CISM Practice Test 4 — 25 Questions

Question 1

An organization's security program includes metrics to measure performance. Which metric BEST indicates the effectiveness of the vulnerability management process?

Accepted Answer

Mean time to remediate (MTTR) vulnerabilities. Mean time to remediate (MTTR) directly measures how quickly the organization closes the window of exposure after a vulnerability is identified. A lower MTTR indicates a more effective vulnerability management process because it reduces the risk window, whereas raw counts of vulnerabilities or patches do not reflect the timeliness or completeness of remediation.

Answer

Number of vulnerabilities identified

Answer

Number of patches deployed per month

Answer

Percentage of systems scanned weekly

Question 2

Which document should be reviewed and updated at least annually?

Accepted Answer

Incident response plan. The incident response plan must be reviewed and updated at least annually to ensure it remains effective against evolving threats and changes in the organization. Option B is correct. Vendor contracts (A), network topology diagrams (C), and user manuals (D) are typically reviewed on a different schedule or as needed, not necessarily annually.

Answer

Vendor contracts

Answer

Network topology diagram

Answer

User manuals

Question 3

An organization has experienced a DDoS attack that is overwhelming its internet-facing services. The incident response team has implemented mitigations, but services remain degraded. The maximum tolerable downtime (MTD) for the affected services is 4 hours, and 3 hours have passed. Which of the following should the incident manager do NEXT?

Accepted Answer

Escalate to the crisis management team to consider activating the disaster recovery plan.. If an incident cannot be resolved within the MTD, it should transition to BC/DR activation. The decision authority (e.g., CISO or CMT) should declare a disaster.

Answer

Continue current mitigation efforts and reassess after another hour.

Answer

Increase the capacity of the DDoS mitigation service.

Answer

Notify customers of a prolonged outage.

Question 4

You are the CISO of a mid-sized e-commerce company with 500 employees. The company recently suffered a data breach where an attacker exfiltrated customer credit card data from the production database. The investigation revealed that the breach originated from a compromised developer workstation. The developer had been granted direct access to the production database for troubleshooting purposes, a practice that had been in place for years. The security governance framework currently lacks a formal process for managing privileged access. The board has asked for immediate improvements to prevent recurrence. Which course of action BEST addresses the governance gap?

Accepted Answer

Implement a privileged access management (PAM) solution with just-in-time access and session recording.. The core governance gap is the lack of a formal process for managing privileged access. Implementing a Privileged Access Management (PAM) solution with just-in-time (JIT) access and session recording directly addresses this by enforcing time-bound, auditable, and approved access to the production database, eliminating standing privileges. This aligns with the principle of least privilege and provides a governance mechanism to control, monitor, and revoke elevated access, which is the root cause of the breach.

Answer

Segment the network to isolate production databases from developer workstations.

Answer

Conduct security awareness training for all developers on password security.

Answer

Deploy endpoint protection and patch management for all workstations.

Question 5

You are the incident response manager for a multinational corporation that processes sensitive financial data. The company has a mature security operations center (SOC) that monitors network traffic, endpoints, and cloud services. At 2:00 AM local time, the SOC alerts you to a critical incident: an internal server (IP 10.10.10.50) is communicating with an external IP address (198.51.100.23) known to be associated with a ransomware group. The server hosts a financial database that is replicated to a secondary site every 6 hours. The last successful replication was at 1:00 AM. The SOC has already isolated the server from the network by blocking its outbound traffic at the firewall. However, the server is still running. The initial investigation suggests that the communication started 30 minutes ago. The database contains customer PII and transactional data. Your incident response plan includes steps for containment, eradication, recovery, and post-incident review. The CEO is being notified and expects a recommendation on the best course of action. The company has a cyber insurance policy that requires timely notification and preservation of evidence. The legal department advises that any action that could destroy evidence must be carefully considered. Which of the following is the BEST course of action?

Accepted Answer

Take a forensic image of the server's memory and disk for analysis, then rebuild the server from a known good backup.. It balances forensic preservation (memory and disk imaging) with recovery from a known good backup, ensuring evidence is intact for legal and insurance requirements while restoring operations. The server is isolated, so imaging can be done safely without risk of further compromise, and the 1:00 AM backup (just one hour before the 2:00 AM communication started) is likely clean, minimizing data loss.

Answer

Reconnect the server to the network and attempt to negotiate with the attacker if ransomware is detected.

Answer

Immediately wipe the server and restore from the 1:00 AM backup to minimize downtime.

Answer

Leave the server isolated but running to monitor the attacker's actions and gather intelligence.

