CISM Practice Test 26 — 15 Questions

Question 1

Which THREE of the following should be included in an incident communication template?

Accepted Answer

Affected systems or data. Option A (Affected systems or data) is correct because an incident communication template must clearly identify the scope of impact—which systems, services, or data sets are involved—so recipients understand what is at risk and can prioritize their response. Option B (Description of the incident) is correct because the template needs a concise, accurate summary of what happened (e.g., type of incident, time of detection, current status) to give recipients the context required to act appropriately. Option C (Actions to be taken by recipients) is correct because the primary purpose of incident communications is to direct the audience—users, IT staff, or stakeholders—on specific steps such as disconnecting from the network, resetting passwords, or awaiting further instructions. Option D (Technical indicators of compromise) is not included because IoCs such as IP addresses, hashes, and domain names belong in threat intelligence or technical investigation reports, not in a general communication template intended for broad audiences. Option E (Attribution of the attacker) is not included because attribution is typically uncertain, sensitive, and often irrelevant to the immediate protective actions recipients must take, making it inappropriate for a standard incident communication template.

Answer

Technical indicators of compromise (IoCs)

Answer

Attribution of the attacker

Question 2

During a security assessment, an organization discovers that its patch management process is not consistently applied across all systems. Which of the following controls would best address this deficiency as part of the information security program?

Accepted Answer

Implement a configuration management database (CMDB) linked to an automated patch deployment tool.. A configuration management database (CMDB) provides a centralized, authoritative inventory of all IT assets, including their current patch status. Linking the CMDB to an automated patch deployment tool ensures that patches are consistently and systematically applied to all systems based on their configuration records, directly addressing the inconsistency in the patch management process. This control enforces a standardized, repeatable workflow that eliminates reliance on manual, ad-hoc patching.

Answer

Require all system administrators to manually approve patches before deployment.

Answer

Increase the frequency of vulnerability scans to weekly.

Answer

Conduct additional security awareness training for system administrators.

Question 3

Which TWO are key elements of a security awareness program designed to change employee behavior?

Accepted Answer

Role-based training tailored to specific job functions. Option A is correct because role-based training tailors security content to the specific risks and responsibilities of each job function (for example, finance staff trained on BEC/invoice fraud, developers on secure coding), which makes the material relevant and far more likely to change day-to-day behavior than generic content. Option C is correct because phishing simulations provide measurable, experiential reinforcement: users who click are immediately routed into targeted remediation training, converting a real mistake into a teachable moment and building the conditioned vigilance that reduces click rates over time. These two elements combine relevance (A) with active practice and feedback (C), the mechanisms that actually drive sustained behavior change. Option B does not belong because a once-a-year compliance checkbox satisfies audit requirements but is too infrequent and generic to alter habits. Option D does not belong because posters and newsletters are passive awareness artifacts that may raise knowledge but lack the interactivity, personalization, and reinforcement needed to change behavior.

Answer

Annual compliance training for all employees

Answer

Posters and newsletters about security topics

Question 4

Which THREE of the following are key indicators of a mature information security governance process? (Select exactly three.)

Accepted Answer

Security risk appetite is defined and reported to the board. Option A is correct because a mature governance process requires the board to formally define and regularly receive reporting on the organization's security risk appetite, ensuring risk decisions align with strategic direction and accountability sits at the top. Option C is correct because mature governance ties security performance metrics to business outcomes (e.g., availability, revenue protection, customer trust), demonstrating that security is managed as a business enabler rather than a purely technical function. Option D is correct because governance maturity demands that the security strategy be reviewed and updated at least annually in response to business, regulatory, and threat landscape changes, keeping strategy aligned with organizational objectives. Option B is not a governance indicator but a tactical operational metric for vulnerability management, and Option E is a lagging outcome metric that reflects incident trends rather than the existence of governance structures, oversight, and strategic alignment.

Answer

Mean time to patch critical vulnerabilities is under 48 hours

Answer

Number of security incidents decreased by 20% year-over-year

Question 5

A CISO is reporting to the board of directors. Which metric would BEST demonstrate the effectiveness of the security program in reducing business impact?

