CISM Practice Test 5 — 25 Questions

Question 1

An organization is implementing a new cloud-based ERP system. Which of the following is the MOST important action for the information security manager to ensure alignment with the organization's risk appetite?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a risk assessment to identify and evaluate risks associated with the cloud deployment.. Conducting a risk assessment (A) is the most important action because it directly evaluates the cloud ERP deployment against the organization's risk appetite, identifying, analyzing, and evaluating risks such as data exposure, vendor lock-in, and compliance gaps. This foundational step ensures that subsequent controls, contracts, and policies are aligned with the acceptable level of risk, as defined by the organization's risk tolerance thresholds.

Answer

Review the cloud provider's SOC 2 report for compliance with relevant regulations.

Answer

Negotiate contract terms including data protection clauses with the cloud provider.

Answer

Develop a detailed access control policy specifically for the cloud ERP system.

Question 2

Which of the following best describes the primary purpose of a security program's governance framework?

Accepted Answer

To provide oversight and alignment with business objectives. The primary purpose of a security program's governance framework is to provide oversight and ensure that security activities are aligned with business objectives, risk appetite, and regulatory requirements. It establishes the policies, roles, and accountability structures that guide decision-making, rather than directly executing technical tasks. This alignment is critical for the program to be sustainable and supported by executive management.

Answer

To implement technical security controls

Answer

To conduct vulnerability assessments

Answer

To manage security incidents

Question 3

An organization has a mature security program but is experiencing an increase in successful social engineering attacks. The incident response team has confirmed that the attacks are bypassing current controls. What should the program manager do first?

Accepted Answer

Conduct a root cause analysis and update risk assessment. A root cause analysis (RCA) is the correct first step because it identifies the specific weaknesses in people, processes, or technology that allowed the social engineering attacks to bypass existing controls. Updating the risk assessment based on RCA findings ensures that remediation efforts are prioritized against actual threats, rather than applying generic fixes. This aligns with the CISM principle that program management decisions must be data-driven and risk-based.

Answer

Implement multi-factor authentication for all systems

Answer

Disable email links and attachments

Answer

Increase the frequency of security awareness training

Question 4

Which of the following is the PRIMARY purpose of a security program's key performance indicators (KPIs)?

Accepted Answer

To measure the effectiveness of security controls. KPIs are designed to provide measurable evidence of how well the security program is achieving its objectives, specifically by quantifying the effectiveness of security controls. For example, a KPI like 'mean time to detect (MTTD)' directly measures the performance of detection controls, enabling data-driven decisions on control improvements. This aligns with the CISM focus on governance and performance management, not just compliance or budgeting.

Answer

To ensure compliance with regulations

Answer

To assign accountability to individuals

Answer

To track the budget for security initiatives

Question 5

Which of the following is the FIRST step in the security policy development lifecycle?

Accepted Answer

Gap analysis. In the security policy development lifecycle, a gap analysis is performed first to compare the organization's current state against the desired state (e.g., regulatory requirements, frameworks like ISO 27001 or NIST). This identifies what policies are missing or inadequate before drafting begins. Only after gaps are understood can legal review, stakeholder consultation, and formal approval meaningfully occur.

Answer

Legal review

Answer

Approval

Answer

Stakeholder consultation

Question 6

An organization's incident response team has completed the initial response to a ransomware incident. During the post-incident review, they identify that the detection was delayed because security logs from different systems were not correlated. The team wants to improve detection capabilities. What should the team recommend as the primary improvement?

Accepted Answer

Implement a Security Information and Event Management (SIEM) system. A SIEM system is the primary improvement because it aggregates and correlates security logs from diverse sources in real time, enabling automated detection of patterns like ransomware propagation that manual or siloed logging cannot achieve. By normalizing log formats and applying correlation rules, a SIEM reduces detection latency and provides actionable alerts, directly addressing the identified gap in log correlation.

Answer

Hire additional security analysts to manually correlate logs

Answer

Increase the amount of logging on all systems

Answer

Reduce log retention to lower storage costs

Question 7

When selecting security controls based on NIST SP 800-53, which control family is MOST directly related to protecting the confidentiality of data?

