CISM Practice Test 4 — 25 Questions

Question 1

During a phishing campaign, several employees clicked a malicious link that downloaded a remote access trojan (RAT). The incident response team has isolated the infected endpoints and is analyzing network traffic. They suspect that data may have been exfiltrated but are unsure. The team needs to determine the extent of data exfiltration as quickly as possible. What action should the team take FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review DNS logs for outbound connections to unknown destinations. Reviewing DNS logs can reveal connections to known malicious domains or unusual patterns, helping identify data exfiltration. Blocking the domain is a containment step but doesn't aid analysis. Running a network scan may be too broad. Resetting passwords is important but not for detecting exfiltration.

Answer

Block the malicious domain at the firewall

Answer

Reset all employees' passwords

Answer

Run a full network scan for open ports

Question 2

An organization has a security program that is aligned with ISO 27001. During an internal audit, it is discovered that several controls are not being applied consistently across all departments. The MOST effective corrective action is to:

Accepted Answer

Establish a centralized security oversight function. The core issue is inconsistent control application across departments, which indicates a lack of governance and oversight rather than a policy or awareness deficiency. Establishing a centralized security oversight function directly addresses this by creating a single authority to enforce, monitor, and standardize control implementation, ensuring alignment with ISO 27001 requirements for management commitment and resource allocation (Clause 5.1 and 7.1). This corrective action provides the necessary organizational structure to drive consistent execution, which is the most effective long-term solution.

Answer

Update the information security policy

Answer

Increase security awareness training frequency

Answer

Conduct a risk assessment for each department

Question 3

A financial institution is developing an information security program based on the COBIT framework. The board has requested a balanced scorecard to communicate program effectiveness. Which of the following metric categories would best align with the 'Internal Processes' perspective?

Accepted Answer

Percentage of security incidents detected within defined SLAs. The 'Internal Processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of internal operational processes. The percentage of security incidents detected within defined SLAs directly measures the performance of the security monitoring and incident response processes, which are core internal processes in a COBIT-based information security program.

Answer

Cost of security incidents as a percentage of revenue

Answer

Number of security training hours per employee

Answer

Customer satisfaction survey scores on data protection

Question 4

What is the primary purpose of having a pre-established forensic retainer agreement with an external forensics firm?

Accepted Answer

To reduce time to engage during an incident. The primary purpose of a pre-established forensic retainer agreement is to reduce the time to engage during an incident. By having a contract already in place, the organization can bypass procurement and legal review delays, enabling the forensics firm to begin work immediately when an incident occurs, which is critical for preserving volatile evidence and minimizing damage.

Answer

To ensure chain of custody

Answer

To reduce legal liability

Answer

To guarantee confidentiality

Question 5

A multinational corporation is implementing a risk-based approach to information security governance. The chief information security officer (CISO) has been asked to prioritize security initiatives based on business impact. Which of the following actions should the CISO take FIRST to align security governance with business objectives?

Accepted Answer

Conduct a business impact analysis (BIA) to identify critical processes and their security requirements.. Conducting a business impact analysis (BIA) is the foundational step in a risk-based governance approach because it identifies critical business processes, their recovery time objectives (RTOs), and the specific security requirements needed to protect them. Without this analysis, the CISO cannot align security initiatives with business impact, as the BIA directly links security controls to the organization's most valuable assets and operational priorities.

Answer

Enforce multifactor authentication (MFA) for all remote access.

Answer

Implement a compliance management tool to track regulatory requirements.

Answer

Deploy a security information and event management (SIEM) system to centralize log analysis.

Question 6

Which TWO of the following are key components of a security operations center (SOC)? (Select TWO)

Accepted Answer

Incident response. Incident response (C) is a core SOC component because the SOC's mission includes detecting, containing, eradicating, and recovering from security incidents, typically following a defined IR lifecycle and using tools like SIEM alerts, ticketing, and forensic analysis. Security monitoring and detection (D) is also fundamental, as the SOC continuously collects and correlates telemetry (for example, logs and network flows via a SIEM) to identify suspicious activity and generate alerts that drive response. Vulnerability scanning (A) is a vulnerability management activity often performed by a separate team, even if its output may inform SOC prioritization. Identity and access management (B) is an access-control discipline typically owned by IAM/identity teams, not a defining SOC component. Application security testing (E) belongs to secure development/AppSec functions such as SAST, DAST, and SCA, rather than the SOC's monitoring-and-response core.

Answer

Vulnerability scanning

Answer

Identity and access management

Answer

Application security testing

Question 7

Which of the following is the PRIMARY responsibility of the CISO in an organization?

Accepted Answer

Owning the information security strategy and programme. The CISO is a senior executive whose primary accountability is owning and directing the information security strategy and programme, aligning it with business objectives and reporting to the board or CEO. This strategic ownership distinguishes the role from operational or assurance functions. Managing infrastructure, auditing controls, and running day-to-day operations are execution responsibilities delegated to IT, audit, and security operations teams respectively.

