CISM Practice Test 27 — 15 Questions

Question 1

An organization is designing a policy exception management process. Which THREE elements are critical for this process to be effective?

Accepted Answer

Approval by the CISO or designated authority. Option A is correct because an exception to a security policy must be authorized by the CISO or another designated authority who owns the risk, ensuring accountability and preventing unauthorized deviations from the baseline. Option C is correct because formal documentation of the exception request captures the justification, scope, risk assessment, compensating controls, and approver, providing an auditable record for compliance and future review. Option E is correct because every exception should carry an expiration date so it is time-bound and automatically reviewed or revoked, preventing permanent, unmanaged risk acceptance. Option B is incorrect because automatic approval after 24 hours of silence would grant exceptions without any risk review or authorization, which is the opposite of effective governance. Option D is incorrect because allowing any employee to request an exception is not itself a critical control; the process must define who is authorized to request and, more importantly, who can approve, so unrestricted requesting does not make the process effective.

Answer

Automatic approval if no response within 24 hours

Answer

Ability for any employee to request an exception

Question 2

A small e-commerce company with 50 employees and limited IT budget is establishing its first formal information security program. The company processes customer payment data and must comply with PCI DSS. The CEO wants to balance security with operational costs. The IT manager proposes investing in a state-of-the-art security information and event management (SIEM) system costing $100,000 annually. The CISO, however, recommends a more phased approach. Considering the company's size, budget constraints, and compliance requirements, what should be the CISO's primary recommendation?

Accepted Answer

Deploy a firewall, antivirus software, and enforce strong access controls as baseline security measures.. For a 50-person e-commerce company with limited budget and PCI DSS obligations, the CISO should recommend foundational controls first: firewall, antivirus/endpoint protection, and strong access controls. These address the PCI DSS baseline requirements (Req 1, 5, 7, 8) at a fraction of the SIEM cost and deliver immediate risk reduction. A phased approach aligns security investment with maturity and budget, which is the core of the CISO's recommendation.

Answer

Implement the SIEM system immediately to achieve real-time threat detection.

Answer

Outsource all security operations to a managed security service provider (MSSP).

Answer

Develop a custom security software solution tailored to the company's payment processing system.

Question 3

An information security manager is designing a program for a healthcare organization. Which of the following should be the FIRST step in establishing the program?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment is the foundational first step because it identifies and prioritizes the specific threats and vulnerabilities facing the healthcare organization's sensitive data (e.g., PHI under HIPAA). Without this baseline understanding, any subsequent policies, controls, or metrics would be misaligned with actual risk exposure, leading to ineffective or wasteful security investments.

Answer

Develop information security policies and procedures

Answer

Select and implement security controls

Answer

Define security metrics and reporting

Question 4

A company is designing a third-party risk management (TPRM) program. Which factor should PRIMARILY determine the tier of a vendor?

Accepted Answer

Type of data accessed and service criticality. The tier of a vendor in a TPRM program should be primarily determined by the type of data the vendor accesses and the criticality of the service they provide. These factors directly impact the organization's risk exposure and regulatory compliance obligations. Revenue, relationship length, and contract value do not necessarily correlate with risk.

Answer

Vendor's annual revenue

Answer

Length of business relationship

Answer

Contract value

Question 5

Which type of incident response exercise involves a facilitated discussion of a hypothetical scenario to review plans and procedures?

Accepted Answer

Tabletop exercise. A tabletop exercise is a discussion-based session where participants, guided by a facilitator, walk through a hypothetical incident scenario to evaluate plans, procedures, and decision-making. It does not involve deploying actual resources or simulating live systems; instead, it focuses on reviewing roles, communication, and coordination. This matches the question's description of a facilitated discussion to review plans and procedures. Other exercise types involve more active or technical execution.

Answer

Full-scale exercise

Answer

Simulation

Answer

Drill

Question 6

During a P1 (critical) incident involving a ransomware attack that has encrypted critical systems, the incident manager needs to provide updates to executives. What is the recommended frequency for situation reports (sitreps)?

Accepted Answer

Hourly. For P1 incidents, hourly sitreps keep executives informed of rapidly evolving situations.

Answer

Only at milestone events

Answer

Every 4 hours

Answer

Daily

Question 7

Which TWO of the following are primary objectives of information security governance? (Choose two.)

Accepted Answer

Align security strategy with business goals.. Information security governance's primary objective is to ensure that security strategy is aligned with business goals, enabling the organization to protect assets while supporting its mission. This alignment is achieved through governance frameworks like COBIT or ISO 38500, which mandate that security investments and controls are directly tied to business objectives, not isolated technical measures.

Answer

Eliminate all information security risks.

Answer

Maximize profitability through security investments.

Answer

Achieve compliance with all applicable regulations.

Question 8

A CISO is establishing a vendor risk management (TPRM) program. Which THREE of the following are key components of an effective TPRM program?

Accepted Answer

Exit procedures to ensure data is returned or destroyed.. Option A is correct because an effective TPRM program must define exit procedures that ensure vendor-held data is returned or securely destroyed when the relationship ends, addressing data retention and offboarding risk. Option C is correct because onboarding risk assessments should be risk-tiered, scoped to the vendor's criticality and level of access to systems and data, rather than applying uniform treatment. Option E is correct because vendor risk is continuous, so ongoing monitoring of the vendor's security posture (for example, via security ratings, questionnaires, or attestation tracking) is needed to detect changes after onboarding. Option B is not appropriate because a single annual assessment for all vendors ignores differing risk levels and fails to provide continuous oversight. Option D is not required because ISO 27001 certification is only one possible assurance mechanism; mandating it for all vendors is overly prescriptive and does not fit a risk-based program.

