CISM Practice Test 5 — 25 Questions

Question 1

Which of the following is a key objective of sharing threat intelligence, such as indicators of compromise (IoCs), with an Information Sharing and Analysis Center (ISAC)?

Accepted Answer

To receive timely threat information and contribute to community defense. Sharing IoCs helps other organizations detect and defend against similar threats, improving collective security.

Answer

To document the incident for insurance claims

Answer

To market the organization's security capabilities

Answer

To fulfill regulatory requirements for public disclosure

Question 2

During a ransomware incident, the incident response team identifies that the encryption process is still ongoing. The CISO decides to isolate affected systems to prevent further spread. Which of the following is the MOST appropriate next step?

Accepted Answer

Preserve forensic evidence before taking any recovery actions.. Preserving forensic evidence is critical before any recovery actions, especially during an ongoing ransomware incident. The encryption process may still be active, and taking immediate recovery steps (like disconnecting cables or restoring backups) could destroy volatile data (e.g., encryption keys in memory, process artifacts, network connections) that are essential for understanding the attack vector, identifying the ransomware variant, and supporting legal or law enforcement actions. The CISO's decision to isolate systems helps contain the spread, but the next priority must be evidence preservation to ensure a thorough investigation and potential prosecution.

Answer

Disconnect all network cables to stop the encryption.

Answer

Contact law enforcement before any internal actions.

Answer

Restore systems from the most recent backup immediately.

Question 3

A financial institution is integrating a newly acquired fintech startup. The startup has a very different security culture. What governance approach best ensures integration without stifling innovation?

Accepted Answer

Use a transitional risk-based approach, phasing in critical controls while allowing flexibility. A transitional risk-based approach balances control with flexibility, allowing the fintech startup to maintain some of its innovative security practices while gradually aligning with the institution's critical controls. Option A is incorrect because indefinitely allowing the startup to maintain its own policies creates ongoing security gaps and governance inconsistency. Option B is incorrect because forcing immediate adoption of all policies would likely stifle innovation and cause resistance, potentially harming the startup's culture. Option D is incorrect because creating a separate security team can lead to silos and undermines unified governance. The transitional approach minimizes disruption while ensuring essential compliance.

Answer

Allow the startup to maintain its own security policies indefinitely

Answer

Force the startup to adopt all of the institution's policies immediately

Answer

Create a separate security team for the startup

Question 4

Which component of an incident response program is most likely to include step-by-step technical actions for addressing a specific type of security incident?

Accepted Answer

Incident response playbook. An incident response playbook provides detailed, step-by-step technical procedures for handling specific incident types (e.g., ransomware, DDoS, phishing). Unlike higher-level documents, playbooks contain actionable commands, tool-specific instructions, and decision trees that guide responders through containment, eradication, and recovery. This granularity ensures consistent and efficient execution during an active security event.

Answer

Communication templates

Answer

Incident response policy

Answer

Incident response plan

Question 5

Which TWO of the following are key performance indicators (KPIs) commonly used to measure the effectiveness of incident management processes?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) measures the average time between the occurrence of an incident and its detection by monitoring systems or personnel. A lower MTTD indicates faster detection, which is critical for minimizing damage and is a direct KPI for incident management effectiveness. Mean Time to Respond (MTTR) measures the average time from detection to the start of remediation actions, reflecting the efficiency of the response process.

Answer

Percentage of incidents resolved within SLA

Answer

Total cost of incidents

Answer

Number of incidents per month

Question 6

During the eradication phase of an incident response, which action is MOST critical to ensure the threat is fully removed?

Accepted Answer

Reimage all affected systems from known-good backups.. Reimaging all affected systems from known-good backups is the most critical action during the eradication phase because it ensures complete removal of the threat, including any rootkits, persistence mechanisms, or hidden malware that may survive simple file deletion or signature-based scans. This approach eliminates the risk of residual compromise, as the system is restored to a trusted state from a verified backup, which is essential for environments where the integrity of the operating system and applications cannot be guaranteed after an incident.

Answer

Delete the malware files from the system.

Answer

Reset passwords for all user accounts.

Answer

Update antivirus signatures.

Question 7

An organization has a mature security program but is experiencing an increase in successful social engineering attacks. The incident response team has confirmed that the attacks are bypassing current controls. What should the program manager do first?

