CISM Practice Test 30 — 15 Questions

Question 1

An organization's incident response plan has not been updated in two years. Which of the following is the MOST likely consequence?

Accepted Answer

The plan may not address current threats and technologies.. An incident response plan that has not been updated in two years is unlikely to account for recent changes in the threat landscape, such as new attack vectors (e.g., ransomware-as-a-service, zero-day exploits) or shifts in technology stack (e.g., cloud-native architectures, IoT devices). Without periodic review, the plan may lack updated playbooks for current malware families, fail to reference new detection tools, or omit revised containment procedures for modern network segmentation. This gap directly increases the risk of ineffective response during an actual incident.

Answer

The plan will comply with new regulations automatically.

Answer

The plan will be more effective due to maturity.

Answer

The plan will be followed exactly as written.

Question 2

A company is restructuring its security governance due to rapid growth. The CISO reports to the CIO. What is the PRIMARY risk of this reporting structure?

Accepted Answer

Security objectives may be overridden by IT operational goals. When the CISO reports to the CIO, security objectives are subordinate to IT operational goals. The CIO's primary mandate is system availability, performance, and cost efficiency, which can lead to security controls being deprioritized or bypassed to meet IT project deadlines. This structural conflict is the primary risk because it directly undermines the independence required for effective security governance.

Answer

Compliance with regulations may become difficult

Answer

The security budget may be insufficient

Answer

Cooperation between IT and security may decrease

Question 3

A company is implementing a vendor tiering system for third-party risk management. Which TWO factors should be used to determine the tier of a vendor?

Accepted Answer

Criticality of the service provided by the vendor. Option B is correct because the criticality of the service provided by the vendor directly determines how much operational impact a failure or disruption would have on the organization, which is a primary driver of vendor tiering in third-party risk management. Option D is correct because the type of data accessed by the vendor (for example, PII, PHI, PCI, or intellectual property) determines the regulatory, privacy, and security risk exposure, and vendors handling sensitive or regulated data warrant a higher tier. Options A, C, and E are not appropriate tiering factors: marketing budget, stock price, and annual revenue reflect the vendor's financial or promotional posture rather than the risk the vendor poses to the organization's operations, data, or compliance obligations.

Answer

Vendor's marketing budget

Answer

Vendor's stock price

Answer

Vendor's annual revenue

Question 4

A global company is establishing an information security governance committee. Which membership composition BEST ensures alignment between security and business strategy?

Accepted Answer

Senior leaders from each business unit, the CISO, and the Chief Risk Officer. It ensures that the information security governance committee includes senior leaders from each business unit, the CISO, and the Chief Risk Officer. This composition directly aligns security initiatives with business strategy by integrating business objectives, risk appetite, and security expertise at the strategic decision-making level, which is essential for effective governance as defined by ISACA's CISM framework.

Answer

IT operations managers and the CISO

Answer

Chief Information Security Officer (CISO) and IT directors only

Answer

Chief Financial Officer (CFO), General Counsel, and CISO

Question 5

Arrange the steps for deploying a security patch to critical servers in a production environment.

Accepted Answer

First identify and assess the patch, then test it in a non-production environment, then backup critical systems and data, then deploy the patch to production, and finally verify the patch installation and system functionality.. Patch management involves identification, testing, backup, deployment, and verification.

Answer

First identify and assess the patch, then backup critical systems, then test the patch in non-production, then deploy, then verify.

Answer

First identify and assess the patch, then test, then deploy, then backup, then verify.

Answer

First identify, then test, then verify, then backup, then deploy.

Question 6

Which TWO components are essential for an effective information security governance framework?

Accepted Answer

Board-level oversight of security programs. Option C is correct because an effective information security governance framework requires board-level oversight, which provides strategic direction, accountability, and authority for the security program at the highest organizational level. Option D is correct because governance must align the security program with business objectives, ensuring that security investments and risk decisions directly support organizational goals and value creation. These two components reflect the core purpose of governance—direction and alignment from leadership—rather than operational or tactical activities. Option A is incorrect because an intrusion detection system is a technical control used in security operations, not a governance component. Option B is incorrect because detailed technical configuration guides are implementation artifacts, not governance elements. Option E is incorrect because daily threat intelligence feeds are operational inputs that support monitoring and response, not governance structure or oversight.

Answer

Implementation of an intrusion detection system

Answer

Detailed technical configuration guides

Answer

Daily threat intelligence feeds

Question 7

Which of the following security team roles is primarily responsible for designing and implementing security solutions to protect an organization's systems and data?

Accepted Answer

Security architect. The security architect role is specifically chartered with designing the security architecture — defining security requirements, selecting controls, and engineering solutions (e.g., zero trust, segmentation, IAM, encryption) that protect systems and data. This is a design-and-build function, distinct from monitoring or assessment roles. The architect translates business and risk requirements into technical security designs that engineering teams implement.