Accepted Answer

Access Control (AC). In NIST SP 800-53, the Access Control (AC) family is the most directly related to protecting data confidentiality because it governs who can access which resources and under what conditions, including least privilege, separation of duties, and information flow enforcement. Confidentiality is fundamentally about restricting unauthorized read access, which is the core purpose of AC controls.

Answer

Identification and Authentication (IA)

Answer

System and Communications Protection (SC)

Answer

Audit and Accountability (AU)

Question 8

Which TWO are common challenges in incident management?

Accepted Answer

Inadequate communication between teams. Option A (Inadequate communication between teams) is correct because incident management depends on rapid, accurate information flow across responders, service owners, and stakeholders; breakdowns in communication cause delayed escalations, duplicated effort, and prolonged mean time to resolution (MTTR). Option B (Lack of executive support) is correct because without executive sponsorship, incident management programs often lack the authority, funding, staffing, and cross-departmental cooperation needed to enforce processes, prioritize remediation, and drive continual improvement. Options C, D, and E are not common incident management challenges: having too many technical staff is not typically a recognized problem, over-reliance on automation is a general operational risk rather than a core incident management challenge, and excessive documentation is not a standard pain point since most organizations struggle with insufficient rather than excessive documentation.

Answer

Too many technical staff

Answer

Over-reliance on automation

Answer

Excessive documentation

Question 9

Which of the following are key components of a mature information security program? (Select 2)

Accepted Answer

Comprehensive risk management process. A comprehensive risk management process is a foundational component of a mature information security program because it ensures that security controls are aligned with business objectives through systematic identification, assessment, and treatment of risks. This process, often guided by frameworks like ISO 31000 or NIST SP 800-39, enables prioritization of resources based on risk appetite and tolerance, rather than relying on ad-hoc or reactive measures. Without this, the program lacks the structured governance needed to adapt to evolving threats and regulatory requirements.

Answer

Adoption of cloud security tools

Answer

Single point of failure for security decisions

Question 10

Which component is essential for building a strong security culture within an organization?

Accepted Answer

Executive sponsorship and visible leadership. Executive sponsorship and visible leadership are essential because security culture is shaped by what leaders prioritise, model, and reward. When executives visibly champion security — allocating resources, participating in governance, and holding managers accountable — employees internalise that security matters. Without top-level sponsorship, awareness efforts are seen as a compliance chore rather than a business value.

Answer

Mandatory annual password changes

Answer

Increasing the security budget

Answer

Implementing the latest technology

Question 11

A security manager is developing a new information security program for a mid-sized company. Which of the following should be the FIRST step?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment is the foundational first step in developing an information security program because it identifies and prioritizes the specific threats, vulnerabilities, and business impacts that the program must address. Without a risk assessment, any subsequent policies, controls, or tools would be based on assumptions rather than the organization's actual risk profile, leading to misallocated resources and ineffective security. This aligns with the CISM framework, which emphasizes that risk management drives the entire security program lifecycle.

Answer

Implement technical controls

Answer

Purchase security tools

Answer

Develop security policies

Question 12

Which TWO of the following are key indicators of a potential insider threat incident? (Select exactly 2)

Accepted Answer

A user accessing large volumes of data not related to their job function. A user accessing large volumes of data unrelated to their job function is a classic behavioral anomaly indicating potential data exfiltration. This pattern often precedes an insider threat incident, as the user may be collecting sensitive information for unauthorized purposes, such as selling it or using it for personal gain. Security information and event management (SIEM) systems typically flag such access based on deviations from baseline user behavior, triggering further investigation.

Answer

Multiple failed login attempts from an external IP address

Answer

An increase in network traffic to a known malicious domain

Answer

A user updating their password as required by policy

Question 13

A company's security program includes a set of controls based on a risk assessment. During an audit, several controls are found to be ineffective. What should the security manager do first?

Accepted Answer

Conduct a root cause analysis to determine why controls failed.. When controls are found ineffective, the security manager must first conduct a root cause analysis to identify why the controls failed. This aligns with the CISM's emphasis on corrective action based on understanding the underlying failure, such as misconfigured firewall rules, outdated signature databases, or improper access control lists (ACLs). Without this analysis, any subsequent remediation (like implementing compensating controls or increasing testing frequency) may address symptoms rather than the actual cause, leading to recurring failures.

Answer

Increase the frequency of control testing.