Accepted Answer

Conduct a root cause analysis and update risk assessment. A root cause analysis (RCA) is the correct first step because it identifies the specific weaknesses in people, processes, or technology that allowed the social engineering attacks to bypass existing controls. Updating the risk assessment based on RCA findings ensures that remediation efforts are prioritized against actual threats, rather than applying generic fixes. This aligns with the CISM principle that program management decisions must be data-driven and risk-based.

Answer

Implement multi-factor authentication for all systems

Answer

Disable email links and attachments

Answer

Increase the frequency of security awareness training

Question 8

An organization is implementing a defense-in-depth strategy. Which of the following is the BEST example of a compensating control?

Accepted Answer

Requiring multi-factor authentication for remote access where strong passwords are not feasible. The best example of a compensating control because it provides an alternative security measure (multi-factor authentication) to mitigate the risk of weak or infeasible strong passwords for remote access. Compensating controls are implemented when a primary control cannot be applied due to technical or operational constraints, and they must achieve an equivalent or greater level of security. In this scenario, MFA compensates for the lack of password strength by requiring an additional authentication factor, such as a one-time passcode (OTP) or biometric, thereby reducing the likelihood of credential compromise.

Answer

Encrypting data at rest using AES-256

Answer

Installing a firewall at the network perimeter

Answer

Conducting quarterly vulnerability scans

Question 9

An organization is updating its incident response plan after a major incident. Which post-incident activity should be performed to ensure the plan reflects lessons learned?

Accepted Answer

Updating the IR plan and playbooks based on lessons learned. Updating the IR plan and playbooks based on lessons learned is the definitive post-incident activity that directly incorporates findings from the after-action review into the operational documentation. This ensures the plan reflects actual gaps or improvements identified during the incident, making it actionable for future events. Without this update, the plan remains static and fails to evolve with the organization's threat landscape.

Answer

Sharing indicators of compromise with an ISAC

Answer

Revising the IR policy

Answer

Conducting a tabletop exercise

Question 10

Which of the following are key components of an effective information security program? (Select TWO.)

Accepted Answer

A risk management framework. A risk management framework is a key component because it provides a structured, repeatable process for identifying, assessing, and mitigating information security risks. It ensures that security investments and controls are aligned with business objectives and risk appetite, rather than being ad hoc or technology-driven. Without a risk management framework, an information security program lacks the foundational governance to prioritize threats and allocate resources effectively.

Answer

State-of-the-art security tools and technologies

Answer

A large security operations center

Answer

Compliance with all applicable laws

Question 11

After implementing controls, the residual risk is calculated to be at a level that slightly exceeds the risk appetite. The business owner argues that the cost of further mitigation outweighs the benefit. What is the most appropriate action for the risk manager?

Accepted Answer

Document the risk and escalate to senior management for acceptance. The risk manager should document the risk and escalate to senior management for formal acceptance. Acceptance requires approval at an appropriate level. Simply accepting without documentation is not proper. Implementing controls regardless of cost ignores cost-benefit. Transferring via insurance does not address residual risk that already exceeds appetite.

Answer

Transfer the risk through insurance

Answer

Accept the residual risk as a business decision

Answer

Implement additional controls regardless of cost

Question 12

A company engages a third-party vendor to process customer data. Which of the following is the most critical step in managing the associated risk?

Accepted Answer

Conducting a due diligence assessment before contracting. Conducting due diligence before contracting is essential to identify risks and ensure the vendor meets security requirements. Vulnerability scans are part of due diligence but not the most critical step. NDA and liability clauses are important but secondary to initial assessment.

Answer

Requiring the vendor to sign a non-disclosure agreement

Answer

Performing a vulnerability scan of the vendor's network

Answer

Including a clause that transfers liability to the vendor

Question 13

A multinational corporation is designing its information security program and must decide how to balance security with business agility. The company operates in highly regulated industries with varying legal requirements. Which of the following approaches BEST aligns with industry best practices for such an environment?

Accepted Answer

Develop a risk-based framework that allows for tailored controls based on local risk assessments.. A risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.

Answer

Implement the strictest regulatory requirements globally to ensure compliance everywhere.

Answer

Adopt a baseline of controls that meet the lowest common denominator of all regulations.

Answer

Allow each business unit to define its own security controls based on local requirements.

Question 14

Refer to the exhibit. Based on the risk register extract, which risk should the information security manager prioritize for additional treatment?

