CISM Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit.
Given the exhibit, which type of incident is MOST likely occurring?

Accepted Answer

Insider threat. The exhibit shows a user logging in from an unusual location, attempting unauthorized access, and then exfiltrating sensitive data. This pattern is indicative of an insider threat, as it involves a legitimate user performing malicious actions. Option A is correct.

Answer

Phishing campaign

Answer

Ransomware attack

Answer

DDoS attack

Question 2

During a data breach investigation, the team discovers that an attacker exfiltrated data via encrypted HTTPS to a server abroad. Which forensic step is most critical?

Accepted Answer

Capture memory from the endpoint to find encryption keys. Capturing memory from the endpoint may reveal encryption keys used for the HTTPS session, allowing decryption.

Answer

Analyze firewall logs for the connection

Answer

Decrypt the traffic using the server's private key

Answer

Trace the IP address to identify the attacker

Question 3

A financial institution has an incident involving a suspected data breach of customer PII. The incident response team contains the breach. What should be the NEXT priority according to legal and regulatory requirements?

Accepted Answer

Assess the extent of the breach.. Option C is correct because assessing the extent of the breach determines notification scope. Option A can wait. Option B follows after assessment. Option D is secondary.

Answer

Engage a public relations firm.

Answer

Notify affected customers.

Answer

Perform a root cause analysis.

Question 4

Refer to the exhibit.
The exhibit shows network traffic from a server to a database. What does this pattern MOST likely indicate?

Accepted Answer

SQL injection attempt. A rapid increase in connections to a database in a short time is typical of an automated SQL injection tool testing and exploiting vulnerabilities. Normal application load would be steadier, and a crash would show no connections. Option C is correct.

Answer

Query optimization issue

Answer

Normal application load

Answer

Database server crash

Question 5

Which TWO actions are essential during the detection and analysis phase of incident response?

Accepted Answer

Determine the scope of the incident. Identifying indicators of compromise and determining the scope are critical during detection and analysis.

Answer

Notify law enforcement

Answer

Disconnect affected systems

Answer

Rebuild systems

Question 6

During the identification phase of incident response, which of the following is the MOST reliable indicator of a security incident?

Accepted Answer

Antivirus software detects a known malware signature.. Option C is correct because antivirus detection of a known malware signature is a definitive indicator. Options A and B are ambiguous. Option D is a potential threat but not an incident.

Answer

A network administrator notices unusual traffic patterns.

Answer

An employee reports slow computer performance.

Answer

A vendor sends a vulnerability disclosure.

Question 7

Which TWO are common challenges in incident management?

Accepted Answer

Inadequate communication between teams. Lack of executive support and inadequate communication between teams are frequent obstacles.

Answer

Too many technical staff

Answer

Over-reliance on automation

Answer

Excessive documentation

Question 8

An organization has just recovered from a ransomware attack and restored systems from backups. Before returning to normal operations, what is the MOST important step?

Accepted Answer

Test the restored systems to ensure functionality and security.. Option D is correct because testing restored systems ensures functionality and no residual threats. Options A, B, C are steps that follow after validation.

Answer

Update the incident response plan.

Answer

Notify stakeholders.

Answer

Conduct a root cause analysis.

Question 9

A company's incident response team is conducting a tabletop exercise. They are discussing the steps after containment to prevent recurrence. The facilitator asks: 'What is the MOST important next step after containing an incident?' The team considers several options.

Accepted Answer

Identify the root cause of the incident. Option B is correct because after containment, identifying root cause is crucial to implement corrective actions and prevent recurrence. Option A (forensic imaging) is typically done during containment to preserve evidence. Option C (notify law enforcement) may be required but is not the immediate next step for prevention. Option D (update the incident response plan) is part of post-incident review, not immediate.

Answer

Update the incident response plan with lessons learned

Answer

Forensically image all affected systems

Answer

Notify law enforcement about the incident

Question 10

Refer to the exhibit. What is most suspicious about this event?

Accepted Answer

The process name svchost.exe running from Temp folder. svchost.exe running from the Temp folder is abnormal because it should run from System32.

Answer

The user jdoe is not an administrator

Answer

Event ID 4688 is unusual

Answer

The process ID is too low

Question 11

During a forensic investigation, an incident responder needs to collect memory from a compromised server. What is the BEST method to preserve evidence integrity?

Accepted Answer

Perform a hardware memory acquisition using a write-blocker.. Option C is correct because hardware acquisition with a write-blocker ensures no alteration to the original evidence. Option A and B risk network interference. Option D destroys volatile data.

Answer

Remotely acquire memory using a network connection.

Answer

Use a live forensic toolkit to capture memory to a network share.

Answer

Reboot the system into safe mode and then capture memory.

Question 12

Which TWO of the following are appropriate actions to take during the detection phase of incident management?

Accepted Answer

Activate the incident response team. During detection, the team activates the incident response team and collects/analyzes logs to confirm the incident. Root cause analysis occurs later, evidence preservation is during containment, and rebuilding is recovery.

Answer

Rebuild systems from backups

Answer

Conduct root cause analysis

Answer

Preserve evidence

Question 13

A company's information security manager is tasked with ensuring that security initiatives align with business goals. Which of the following best demonstrates this alignment?

Accepted Answer

Establishing security metrics that are linked to key business performance indicators.. Option D is correct because linking security metrics to business KPIs directly shows how security supports business objectives. Option A is wrong because compliance alone does not guarantee alignment with business goals. Option B is wrong because focusing only on technical risks ignores business context. Option C is wrong because budget allocation should be based on risk and business value, not just equal distribution.

Answer

Prioritizing security projects based solely on technical risk assessment.

Answer

Implementing all security controls required by regulatory standards.

Answer

Creating a security budget that allocates funds equally across departments.

Question 14

An organization has recently experienced a data breach due to an insider threat. The board has requested an update on governance improvements. Which of the following should the information security manager recommend first?

Accepted Answer

Developing a formalized insider threat program with clear roles and responsibilities.. Option B is correct because a formalized insider threat program with defined roles and monitoring reduces the risk of insider incidents. Option A is wrong because technical controls alone are ineffective without governance and process. Option C is wrong because training is important but not the immediate governance priority. Option D is wrong for the same reason as A.

Answer

Conducting annual security awareness training for all employees.

Answer

Implementing two-factor authentication for all critical systems.

Answer

Deploying endpoint detection and response (EDR) software on all systems.

Question 15

Which TWO of the following are key indicators that an organization's information security governance is effective?

Accepted Answer

High percentage of risk treatment plans implemented on time.. Options B and D are correct. A high percentage of risk treatment plan implementation (B) shows governance execution, and board-level security dashboards (D) indicate oversight. Option A is wrong because the number of policies is not a measure of effectiveness. Option C is wrong because low budget variance does not equal good governance. Option E is wrong because awareness training completion is operational.

Answer

Low variance between the approved security budget and actual spending.

Answer

The number of security policies that have been published.

Answer

High completion rate for security awareness training.

CISM Practice Test 28 — 15 Questions

Exhibit

CISM Practice Test 28 — 15 Questions

Exhibit