Accepted Answer

Security investment vs. loss avoidance. Security investment versus loss avoidance expresses the programme's effectiveness in business terms — how much financial loss was prevented relative to what was spent — which is exactly what a board needs to judge whether the security programme is reducing business impact. It translates technical activity into a cost-benefit narrative that resonates with directors focused on shareholder value and risk appetite. Other metrics are operational and do not directly convey business impact reduction.

Answer

Number of security incidents

Answer

Patch compliance percentage

Answer

Mean time to detect (MTTD)

Question 6

A CISO is preparing a multi-year security roadmap. Which of the following is the MOST critical factor for ensuring the roadmap aligns with business strategy?

Accepted Answer

Understanding the organization's strategic business objectives and risk appetite. The roadmap must directly support the organization's strategic goals and risk appetite to ensure security initiatives enable rather than hinder business objectives. Without this alignment, security investments may be misdirected or fail to gain executive support.

Answer

Benchmarking against industry peers

Answer

Assessing current security maturity level

Answer

Reviewing recent security incidents and lessons learned

Question 7

An information security manager is preparing a report for the board on the state of information security governance. Which of the following elements is most important to include in the report?

Accepted Answer

Key risk indicators (KRIs) related to the organization's critical assets.. Key risk indicators (KRIs) provide a forward-looking, quantifiable measure of risk exposure tied directly to critical assets, which is essential for the board to understand the effectiveness of governance and risk management. Unlike operational or tactical data, KRIs enable informed strategic decisions about risk appetite and resource allocation, aligning with the CISM focus on governance over management.

Answer

The percentage of the security budget spent on different projects.

Answer

A log of all recent security incidents and their root causes.

Answer

A detailed list of all security tools and their functionalities.

Question 8

Which THREE are essential steps in incident containment? (Choose three.)

Accepted Answer

Disable compromised accounts. Disabling compromised accounts (C) is an essential containment step because it immediately cuts off the attacker's authenticated access and prevents lateral movement or further data theft using valid credentials. Isolating affected systems (D) is essential containment because it severs network connectivity (e.g., via VLAN change, host firewall block, or endpoint isolation) to stop malware propagation and command-and-control communication while keeping the host available for investigation. Preserving forensic evidence (E) is essential during containment because volatile data (memory, network connections, logs) and disk artifacts must be captured before remediation actions like reimaging or rebooting destroy them, supporting later root cause analysis and legal proceedings. Root cause analysis (A) is not a containment step but a later post-incident activity in the lessons-learned/recovery phase, and notifying external regulators (B) is a communication/notification obligation that typically follows containment and assessment, not a containment action itself.

Answer

Root cause analysis

Answer

Notify external regulators

Question 9

An organization's security program includes a set of metrics reported quarterly to the board. Which metric best demonstrates the effectiveness of the security awareness program?

Accepted Answer

Reduction in phishing click-through rate. The phishing click-through rate directly measures behavioral change—the primary goal of security awareness training. A sustained reduction indicates that employees are applying training to recognize and avoid phishing attempts, which is a more valid effectiveness metric than completion rates or lagging indicators like incidents or violations.

Answer

Percentage of employees who completed training

Answer

Number of security incidents

Answer

Number of policy violations

Question 10

Which THREE of the following are typical roles in an incident response team? (Select THREE)

Accepted Answer

IR manager. The IR manager (A) is a core role that coordinates the entire incident response effort, making decisions on escalation, communication, and resource allocation during an incident. Forensic investigators (C) are essential for collecting, preserving, and analyzing evidence such as disk images, memory dumps, and logs to determine the scope and root cause of a breach. Security analysts (D) form the frontline technical role, monitoring SIEM alerts, triaging events, and performing initial containment and eradication actions. Human resources (B) and internal audit (E) may be consulted for employee-related or compliance matters, but they are supporting stakeholders rather than typical standing roles within the incident response team itself.