Question 6

During an incident investigation, the team discovers that an attacker used a valid user's credentials to access a sensitive database. The user's account had multi-factor authentication (MFA) enabled. How is this MOST likely possible?

Accepted Answer

The user approved a fraudulent MFA prompt. MFA fatigue attacks (also known as push bombing) involve an attacker repeatedly sending MFA push notifications to the user until the user, annoyed or confused, approves one. This allows the attacker to bypass MFA without needing the token or password. Option A is less likely because MFA was enabled and properly configured; Option B is incorrect because MFA tokens are generated dynamically and cannot be guessed; Option D is possible but not the most likely given the description that a valid user's credentials were used and MFA was enabled, making user approval the weakest link.

Answer

MFA was not properly configured

Answer

The attacker guessed the MFA token

Answer

The attacker used a man-in-the-middle attack

Question 7

An information security manager is developing a program metric to measure the effectiveness of the security awareness training. Which metric is most appropriate?

Accepted Answer

Number of security incidents caused by human error.. The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

Answer

Percentage of employees who completed the training.

Answer

Average score on post-training tests.

Answer

Time taken to complete the training modules.

Question 8

An incident response team discovers that an attacker used stolen credentials to access a database. Which step is MOST critical during the eradication phase?

Accepted Answer

Reset all passwords and revoke certificates.. During the eradication phase, the primary goal is to remove all traces of the attacker's access and prevent immediate re-entry. Since the breach occurred via stolen credentials, resetting all passwords and revoking certificates ensures that the attacker can no longer authenticate using those compromised secrets, directly addressing the root cause of the initial access.

Answer

Implement multi-factor authentication.

Answer

Patch the database server.

Answer

Restore the database from backup.

Question 9

Match each risk assessment activity with the correct phase of the risk management lifecycle:

Activities:
1. Identify assets and threats
2. Determine risk level
3. Select controls to reduce risk
4. Monitor risk over time

Phases:
A. Risk Assessment
B. Risk Treatment
C. Risk Monitoring
D. Risk Communication (not used)

Answer

Identify assets and threats

Answer

Determine risk level

Answer

Select controls to reduce risk

Answer

Monitor risk over time

Question 10

After a merger, the combined organization has two different risk tolerance levels: one entity is risk-averse, the other is risk-taking. What is the best governance action?

Accepted Answer

Reassess risk appetite and approve a single unified statement. After a merger, maintaining two separate risk tolerance levels creates governance fragmentation and prevents a unified security posture. The correct action is to reassess the combined organization's risk appetite and approve a single unified statement, as this aligns with the CISM principle that risk governance must be cohesive across the entire enterprise. This ensures consistent risk management decisions, resource allocation, and policy enforcement, avoiding conflicts that could lead to security gaps or regulatory non-compliance.

Answer

Adopt the less restrictive risk tolerance

Answer

Maintain separate risk tolerance levels for each legacy entity

Answer

Adopt the more conservative risk tolerance across the board

Question 11

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 12

You are the information security manager for a mid-sized e-commerce company. The company operates a web application that handles credit card transactions and stores customer data in a backend database. The incident response team has just been alerted to a potential data breach: an intrusion detection system (IDS) flagged a SQL injection attack pattern on the web application's login page. The attack originated from an external IP address (5.5.5.5) and appears to have been successful, as the IDS also detected a large outbound data transfer from the database server to another external IP (6.6.6.6) shortly after. The database server is not segmented from the web server. The company has a legal obligation to report breaches involving cardholder data within 72 hours. The incident response plan is being activated. The team includes a forensic analyst, a network engineer, and a legal advisor. The web application is currently running and serving customers. The CEO wants to minimize business disruption. Which of the following actions should the incident response team take FIRST?

Accepted Answer

Isolate the database server from the network and block outbound traffic to the external IP.. The immediate priority is to contain the breach by isolating the compromised database server and blocking outbound traffic to the attacker's IP (6.6.6.6). This stops the exfiltration of cardholder data, preserves evidence on the isolated server, and minimizes business disruption by keeping the web application running. Shutting down servers (Option A) would cause unacceptable downtime, while patching (Option C) or imaging (Option D) without containment would allow continued data loss.

Answer

Shut down the web application and database server immediately to stop the breach.

Answer

Patch the SQL injection vulnerability in the web application and continue monitoring.

Answer

Take a full forensic image of all servers before taking any containment actions.

Question 13

An organization has recently experienced a data breach due to a misconfigured database. The root cause was a lack of proper change management. As part of the risk management process, what should the organization do NEXT after implementing corrective controls?

