CISM Practice Test 29 — 15 Questions

Question 1

An information security manager is developing a security strategy for a financial institution. Which of the following should be the PRIMARY driver for selecting security controls?

Accepted Answer

Business requirements derived from risk assessment and compliance obligations.. Business requirements derived from risk assessment and compliance obligations are the primary driver because they directly align security controls with the institution's specific risk appetite, regulatory mandates (e.g., PCI DSS, SOX, GDPR), and operational needs. This ensures controls are cost-effective and prioritized based on actual exposure rather than reactive or budget-driven decisions.

Answer

The latest cybersecurity threats reported in the industry.

Answer

Past security incidents that caused significant financial loss.

Answer

The security budget allocated for the fiscal year.

Question 2

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident?

Accepted Answer

Incident response playbook. Playbooks are specific to incident types (e.g., ransomware) and provide step-by-step guidance, whereas the IR plan is a high-level document and policy sets overall intent.

Answer

Incident response policy

Answer

Incident response plan

Answer

Communication templates

Question 3

Refer to the exhibit. During a ransomware incident, the response team discovers that the backup server is also encrypted. Which phase of the playbook is MOST impacted?

Accepted Answer

Phase 4: Recovery. The Recovery phase (Phase 4) is most impacted when the backup server is encrypted during a ransomware incident. Without clean, unencrypted backups, the organization cannot restore systems and data to a known good state, which is the primary goal of the Recovery phase. The encryption of backups directly undermines the ability to recover, forcing the team to consider alternative recovery methods such as decryption keys, offline backups, or system rebuilds.

Answer

Phase 5: Post-Incident

Answer

Phase 3: Eradication

Answer

Phase 2: Containment

Question 4

You are the information security program manager at a global financial services firm. The firm has a mature security program, but the CISO is concerned that the program is not keeping pace with emerging threats such as supply chain attacks and advanced persistent threats (APTs). Additionally, the program currently focuses heavily on compliance with regulations (e.g., PCI DSS, GDPR) rather than proactive risk management. The board wants to see a more strategic approach to information security. However, the compliance team is large and influential, and they resist changes that might reduce their role. You have been asked to propose a new program model that addresses these concerns while maintaining regulatory compliance. What should you do?

Accepted Answer

Evolve the program to a risk-based approach that integrates threat intelligence and adapts controls dynamically, while keeping compliance as a baseline.. Evolving the program to a risk-based approach (Option D) integrates threat intelligence and dynamically adapts controls, directly addressing the need for proactive management of emerging threats while maintaining compliance as a baseline. This balances strategic evolution with the compliance team's continued role. Option A (restructuring the compliance team) risks political friction and does not inherently shift to risk management. Option B (expanding compliance coverage) increases focus on compliance, not proactive risk. Option C (increasing awareness training) is too narrow and does not address the program's strategic direction.

Answer

Restructure the compliance team into a risk management function.

Answer

Expand the compliance team to cover more regulations and increase auditing frequency.

Answer

Increase security awareness training across the organization.

Question 5

A security manager wants to measure the effectiveness of the security awareness program. Which metric is most relevant?

Accepted Answer

Phishing simulation click rate. Phishing simulation click rate directly measures how many employees fall for simulated phishing attacks, which is a key indicator of security awareness and the effectiveness of training. A decreasing click rate over time typically indicates improved awareness.

Answer

Security budget variance

Answer

Mean time to detect incidents

Answer

Number of security policies updated

Question 6

A security analyst notices unusual outbound traffic from a server that is not scheduled for any data transfers. Which step should the analyst take FIRST?

Accepted Answer

Document the observation and escalate to the incident response team. The first step in incident response is to preserve evidence and follow the established escalation path. The analyst should document the observation (including source/destination IPs, ports, protocols, and timestamps) and escalate to the incident response team (IRT) to ensure a coordinated, forensically sound investigation. Premature action like blocking or isolating could destroy volatile data or alert an attacker, violating the principle of evidence preservation outlined in NIST SP 800-61.

Answer

Block the IP addresses in the outbound traffic

Answer

Immediately isolate the server from the network

Answer

Ignore as it may be a false positive

Question 7

A multinational organization needs to comply with GDPR and CCPA. What is the best approach for the information security program?

Accepted Answer

Implement a unified privacy framework covering all regulations. A unified privacy framework (e.g., ISO/IEC 27701 or NIST Privacy Framework) allows the organization to map overlapping requirements from GDPR and CCPA into a single set of controls, reducing duplication and ensuring consistent data protection across jurisdictions. This approach leverages common principles like data minimization, consent management, and breach notification, which are foundational to both regulations, while accommodating specific differences such as GDPR's 72-hour breach notification versus CCPA's broader definition of personal information.

Answer

Adopt the most restrictive requirements from any regulation

Answer

Outsource compliance to a third-party provider

Answer

Create separate security programs for each region

Question 8

Which TWO of the following are essential components of an effective information security governance framework? (Select exactly two.)