Answer

Managing the IT infrastructure

Answer

Auditing security controls

Answer

Performing day-to-day security operations

Question 8

An organization's information security program has been in place for two years. During a recent audit, several findings indicated that security controls are not consistently applied across business units. The CISO has been asked to improve the program. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a risk assessment to identify gaps and prioritize remediation.. Conducting a risk assessment first (Option C) is the correct initial step because it systematically identifies where controls are failing or missing across business units, quantifies the associated risks, and prioritizes remediation based on business impact. Without this foundational analysis, any subsequent actions—such as automation, policy updates, or new controls—would lack direction and could waste resources on low-priority areas. This aligns with the CISM program lifecycle, where risk assessment drives all other program improvements.

Answer

Automate security compliance monitoring across all business units.

Answer

Update the information security policy to mandate compliance.

Answer

Implement additional security controls across all business units.

Question 9

Which of the following is the most important factor for ensuring the long-term success of an information security program?

Accepted Answer

Strong support from top management.. Strong support from top management is the most important factor because it ensures the information security program receives adequate budget, organizational authority, and strategic alignment with business objectives. Without executive sponsorship, even the best technical controls can be undermined by resource constraints, policy non-compliance, or lack of cross-departmental cooperation. The CISM framework emphasizes that governance and leadership commitment are foundational to sustaining a security program over time.

Answer

Deployment of advanced security technologies.

Answer

Comprehensive security awareness training.

Answer

Regular penetration testing.

Question 10

An incident response team is analyzing a phishing email that successfully compromised a user's credentials. Which TWO indicators of compromise (IOCs) should the team prioritize collecting? (Choose two.)

Accepted Answer

The IP address of the sending server.. Option B is correct because the IP address of the sending server is a network-based IOC that can be used to block or monitor the source of the phishing email and correlate it with other attacks. Option C is correct because the malicious URL or attachment hash provides a host- or file-based IOC that can be used to detect the payload, block it at email/web gateways, and search for other victims. Option A is not a prioritized IOC for this scenario because browser history is user activity data that may be noisy and is not directly tied to the phishing infrastructure. Option D is not an IOC because a personal phone number is not a technical artifact of the compromise. Option E is not an IOC because the company's public website is a legitimate asset, not an indicator of malicious activity.

Answer

The user's browser history.

Answer

The user's personal phone number.

Answer

The company's public website.

Question 11

As part of post-incident activities, an organization schedules a lessons learned meeting. When should this meeting ideally take place?

Accepted Answer

Within 2 weeks of incident resolution. Lessons learned meetings should occur within two weeks of incident resolution while details are fresh, to capture accurate feedback and improve the IR plan.

Answer

At the next quarterly board meeting

Answer

Immediately after the incident is detected

Answer

Only after all legal proceedings are concluded

Question 12

A security program lacks executive support. What is the best strategy to gain support?

Accepted Answer

Show risk quantification in business terms. C is correct because executive stakeholders prioritize business outcomes over technical details. By quantifying risks in financial terms (e.g., potential loss exposure, ROI of mitigation), the security manager aligns with the organization's strategic language, making the case for investment compelling and actionable. This approach directly addresses the root cause—lack of perceived business value—rather than relying on technical arguments or fear.

Answer

Hire a security consultant to advise

Answer

Implement quick-win security improvements

Answer

Threaten regulatory fines for non-compliance

Question 13

A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)

Accepted Answer

Employee role and job function. Option B (Employee role and job function) is correct because employees in finance, HR, or executive roles face different phishing lures and risk levels, so simulations should be tailored to the specific threats and responsibilities of each role. Option C (Past phishing click rate trends) is correct because historical click-rate data reveals which users or departments are most susceptible, allowing frequency and difficulty to be adjusted upward or downward based on demonstrated performance. Option E (Current threat landscape and prevalent attack types) is correct because simulations must reflect real-world tactics such as credential harvesting, QR-code phishing, or business email compromise that are actively trending, ensuring training stays relevant. Option A (Employee's years of service) is not a reliable indicator of phishing susceptibility, since tenure does not correlate consistently with security awareness or behavior. Option D (Number of security incidents in the past year) is too broad and lagging an indicator; it does not directly inform the design of phishing simulation frequency or difficulty the way role, click trends, and threat landscape do.

Answer

Employee's years of service

Answer

Number of security incidents in the past year

Question 14

Which of the following incident categories would typically require the involvement of the crisis management team?

Accepted Answer

A P1 critical-severity ransomware attack encrypting critical systems.. A P1 critical-severity ransomware attack encrypting critical systems requires immediate activation of the crisis management team because it poses an existential threat to business operations, often involving legal, PR, executive, and regulatory stakeholders. The crisis management team handles incidents that exceed the capacity of the incident response team, typically those with high business impact, widespread system compromise, or potential for significant financial/reputational damage.