Accepted Answer

Perform a residual risk assessment. After implementing corrective controls, the next step in the risk management process is to perform a residual risk assessment. This evaluates the remaining risk after controls are applied, ensuring that the organization's risk appetite is not exceeded. Without this assessment, the organization cannot confirm whether the implemented controls are sufficient or if additional measures are needed.

Answer

Purchase additional cyber insurance to cover future breaches

Answer

Conduct security awareness training for all employees

Answer

Update the information security policy to mandate stricter controls

Question 14

An organization's security strategy includes a goal to achieve CMM Level 3. What capability does the organization need to demonstrate?

Accepted Answer

Standardized and documented security processes. Level 3 (Defined) requires standardized, documented processes across the organization.

Answer

Ad-hoc security processes

Answer

Quantitative measurement of process effectiveness

Answer

Continuous process optimization

Question 15

An organization uses ISO 27001 Annex A as its control framework. During a risk assessment, a control weakness is identified that could lead to a high-impact data breach. However, implementing the recommended control is cost-prohibitive. Which approach BEST addresses this situation?

Accepted Answer

Implement a compensating control that provides equivalent protection. Compensating controls provide an alternative means of mitigating risk when the primary control is not feasible.

Answer

Transfer the risk through cyber insurance

Answer

Reduce the risk rating to justify not implementing

Answer

Accept the risk without further action

Question 16

A security manager is measuring the security culture of the organization. Which three metrics are most appropriate?

Accepted Answer

Phishing simulation click rate. These metrics directly reflect employee behavior and the effectiveness of the security culture program.

Answer

Security budget as percentage of IT budget

Answer

Number of security policies published

Question 17

An organization is updating its security governance framework. Which three elements are essential for ensuring board-level oversight?

Accepted Answer

Board-level risk committee review of security posture. These three elements ensure the board can fulfill its oversight role effectively.

Answer

Security awareness training for board members

Answer

CISO reporting directly to the CEO

Question 18

Which TWO actions are appropriate during the containment phase of an incident involving a malware outbreak on multiple workstations?

Accepted Answer

Isolate infected workstations from the network. Isolating infected workstations from the network is a primary containment action that prevents the malware from spreading laterally to other systems, limiting the scope of the incident. This is typically achieved by disconnecting network cables, disabling switch ports, or using network access control (NAC) to quarantine the affected hosts, which stops further propagation without destroying forensic evidence.

Answer

Contact all users to warn them about the malware

Answer

Reimage all affected workstations immediately

Answer

Notify customers about potential data breach

Question 19

Acme Corp, a global manufacturer, has a decentralized security governance model. Each business unit manages its own security, resulting in inconsistent policies and repeated audit findings. The new CISO proposes a federated model where a central team sets minimum standards and each unit can add local controls. However, the European unit's head insists on full autonomy due to GDPR strictness. The board is concerned about compliance costs. What should the CISO do first?

Accepted Answer

Conduct a risk assessment to identify where local controls are truly needed. Conducting a risk assessment will identify where local controls are truly necessary and justify the federated model. Option A ignores local concerns. Option B undermines the federation goal. Option D is a tactical fix, not strategic.

Answer

Implement the federated model immediately and require all units to comply

Answer

Allow the European unit to keep full autonomy while others follow the model

Answer

Hire a GDPR expert for the European unit

Question 20

You are the information security manager for a mid-sized e-commerce company with 500 employees. The company recently experienced a data breach where an attacker exploited a vulnerability in a third-party payment processing API, resulting in the exposure of 10,000 customer credit card numbers. The breach was detected by an external forensics team 90 days after the initial compromise. The board is concerned about the company's ability to detect and respond to incidents. Currently, the company has a part-time security team of three people who focus on firewall management and antivirus updates. There is no formal incident response plan, and security monitoring is limited to basic log review once a week. The CISO has asked you to recommend a course of action to improve the security posture, with a focus on governance and oversight. Which of the following is the BEST course of action?

Accepted Answer

Develop and implement an incident response plan, establish a security operations center (SOC) with 24/7 monitoring, and define clear roles and responsibilities.. The core governance issue is the lack of a formal incident response plan and adequate monitoring. Establishing a SOC with 24/7 monitoring directly addresses the 90-day detection gap, while defining roles and responsibilities ensures accountability and oversight, which are key governance principles. This approach aligns with the CISM focus on establishing processes and oversight rather than just deploying technology.

Answer

Immediately implement a PCI DSS compliance program to ensure all payment data handling meets industry standards.

Answer

Purchase and deploy a next-generation firewall and endpoint detection and response (EDR) tools across the network.

Answer

Outsource all security operations to a managed security service provider (MSSP) with a focus on threat intelligence.