained access via SSH from an external IP directly confirms this rule as the root cause.

Answer

MySQL should be blocked entirely

Answer

RDP should not be allowed

Answer

HTTPS should be inspected

Question 15

During a data breach investigation, an organization engages an external forensics firm. To preserve attorney-client privilege, which of the following is the BEST practice?

Accepted Answer

Engage the forensics firm under the direction of legal counsel.. Engaging the forensics firm under the direction of legal counsel is the best practice because it extends attorney-client privilege to the investigation. When counsel directs the work, communications and findings are protected as work product, preventing disclosure in litigation. This is a foundational principle in incident response legal strategy.

Answer

Have the forensics firm work independently to maintain objectivity.

Answer

Ensure the forensics firm signs a non-disclosure agreement only.

Answer

Have the forensics firm report directly to the CISO.

Question 16

During a P1 incident, the crisis management team (CMT) is activated and meets within the first hour. Which communication practice is most appropriate for the CMT to follow when providing updates to the board of directors?

Accepted Answer

Send a brief status report every hour, avoiding speculation and including legal counsel review. During a P1 incident, the CMT must provide timely, concise updates to the board to maintain trust and enable strategic decisions. Option A is correct because it balances frequency (hourly) with content discipline (avoiding speculation) and includes legal counsel review, which is critical for compliance and liability management. This aligns with the CISM Incident Management domain's emphasis on clear, non-technical communication to senior leadership.

Answer

Provide detailed technical updates every hour

Answer

Provide speculative root cause analysis to demonstrate competence

Answer

Wait until the incident is fully understood before any communication

Question 17

Which of the following is the PRIMARY reason for having a pre-established forensic retainer agreement before an incident occurs?

Accepted Answer

To reduce the time needed to bring forensic experts on board during an incident.. The primary reason for a pre-established forensic retainer agreement is to reduce the time needed to bring forensic experts on board during an incident. In incident management, every minute of delay can allow an attacker to exfiltrate data or destroy evidence; a retainer bypasses the procurement and contracting process, enabling immediate deployment of the forensic team to preserve volatile memory and capture network artifacts.

Answer

To ensure the forensic firm is familiar with the organization's environment.

Answer

To lock in a favorable pricing structure.

Answer

To ensure the forensic firm has the necessary certifications.

Question 18

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 19

During a data breach investigation, the incident response team discovers that a backup was encrypted by ransomware. The team needs to determine the sequence of events leading to the encryption. Which of the following documentation is MOST critical to preserve for potential litigation?

Accepted Answer

The chain of custody for the backup media. Chain of custody documentation is essential to prove the integrity and admissibility of digital evidence in court.

Answer

The communication logs between team members

Answer

The forensic tools used in the investigation

Answer

The incident response plan version used during the incident

Question 20

During a major incident, the incident response team discovers that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Accepted Answer

Escalate to activate the business continuity and disaster recovery plans. When an incident cannot be resolved within the MTD, it triggers the transition to business continuity and disaster recovery (BC/DR) plans to maintain critical operations.

Answer

Continue incident response efforts until resolution regardless of time

Answer

Declare the incident a disaster and shut down all systems

Answer

Notify the insurance provider immediately