Answer

A P2 high-severity DDoS attack that has been mitigated within a few hours.

Answer

A P3 medium-severity insider threat involving unauthorized access to a non-critical system.

Answer

A P4 low-severity phishing email reported by a user.

Question 15

A government agency is criticized for poor security governance after a data breach. An external review finds that security policies are not aligned with agency's mission. The director wants to implement a governance framework that ties security to strategic objectives. Which framework is most suitable?

Accepted Answer

COBIT 2019. COBIT 2019 is specifically designed as an IT governance framework that aligns IT (including security) with enterprise strategic objectives. It provides a comprehensive governance system with principles, enablers, and performance management to ensure that IT delivers value and mitigates risks in line with business goals. Unlike security-focused frameworks, COBIT emphasizes governance and management of enterprise IT, making it ideal for tying security to the agency's mission.

Answer

NIST Cybersecurity Framework

Answer

PCI DSS

Answer

ISO 27001

Question 16

An organization is implementing a vendor risk management program. A vendor that provides cloud-based HR services will have access to employee PII. According to industry best practices, what should be the first step in the vendor lifecycle?

Accepted Answer

Perform a risk assessment of the vendor. The first step in the vendor lifecycle is to perform a risk assessment of the vendor (B). Before any contractual, audit, or documentation requests, the organization must understand the risk the vendor poses based on the data it will access (employee PII) and the criticality of the service. This risk assessment determines the appropriate level of due diligence, contractual controls, and ongoing monitoring — it drives all subsequent steps.

Answer

Include security requirements in the contract

Answer

Request the vendor's SOC 2 report

Answer

Conduct an onsite audit of the vendor

Question 17

An organization is implementing a vendor tiering program for third-party risk management. Which TWO criteria should be used to classify vendors into high, medium, or low risk tiers? (Select TWO)

Accepted Answer

Type and sensitivity of data accessed. Option B is correct because the type and sensitivity of data a vendor accesses directly determines the potential impact of a breach — vendors handling regulated data such as PII, PHI, or PCI cardholder data warrant higher risk tiers than those with no data access. Option D is correct because the criticality of the service provided reflects how much business disruption would occur if the vendor failed, making it a core input to tiering under frameworks like NIST and ISO 31000. Options A, C, and E are not primary tiering criteria: contract length does not indicate inherent risk, annual revenue reflects vendor size rather than the risk it poses to the organization, and geographic location is at most a secondary or contextual factor rather than a defining classification criterion.

Answer

Length of contract

Answer

Vendor's annual revenue

Answer

Vendor's geographic location

Question 18

During a merger, the acquiring company's CISO must integrate the security governance of the target company. The target company has no formal security governance. What is the FIRST step the CISO should take?

Accepted Answer

Perform a comprehensive risk assessment of the target company's security posture.. Without a formal security governance structure, the CISO must first understand the target company's current security posture through a comprehensive risk assessment. This step identifies vulnerabilities, threats, and gaps in controls, providing the baseline data needed to prioritize integration efforts and align with the acquirer's governance framework. Skipping this assessment risks implementing policies that are irrelevant or ineffective against the target's actual risks.

Answer

Conduct a security awareness training for the target company's employees.

Answer

Align the target company's security policies with the acquirer's policies.

Answer

Implement the acquirer's security governance framework immediately.

Question 19

Which TWO of the following are essential components of an incident response (IR) plan? (Select TWO)

Accepted Answer

Communication templates. Communication templates (C) are an essential IR plan component because during an incident responders must notify stakeholders, legal, regulators, and customers quickly and consistently, and pre-approved templates prevent delays and wording errors under pressure. The IR team roster and contact list (E) is also essential because the plan must identify who is on the incident response team and how to reach them (including after-hours and escalation contacts) so the team can be assembled immediately. Detailed network architecture diagrams (B) and vendor risk assessment reports (A) are valuable supporting artifacts for preparation and investigation, but they are not core components of the IR plan itself. A ransomware playbook (D) is a useful specialized procedure, yet it is only one scenario-specific playbook rather than a foundational element required in every IR plan.

Answer

Vendor risk assessment reports

Answer

Detailed network architecture diagrams

Answer

Playbook for ransomware incidents

Question 20

A security analyst detects unusual outbound network traffic from a database server to an unknown IP address. The traffic uses encrypted connections on port 443. Which type of attack is MOST likely occurring?

Accepted Answer

Data exfiltration. The encrypted outbound traffic on port 443 (HTTPS) from a database server to an unknown IP is a classic indicator of data exfiltration. Attackers often use encrypted channels to bypass network security controls, as the contents of the traffic cannot be inspected by DLP or IDS/IPS systems. The database server is a high-value target for sensitive data, making this the most likely attack scenario.

Answer

SQL injection

Answer

Ransomware

Answer

Denial of service