Accepted Answer

Process for aligning security strategy with business strategy. Option C is correct because information security governance fundamentally requires a process that aligns the security strategy with the organization's business strategy, ensuring security investments and priorities directly support business objectives and risk appetite. Option E is correct because governance depends on clearly defined roles and responsibilities for security decisions, establishing accountability and authority (for example, who approves policy, who accepts risk, and who reports to the board) so decisions are made and enforced consistently. Options A, B, and D are incorrect because a SIEM system, automated patch management, and an IPS are technical security controls that support operations and defense-in-depth, but they are implementation tools rather than essential governance framework components; governance is about direction, alignment, and accountability, not specific technologies.

Answer

Implementation of a SIEM system

Answer

Automated patch management system

Answer

Intrusion prevention system (IPS)

Question 9

Which TWO of the following are essential components of an information security program charter?

Accepted Answer

Roles and responsibilities of key stakeholders.. The information security program charter is a high-level document that establishes the authority, scope, and governance of the security program. Roles and responsibilities of key stakeholders (Option B) are essential because they define accountability and decision-making authority, ensuring the program has clear ownership and oversight. Program scope and objectives (Option D) are equally essential as they set the boundaries and goals of the security program, aligning it with business strategy and risk appetite.

Answer

List of specific security tools to be deployed.

Answer

Vendor selection criteria.

Answer

Detailed budget allocation.

Question 10

A company is considering a policy exception that would allow temporary non-compliance with a data encryption standard due to a legacy system. What is the most important element of the exception management process?

Accepted Answer

A documented remediation plan with timelines and risk acceptance. The most important element of an exception management process is a documented remediation plan with timelines and formal risk acceptance. This ensures that the exception is temporary, that the risk is understood and accepted by the appropriate authority, and that there is a clear path to compliance.

Answer

Notification to all employees

Answer

Annual renewal without further review

Answer

Approval by the CISO only

Question 11

Which of the following is the PRIMARY reason for an information security manager to integrate risk management into the organization's enterprise risk management (ERM) framework?

Accepted Answer

To support informed decision-making by aligning security risks with business objectives. The primary purpose of integrating information security risk management into ERM is to enable informed decision-making by ensuring security risks are evaluated in the same language and context as business, financial, and operational risks. This alignment lets leadership prioritize investments and accept or mitigate risks based on their impact on business objectives, not in isolation. CISM emphasizes that security exists to support the business, so alignment with business objectives is the fundamental driver.

Answer

To ensure compliance with regulatory requirements

Answer

To provide a consistent risk reporting structure across the enterprise

Answer

To reduce the cost of risk management through shared resources

Question 12

A security manager needs to justify an increase in the security budget. Which approach provides the strongest quantitative justification?

Accepted Answer

Showing the return on investment using avoided breach costs. Quantitative justification requires translating security spend into financial terms that executives understand. Showing ROI via avoided breach costs — using industry data such as IBM's Cost of a Data Breach report, internal incident history, and expected loss modeling — converts security investment into a defensible business case. This directly answers the CFO's question: what do we get for the money?

Answer

Comparing the budget to industry benchmarks

Answer

Presenting the number of vulnerabilities discovered

Answer

Listing all pending compliance requirements

Question 13

Which regulatory requirement mandates that organizations implement data protection measures for personal data of EU citizens?

Accepted Answer

GDPR. The General Data Protection Regulation (GDPR) is the EU regulation that mandates organizations implement data protection measures for personal data of EU citizens. It applies to any organization processing personal data of individuals in the EU, regardless of the organization's location.

Answer

SOX

Answer

PCI DSS

Answer

HIPAA

Question 14

An organization is updating its incident response plan. Which TWO components are essential to include for effective insider threat management? (Select TWO.)

Accepted Answer

Procedures for coordinating with human resources and legal departments.. Option B is correct because insider threat incidents require close coordination with human resources and legal departments to handle employee privacy, employment law, evidence handling, and potential disciplinary or legal action properly. Option D is correct because a dedicated insider threat playbook provides specific, pre-defined procedures for detecting, investigating, and responding to malicious or negligent insider activity, which differs from generic incident response steps. Option A is not essential here because ransomware recovery is a separate threat category and does not specifically address insider threat management. Option C is inappropriate and insecure because storing all employee passwords violates least privilege and credential security best practices. Option E is unrelated because DDoS mitigation contacts address external availability attacks, not insider threats.

Answer

A dedicated ransomware recovery procedure.

Answer

A list of all employee passwords for investigation purposes.

Answer

Contact information for the DDoS mitigation service provider.

Question 15

During a risk assessment, a CISM identifies that the organization's data backup process has a single point of failure. The backup server is located in the same data center as the primary server. Which risk response is most appropriate?

Accepted Answer

Mitigate by moving the backup server to a geographically separate location.. Moving the backup server to a geographically separate location directly eliminates the single point of failure by ensuring that a localized disaster (e.g., fire, flood, power outage) at the primary data center does not simultaneously destroy both the primary and backup data. This is a classic risk mitigation strategy that reduces the likelihood and impact of data loss, aligning with the principle of geographic redundancy for disaster recovery.

Answer

Transfer the risk by purchasing business interruption insurance.

Answer

Avoid the risk by discontinuing the backup process.

Answer

Accept the risk because the cost of mitigation is high.