Answer

Performing a single annual assessment for all vendors.

Answer

Requiring all vendors to have ISO 27001 certification.

Question 9

A security manager is selecting a controls framework for a new organization. Which framework provides the most granular control families and is widely used for US federal agencies?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the correct answer because it provides the most granular control families (20 families, over 1,000 controls) and is mandated for US federal agencies under FISMA. Its control catalog is organized into detailed families such as AC (Access Control), AU (Audit and Accountability), and CM (Configuration Management), each with specific control enhancements. This level of granularity and its federal adoption make it the best fit for the scenario.

Answer

CIS Controls v8

Answer

ISO 27001 Annex A

Answer

COBIT 2019

Question 10

An organization's information security program includes a formal exception process. When reviewing an exception request to bypass a critical control, what is the MOST important factor for the information security manager to consider?

Accepted Answer

The residual risk after compensating controls. The most important factor when reviewing an exception request to bypass a critical control is the residual risk after compensating controls. This ensures that the organization's risk appetite is not exceeded and that the compensating controls adequately mitigate the risk to an acceptable level, as required by frameworks like ISO 27001 and NIST SP 800-53.

Answer

The cost of implementing the control

Answer

The number of users affected by the exception

Answer

The duration of the exception

Question 11

A security manager is selecting controls for a new application. Which TWO controls are most important to include in a defense-in-depth strategy? (Select TWO)

Accepted Answer

Role-based access control (RBAC) with least privilege. Option B (RBAC with least privilege) is correct because it enforces authorization by granting users only the minimum permissions needed for their roles, directly limiting the blast radius of compromised accounts and insider misuse—a core preventive control in any defense-in-depth strategy. Option E (input validation and sanitization) is correct because it defends against injection flaws such as SQLi, XSS, and command injection by rejecting or neutralizing untrusted input at the application boundary, addressing the most common application-layer attack vector. Together these controls cover both access control and secure input handling, which are foundational application security layers. Option A is not among the marked answers because periodic vulnerability scans are detective/assessment activities that identify issues rather than directly preventing exploitation. Option C is not marked because SSO centralizes authentication and improves usability but does not by itself enforce least privilege or stop injection attacks. Option D is not marked because encryption at rest protects stored data confidentiality but does not prevent application-layer attacks like injection or privilege abuse.

Answer

Weekly vulnerability scans

Answer

Single sign-on (SSO) implementation

Answer

Encryption of data at rest

Question 12

During an incident, the incident response team is communicating with affected stakeholders. According to best practices, which of the following should be communicated FIRST?

Accepted Answer

A summary of actions taken so far. During an incident, the first communication to stakeholders should provide a summary of actions taken so far to establish transparency and demonstrate that the incident response team is actively managing the situation. This aligns with NIST SP 800-61r2 guidance, which prioritizes timely, high-level updates over detailed technical data to avoid overwhelming stakeholders and to maintain trust. Detailed technical analysis, timelines, and root cause determination typically require more investigation and are communicated in subsequent updates.

Answer

Detailed technical analysis

Answer

A timeline of all events

Answer

The root cause of the incident

Question 13

An organization's risk management policy requires a quantitative risk assessment for all new projects. The project team estimates that a data breach could occur once every 5 years with an average loss of $2 million. What is the annualized loss expectancy (ALE)?

Accepted Answer

$400,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, the ARO is 1/5 = 0.2 (one event every five years), and the SLE is $2,000,000. Thus, ALE = 0.2 × $2,000,000 = $400,000.

Answer

$10,000,000

Answer

$500,000

Answer

$2,000,000

Question 14

An organization is implementing a security champions program. Which of the following is the primary benefit of such a program?

Accepted Answer

Embedding security expertise within development teams. A security champions program embeds security expertise within development teams by designating individuals who act as liaisons between the security team and developers. This fosters a security culture, enables early identification of security issues, and reduces the bottleneck of a centralized security team. The primary benefit is scaling security knowledge across the organization.

Answer

Providing 24/7 security monitoring

Answer

Eliminating the need for security awareness training

Answer

Reducing the need for a dedicated security team

Question 15

During a merger, two companies with different information security programs are being integrated. The combined entity must maintain compliance with PCI DSS and GDPR. The CISO is concerned about gaps in coverage due to differing maturity levels. Which of the following is the BEST approach to harmonize the programs?

Accepted Answer

Perform a gap analysis against the requirements and prioritize remediation.. A gap analysis against the combined requirements of PCI DSS and GDPR identifies exactly where each legacy program falls short, allowing the CISO to prioritize remediation based on risk and regulatory obligation. This is the standard, defensible approach for harmonizing programs during M&A because it is evidence-based, accounts for differing maturity levels, and produces a prioritized roadmap rather than a blunt consolidation. It also respects that the two regulations have different scopes (PCI DSS for cardholder data, GDPR for personal data of EU residents).

Answer

Adopt the more stringent security program from the acquirer across the entire entity.

Answer

Merge the two programs by combining all controls from each.

Answer

Implement a completely new framework that meets both regulations.