Answer

Human resources representative

Answer

Internal audit representative

Question 11

A regional hospital is required to comply with the Health Insurance Portability and Accountability Act (HIPAA). During an internal audit, it was discovered that patient electronic health records (EHRs) are transmitted over the internet without encryption. The risk manager has been asked to recommend a risk treatment. Which action should be prioritized to address this finding?

Accepted Answer

Implement encryption for all data in transit. HIPAA's Security Rule requires covered entities to protect ePHI in transit using encryption or an equivalent alternative, and transmitting unencrypted EHRs over the internet is a direct violation. Implementing encryption for all data in transit is the prioritized risk treatment because it directly mitigates the identified vulnerability, is technically feasible, and aligns with regulatory requirements. Other options either avoid the risk, transfer it, or disrupt operations without fixing the root cause.

Answer

Accept the risk because the likelihood of interception is low

Answer

Purchase cyber insurance to cover potential data breach costs

Answer

Discontinue all electronic transmission of patient data

Question 12

During a risk assessment, the risk team identifies that a key vendor has access to sensitive data. The vendor's security posture is unclear. Which of the following is the BEST course of action?

Accepted Answer

Conduct a third-party risk assessment. When a vendor's security posture is unclear and they have access to sensitive data, the best course of action is to conduct a third-party risk assessment. This assessment evaluates the vendor's security controls, compliance with standards (e.g., ISO 27001, SOC 2), and contractual obligations before making any decisions. It provides the necessary evidence to determine if the risk is acceptable or requires mitigation, rather than acting on assumptions.

Answer

Ignore the risk because the vendor is known

Answer

Terminate the vendor relationship immediately

Answer

Request the vendor's latest security certification

Question 13

A global financial services firm operates in 30 countries and is subject to multiple data protection regulations, including GDPR, CCPA, and various financial services directives. The firm has a centralized information security program but struggles with inconsistent enforcement across regions. The CISO is under pressure to demonstrate compliance to the board while reducing costs. The compliance team suggests creating a separate security program for each regulation, while the IT audit team recommends adopting the most stringent regulation as the baseline. The CISO must decide on a strategy that balances compliance, efficiency, and cost. What is the best approach for the CISO to take?

Accepted Answer

Develop a unified set of controls that satisfy the common requirements of all regulations and map them to each regulation's specific needs.. A unified set of controls that satisfies the common requirements of all regulations and maps to each regulation's specific needs provides a single, efficient control framework while ensuring compliance with each regulation. This balances compliance, efficiency, and cost by avoiding duplication and gaps.

Answer

Adopt ISO 27001 as the single framework and map it loosely to all regulations.

Answer

Create three separate security programs, one for each major regulation (GDPR, CCPA, financial directives).

Answer

Use the most stringent regulation (e.g., GDPR) as the baseline and accept potential gaps with other regulations.

Question 14

An organization with a mature security program is reviewing its budget allocation. The board has asked the CISO to justify a proposed increase. Which of the following provides the STRONGEST justification for the security budget?

Accepted Answer

Breach avoidance value, estimating the cost of incidents that were prevented.. Breach avoidance value quantifies the cost of incidents that were prevented, directly linking security spending to avoided financial loss and risk reduction. This is the strongest justification because it speaks the board's language — return on security investment — and demonstrates measurable value rather than relative positioning or compliance minimums.

Answer

Benchmarking against industry peers showing that the proposed budget is below average.

Answer

Operational efficiency gains from automation of security processes.

Answer

Compliance with all regulatory requirements to avoid fines.

Question 15

A company has implemented a security awareness program with quarterly phishing simulations. The click rate has remained at 15% for the past two quarters. What is the most effective next step?

Accepted Answer

Implement mandatory remediation training for users who click. A stagnant 15% click rate indicates that awareness alone is not changing behavior; the program needs reinforcement through consequence and remediation. Mandatory remediation training for users who click — typically a short, targeted module delivered immediately after the failure — converts the teachable moment into learning and has been shown to reduce repeat click rates. This is the most effective next step because it addresses the root cause: users who click are not internalizing the training.

Answer

Increase the frequency of simulations to monthly

Answer

Discontinue simulations as they are not effective

Answer

Reduce the difficulty of simulations to lower the click rate