Accepted Answer

Both R-001 and R-002. Both R-001 and R-002 have residual risk levels exceeding the risk appetite of 5 (R-001: 9, R-002: 6). According to standard risk management practice, any residual risk above the appetite threshold requires additional treatment. Although R-002 has a higher inherent risk (24 vs. 12), the priority for treatment is determined by the gap between residual risk and appetite. R-001's gap of 4 is larger than R-002's gap of 1, indicating a more urgent need for treatment. Therefore, both risks require additional treatment.

Answer

R-001 only

Answer

Neither risk requires additional treatment

Answer

R-002 only

Question 15

A financial institution is implementing a new online banking platform. The risk assessment identified that the authentication module has a high likelihood of exploitation due to weak password policies. The risk owner has decided to implement multi-factor authentication (MFA) to reduce the risk. This is an example of which risk response strategy?

Accepted Answer

Risk mitigation. Implementing multi-factor authentication (MFA) reduces the likelihood or impact of a security risk by adding additional authentication factors (e.g., something you know, something you have, something you are) beyond a weak password. This directly aligns with risk mitigation, which seeks to decrease the residual risk to an acceptable level through controls. The decision does not eliminate the risk entirely (avoidance), accept it without action, or transfer it to a third party.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 16

Which TWO of the following are risk treatment strategies as defined in ISO 27005?

Accepted Answer

Risk avoidance. Risk avoidance is a defined risk treatment strategy in ISO 27005 where the organization decides to avoid the risk by not engaging in the activity that gives rise to it, such as discontinuing a service or choosing an alternative technology. Option C is correct because ISO 27005 explicitly lists risk avoidance as one of the four primary risk treatment options (avoidance, reduction, retention, and transfer).

Answer

Risk analysis

Answer

Risk monitoring

Answer

Risk communication

Question 17

A company is implementing a risk management program and needs to identify the most critical assets. Which of the following is the BEST approach to prioritize assets for risk assessment?

Accepted Answer

Assess the business impact of each asset's compromise. The best approach to prioritize assets for risk assessment is to assess the business impact of each asset's compromise because risk management focuses on the potential harm to business objectives, not on financial cost or technical vulnerabilities. Business impact analysis (BIA) evaluates criticality based on factors like revenue loss, regulatory penalties, and operational downtime, directly aligning asset priority with organizational risk appetite.

Answer

Use the asset's purchase value to determine priority

Answer

Perform a vulnerability scan and prioritize based on findings

Answer

Review historical incident reports for each asset

Question 18

After a data breach, the risk manager discovers that the risk assessment for the affected system had not been updated for two years. The organization's risk management policy requires annual reviews. Which of the following is the MOST significant consequence of this noncompliance?

Accepted Answer

Inaccurate risk profile leading to uninformed decisions. C is correct because the primary purpose of a risk assessment is to provide an accurate, current risk profile that informs security decisions and resource allocation. When the assessment is two years out of date, the organization lacks visibility into new threats, vulnerabilities, and changes in the threat landscape, leading to uninformed decisions that can result in security gaps and increased exposure. This directly undermines the risk management process, making it the most significant consequence of noncompliance with the annual review policy.

Answer

Increased audit findings

Answer

Regulatory fines for noncompliance

Answer

Higher insurance premiums

Question 19

An organization is developing a new information security program and wants to ensure it aligns with business objectives. Which of the following is the MOST critical first step?

Accepted Answer

Identify business strategy and risk appetite.. Identifying business strategy and risk appetite is the most critical first step because the information security program must be designed to support the organization's objectives and operate within the risk tolerance defined by leadership. Without this alignment, subsequent security controls and investments may conflict with business goals or fail to address the risks the organization is willing to accept. This ensures that security is a business enabler rather than a technical silo.

Answer

Develop a security awareness training program.

Answer

Design the security architecture based on industry frameworks.

Answer

Conduct a comprehensive risk assessment.

Question 20

Which THREE of the following are best practices for handling evidence during an incident investigation?

Accepted Answer

Document all actions taken during evidence collection.. Documenting all actions taken during evidence collection ensures the integrity and admissibility of evidence in legal proceedings. This documentation, often referred to as a 'paper trail' or 'audit log,' must include timestamps, personnel involved, tools used, and any deviations from standard procedures. Without this, the chain of custody is weakened, and the evidence may be challenged as unreliable or tampered with.

Answer

Analyze evidence directly on live systems to avoid delays.

Answer

Store evidence in its original location to avoid disturbance.