CISM Practice Test 3 — 10 Questions

Question 1

An organization uses a SIEM to correlate security events. The SIEM generates an alert for a possible brute-force attack against an admin account. The incident response team reviews the alert and finds that the account is a service account with a known password. What should the team do NEXT?

Accepted Answer

Change the password for the service account. The correct next step is to change the password for the service account because the alert indicates a possible brute-force attack, and a known password represents a compromised credential. Even if the account is a service account, the password must be rotated to prevent unauthorized access. This aligns with the incident response principle of containing the threat by invalidating the compromised authentication factor.

Answer

Notify the service owner

Answer

Disable the service account

Answer

Investigate the source IP addresses

Question 2

After a security incident, the incident response team identifies that the root cause was a phishing email that bypassed the email filter. The email contained a malicious macro that executed PowerShell commands. Which control would be MOST effective in preventing similar incidents in the future?

Accepted Answer

Disable macros in documents originating from external sources. Disabling macros in documents from external sources directly addresses the attack vector: the malicious macro that executed PowerShell commands. This control prevents the macro from running, regardless of the email filter's failure, by blocking the execution environment at the endpoint level. It is a preventive technical control that stops the attack before it can proceed.

Answer

Implement network segmentation for sensitive systems

Answer

Deploy additional antivirus software on endpoints

Answer

Conduct security awareness training for all employees

Question 3

A financial institution is designing an incident response plan. They want to ensure that during a ransomware incident, critical transaction systems can be restored within 4 hours. Which metric should be used to measure this requirement?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable downtime after a disaster or incident, which directly aligns with the requirement to restore critical transaction systems within 4 hours. In incident management, RTO is the metric used to set the target for system recovery, ensuring business continuity. For ransomware incidents, RTO drives the restoration strategy and resource allocation to meet the 4-hour window.

Answer

Mean Time to Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)

Question 4

An information security manager is developing a program metric to measure the effectiveness of the security awareness training. Which metric is most appropriate?

Accepted Answer

Number of security incidents caused by human error.. The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

Answer

Percentage of employees who completed the training.

Answer

Average score on post-training tests.

Answer

Time taken to complete the training modules.

Question 5

An information security manager is designing a metrics program to report to the board. Which of the following metrics would be MOST meaningful to the board?

Accepted Answer

Percentage of systems with critical vulnerabilities. The board is primarily concerned with strategic risk posture and business impact. Percentage of systems with critical vulnerabilities directly quantifies the organization's exposure to high-severity threats, enabling informed risk acceptance or remediation decisions. This metric aligns with the board's fiduciary duty to oversee risk management, unlike operational details such as incident counts or training completions.

Answer

Number of security incidents reported

Answer

Average patch deployment time

Answer

Number of security awareness training completions

Question 6

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Accepted Answer

Business impact analysis (BIA) results.. A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Answer

Security awareness training for all employees.

Answer

Vulnerability scanning schedules.

Question 7

Which of the following best describes the primary purpose of a security program's governance framework?

Accepted Answer

To provide oversight and alignment with business objectives. The primary purpose of a security program's governance framework is to provide oversight and ensure that security activities are aligned with business objectives, risk appetite, and regulatory requirements. It establishes the policies, roles, and accountability structures that guide decision-making, rather than directly executing technical tasks. This alignment is critical for the program to be sustainable and supported by executive management.

Answer

To implement technical security controls

Answer

To conduct vulnerability assessments

Answer

To manage security incidents

Question 8

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 9

During an incident investigation, the incident response team needs to collect volatile data from a compromised server. Which of the following data should be collected FIRST?

Accepted Answer

Contents of system memory (RAM). Volatile data, such as the contents of system memory (RAM), is lost when the system is powered off. Collecting RAM first preserves evidence of running processes, network connections, and encryption keys that would otherwise be destroyed. This follows the order of volatility (RFC 3227), which mandates capturing the most volatile data first.

Answer

Network connection logs from the firewall

Answer

Contents of the hard drive

Answer

Event logs from the system

Question 10

An organization's security team detects an unusual spike in outbound traffic from a database server to an external IP address during a routine security scan. The database server contains sensitive customer data. Which of the following is the MOST appropriate initial response?

Accepted Answer

Isolate the database server from the network to stop the traffic.. Isolating the database server is the most appropriate initial response because it immediately halts the suspected data exfiltration, containing the incident and preventing further loss of sensitive customer data. In incident management, the priority is to stop the active threat before performing any investigative or notification steps, as per the NIST SP 800-61 incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery). Delaying containment to review logs or run scans allows the exfiltration to continue, increasing the potential damage.

Answer

Notify the data protection officer and legal team.

Answer

Review firewall logs to confirm data exfiltration.

Answer

Run a full antivirus scan on the database server.