CISM Practice Test 28 — 15 Questions

Question 1

You are the IT governance officer at a regional bank with 1,200 employees. The bank has a security policy that requires annual security awareness training for all staff. However, the compliance rate is only 60%. The board is concerned about regulatory risk and wants to improve compliance. The current training is a generic online module that takes 30 minutes to complete. Employees complain that the training is boring and not relevant to their roles. The training is managed by the HR department, which sends reminders but does not enforce consequences. Which of the following is the BEST course of action to improve training compliance and governance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Redesign the training to be role-specific and mandate completion in the security governance framework with consequences for non-compliance.. It addresses both the root cause (irrelevant training) and the governance gap (lack of enforcement). By redesigning training to be role-specific, employees see direct relevance, which improves engagement and retention. Mandating completion within the security governance framework and attaching consequences (e.g., access revocation) creates accountability, directly driving compliance from 60% toward the board's target.

Answer

Outsource the training to a third-party provider.

Answer

Increase the frequency of reminder emails from monthly to weekly.

Answer

Implement a learning management system (LMS) to track completion.

Question 2

An organization is implementing a hybrid governance model for information security. Which statement best describes this approach?

Accepted Answer

A central security team sets policies and provides oversight, while business units execute security operations. A hybrid governance model combines central oversight with distributed execution: a central security team sets policies, standards, and provides oversight, while business units execute security operations tailored to their needs. This balances consistency with business agility. It is the defining characteristic of a federated or hybrid approach.

Answer

All security decisions are made by a central security team

Answer

Each business unit has full autonomy over security without central coordination

Answer

Security is outsourced to a third-party provider

Question 3

Match each security control type to its example.

Accepted Answer

Preventive: Firewall. The correct matches are: Preventive controls prevent incidents (e.g., firewall), Detective controls identify incidents (e.g., IDS), Corrective controls fix issues (e.g., backup/restore), and Deterrent controls discourage attacks (e.g., warning signs). Options E and F are common confusions where definitions are swapped.

Answer

Preventive: Backup and restore

Answer

Detective: Firewall

Question 4

A company's IDS alerts on a potential breach. The incident response team is called. What should they do immediately?

Accepted Answer

Verify the alert and assess scope. The immediate priority upon receiving an IDS alert is to verify the alert's validity and assess the scope of the potential breach. This ensures the incident response team does not waste resources on false positives and can accurately determine the affected systems, data, and network segments before taking containment actions. Verification typically involves correlating the IDS signature with actual packet captures, logs, and system telemetry to confirm malicious activity.

Answer

Disconnect all network cables

Answer

Notify law enforcement

Answer

Reimage affected systems

Question 5

Which TWO of the following are primary objectives of a security awareness program?

Accepted Answer

Reduce the number of security incidents. A primary objective of a security awareness program is to reduce the number of security incidents by educating employees on threats like phishing, social engineering, and unsafe practices. By raising awareness, employees are less likely to fall for attacks that could lead to data breaches or malware infections, directly lowering incident frequency.

Answer

Improve password sharing practices

Answer

Increase the security budget

Answer

Ensure compliance with regulations

Question 6

When implementing security controls, which approach ensures that multiple layers of defense are applied so that if one control fails, others compensate?

Accepted Answer

Defense-in-depth. Defense-in-depth (option D) is the correct approach because it implements multiple, overlapping layers of security controls (e.g., firewalls, IDS/IPS, endpoint protection, access controls) so that if one layer fails or is bypassed, subsequent layers continue to provide protection. This layered strategy reduces the likelihood of a single point of failure compromising the entire security posture, aligning with the CISM principle of risk mitigation through redundancy.

Answer

Business-enabling controls

Answer

Critical controls first

Answer

Compensating controls

Question 7

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is unable to restore operations within the maximum tolerable downtime (MTD). Which action should be taken next?

Accepted Answer

Escalate to activate the business continuity/disaster recovery plan. When an incident cannot be resolved within MTD, it escalates to business continuity/disaster recovery activation to restore operations.

Answer

Notify law enforcement

Answer

Increase the ransom payment

Answer

Engage the forensics firm to preserve evidence

Question 8

Which governance structure is characterized by a single security team that serves the entire organization?