Answer

Report the findings to management and accept the risk.

Answer

Implement compensating controls immediately.

Question 14

Which THREE of the following are appropriate members of a crisis management team (CMT) for a major cybersecurity incident? (Select three.)

Accepted Answer

General Counsel (GC). The General Counsel (GC) is a correct CMT member because major cybersecurity incidents carry legal, regulatory, contractual, and disclosure obligations, so the GC advises on breach notification laws, litigation risk, and privilege. The Chief Information Security Officer (CISO) is correct because the CISO owns the security program and provides executive-level technical and strategic leadership for incident response decisions. The Chief Executive Officer (CEO) is correct because a major incident can threaten the entire organization, and the CEO holds ultimate authority for business continuity, stakeholder communication, and resource commitment. A security analyst and a forensic investigator are not appropriate CMT members; they are operational/technical responders who perform hands-on triage and evidence analysis and report to the CMT rather than sitting on it.

Answer

Security analyst

Answer

Forensic investigator

Question 15

An organization is designing a vendor tiering process for its third-party risk management program. Which TWO factors are MOST appropriate for determining a vendor's risk tier?

Accepted Answer

Type and sensitivity of data the vendor accesses. Option A is correct because the type and sensitivity of the data a vendor accesses directly drives the inherent risk of a data breach or regulatory violation, making it a primary factor in tiering (e.g., PII, PHI, or PCI data raises the tier). Option E is correct because the criticality of the vendor's service to business operations determines the impact of a vendor failure or outage on the organization's ability to function, which is a core dimension of vendor risk tiering. In contrast, Option B (geographic location) can influence risk but is not a primary tiering factor by itself and is often a sub-factor under data and operational considerations. Option C (number of employees) and Option D (annual revenue) are vendor size metrics that do not directly reflect the risk the vendor poses to the organization's data or operations, so they are not the most appropriate determinants.

Answer

Vendor's geographic location

Answer

Number of employees at the vendor

Answer

Vendor's annual revenue

Question 16

Which control framework is most appropriate for an organization that wants a prioritized set of controls based on implementation groups (IG1, IG2, IG3)?

Accepted Answer

CIS Controls v8. CIS Controls v8 is uniquely structured around Implementation Groups (IG1, IG2, IG3), which prioritize safeguards based on organizational size, resources, and risk. No other major framework uses this exact IG tiering model. The question's mention of 'prioritized set of controls based on implementation groups' is a direct signature of CIS Controls v8.

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Question 17

Which of the following best describes the primary purpose of an Information Security Program?

Accepted Answer

To align security efforts with business objectives and manage risk.. The primary purpose of an Information Security Program is to align security efforts with business objectives and manage risk to an acceptable level. This ensures that security investments and activities directly support the organization's mission, rather than operating in isolation. A program focused solely on compliance or technical controls may fail to address the dynamic risk landscape and business needs.

Answer

To reduce the number of security incidents to zero.

Answer

To ensure compliance with all relevant laws and regulations.

Answer

To implement technical security controls across all systems.

Question 18

An organization is updating its incident response playbook after a ransomware attack. Which of the following should be included as a key step in the ransomware playbook?

Accepted Answer

Isolate affected systems from the network. Ransomware playbooks should include isolating infected systems to prevent spread, as containment is a priority.

Answer

Reboot all servers to clear the ransomware

Answer

Immediately pay the ransom demand

Answer

Notify all customers immediately

Question 19

Which role in the incident response team structure is responsible for coordinating all response activities and making decisions about incident severity classification?

Accepted Answer

Incident response manager. The IR manager leads the team, coordinates activities, and classifies incidents based on severity.

Answer

Communications lead

Answer

Security analysts

Answer

Forensic investigators

Question 20

An incident response team is handling a supply chain compromise that has affected a critical business process. The estimated recovery time exceeds the maximum tolerable downtime (MTD). What should the incident manager do NEXT?

Accepted Answer

Escalate to the BC/DR team and the authority who can declare a disaster. When MTD is exceeded, the incident escalates to business continuity/disaster recovery activation. The BC/DR decision authority should be notified to declare a disaster and activate recovery plans.

Answer

Notify affected customers of the expected delay

Answer

Continue containment efforts and hope for a faster recovery

Answer

Shut down the affected system to prevent further impact