Accepted Answer

Centralized. A centralized governance model consolidates security responsibilities under one team, ensuring consistent policy enforcement and resource allocation.

Answer

Matrix

Answer

Hybrid

Answer

Decentralized

Question 9

An organization has just recovered from a ransomware attack and restored systems from backups. Before returning to normal operations, what is the MOST important step?

Accepted Answer

Test the restored systems to ensure functionality and security.. After recovering from a ransomware attack and restoring systems from backups, the most critical step is to test the restored systems for both functionality and security. This ensures that the backups are clean (free of malware), that system integrity is verified, and that no residual threats remain before returning to normal operations. Without this validation, the organization risks re-infection or operational failures that could undermine the entire recovery effort.

Answer

Update the incident response plan.

Answer

Notify stakeholders.

Answer

Conduct a root cause analysis.

Question 10

A newly appointed CISO wants to establish an information security governance committee. What is the PRIMARY purpose of this committee?

Accepted Answer

To ensure security strategy aligns with business objectives and provide oversight.. The primary purpose of an information security governance committee is to ensure that the security strategy aligns with business objectives and to provide oversight. This committee does not execute day-to-day operations or implement controls; instead, it sets direction, reviews risk posture, and ensures that security investments support organizational goals, as defined in frameworks like COBIT and ISO 38500.

Answer

To manage day-to-day security operations.

Answer

To implement security controls across the organization.

Answer

To approve technical security solutions.

Question 11

An organization is determining the risk treatment for a critical business process that has a high inherent risk. Which of the following is the MOST effective risk treatment strategy when the cost to mitigate exceeds the potential loss?

Accepted Answer

Risk acceptance. Risk acceptance is the appropriate treatment when the cost of mitigating a risk exceeds the potential loss it represents. In this scenario, since mitigation costs more than the expected loss, accepting the risk is the most economically justified and effective strategy. The organization consciously retains the risk and monitors it, rather than spending more to prevent it than the loss would cost.

Answer

Risk avoidance

Answer

Risk reduction

Answer

Risk transfer

Question 12

A company is selecting a security control framework. They want a prioritized set of controls that are implementation group-based and address common cyber threats. Which framework best meets these requirements?

Accepted Answer

CIS Controls v8. CIS Controls v8 provides a prioritized set of actions that collectively form a defense-in-depth set of best practices to mitigate the most common cyber attacks. It is organized into Implementation Groups (IG1, IG2, IG3) based on organizational risk and resources, making it the framework that best meets the requirement for prioritized, implementation group-based controls addressing common threats.

Answer

COBIT 2019

Answer

NIST SP 800-53

Answer

ISO 27001 Annex A

Question 13

An information security program is being developed for a multinational organization. Which of the following is the PRIMARY driver for aligning the security program with business objectives?

Accepted Answer

Achieving the organization's strategic goals. The primary driver for aligning the security program with business objectives is to ensure that security initiatives directly support and enable the organization's strategic goals. Without this alignment, security becomes a cost center rather than a business enabler, and resources may be misallocated to activities that do not advance the enterprise's mission. CISM emphasizes that security governance must be integrated with business strategy to justify investment and demonstrate value to stakeholders.

Answer

Compliance with industry regulations

Answer

Reducing information security costs

Answer

Implementing the latest security technologies

Question 14

An organization is implementing a security controls framework and needs to prioritize controls for a small business with limited resources. Which implementation group from CIS Controls v8 should be addressed first?

Accepted Answer

IG1. CIS Controls v8 defines Implementation Group 1 (IG1) as the foundational set of safeguards for small businesses with limited resources and low-risk data. IG1 represents basic cyber hygiene and should be implemented first to establish a minimum level of security. Therefore, a small business with limited resources should address IG1 first.

Answer

IG2

Answer

IG3

Answer

IG0

Question 15

An organization's incident response team has contained a data breach. Legal counsel has advised that litigation is likely. Which of the following actions should the team take to preserve evidence?

Accepted Answer

Issue a legal hold and create forensic images of affected systems. When litigation is anticipated, a legal hold must be issued to prevent destruction of relevant evidence, and forensic copies should be made before remediation.

Answer

Immediately wipe affected systems to prevent further data loss

Answer

Notify the affected individuals as required by law

Answer

Delete all logs to avoid exposing sensitive information