Answer

Security analyst

Answer

GRC analyst

Answer

Penetration tester

Question 8

After successfully containing an incident, the incident response team discovers that the attacker exploited a previously unknown vulnerability in a web application. The vulnerability is not yet patched by the vendor. The organization's management is concerned about the risk of another attack using the same vulnerability. What should the team recommend as the immediate action to reduce this risk?

Accepted Answer

Implement a workaround to mitigate the vulnerability. When a zero-day vulnerability has no vendor patch, the only immediate way to reduce exposure is to apply a compensating control or workaround (e.g., virtual patching via WAF rules, disabling the vulnerable function, or restricting access). This directly reduces the attack surface without waiting for the vendor. It is the fastest risk-reduction action available to the IR team.

Answer

Disable the web application until a patch is available

Answer

Report the vulnerability to the software vendor

Answer

Develop an in-house patch for the vulnerability

Question 9

What is the PRIMARY reason for having an incident response team roster and contact list readily available?

Accepted Answer

To enable quick activation of the incident response team.. Rapid activation of the IR team depends on knowing who to contact and their backup.

Answer

To satisfy regulatory compliance requirements.

Answer

To ensure all team members have the necessary training.

Answer

To provide a list for auditors to review.

Question 10

In designing a security operations centre (SOC), which TWO functions are core to the SOC's responsibilities? (Select TWO.)

Accepted Answer

Security monitoring and detection. Option B, security monitoring and detection, is a core SOC responsibility because the SOC's primary mission is continuous 24x7 visibility over logs, network traffic, and endpoint telemetry using SIEM, IDS/IPS, and EDR to identify malicious activity. Option E, incident response, is also core because once detection occurs, the SOC triages, contains, eradicates, and recovers from incidents, coordinating escalation and forensic evidence handling. Together, monitoring/detection and incident response form the detect-and-respond loop that defines SOC operations. Vulnerability management (A) is typically owned by a vulnerability management or risk team, though the SOC may consume its output. Security awareness training (C) belongs to the security awareness/HR function, and security architecture design (D) is an engineering/architecture responsibility rather than a SOC operational function.

Answer

Vulnerability management

Answer

Security awareness training

Answer

Security architecture design

Question 11

A healthcare organization is developing an information security strategy. The board has mandated that the strategy must support innovation while protecting patient data. Which governance approach BEST balances these priorities?

Accepted Answer

Establish a risk appetite framework that defines acceptable risk levels for innovation initiatives.. A risk appetite framework (Option B) is the correct governance approach because it explicitly defines the level of risk the organization is willing to accept in pursuit of innovation, allowing the board to balance patient data protection with strategic growth. This framework provides a decision-making boundary for security controls, ensuring that innovation initiatives are not stifled by overly restrictive measures while still maintaining compliance with healthcare regulations like HIPAA and HITECH.

Answer

Implement strict access controls and encryption for all data.

Answer

Adopt a 'security by design' approach for all new projects.

Answer

Create a separate innovation sandbox with limited data access.

Question 12

Which component of an incident response program is most likely to include step-by-step technical actions for addressing a specific type of security incident?

Accepted Answer

Incident response playbook. An incident response playbook provides detailed, step-by-step technical procedures for handling specific incident types (e.g., ransomware, DDoS, phishing). Unlike higher-level documents, playbooks contain actionable commands, tool-specific instructions, and decision trees that guide responders through containment, eradication, and recovery. This granularity ensures consistent and efficient execution during an active security event.

Answer

Communication templates

Answer

Incident response policy

Answer

Incident response plan

Question 13

A CISO is designing the security organization for a financial services firm. Which reporting structure is most likely to ensure the independence and authority of the information security function?

Accepted Answer

Reporting to the CEO or board of directors. For the information security function to have true independence and authority, it must not report to an executive whose objectives it is expected to audit or control. Reporting to the CEO or board of directors gives the CISO organizational independence from IT operations and the authority to enforce security policy across the enterprise. This structure is widely recommended by ISACA and regulatory frameworks for financial services firms.

Answer

Reporting to the risk committee

Answer

Reporting to the CIO

Answer

Reporting to the chief legal officer

Question 14

A multinational corporation is establishing an information security governance framework. The board has approved a top-down approach where security policies are created at the corporate level and adapted locally. Which of the following is a key benefit of this approach?

Accepted Answer

It ensures a consistent baseline of security controls while allowing for local regulatory adjustments.. A top-down governance approach ensures that a consistent baseline of security controls is mandated at the corporate level, which is critical for managing risk across a multinational enterprise. By allowing local adaptation, the framework can incorporate region-specific legal requirements (e.g., GDPR in Europe, CCPA in California) without deviating from the core security posture. This balance between uniformity and flexibility is the primary benefit, as it prevents fragmented security while respecting jurisdictional mandates.

Answer

It allows each subsidiary to develop security policies that best fit their local legal environment.

Answer

It reduces the time required to implement security policies across the entire organization.

Answer

It minimizes the need for local security teams to understand the corporate strategy.

Question 15

Which of the following are key components of an effective information security program? (Select TWO.)

Accepted Answer

A risk management framework. A risk management framework is a key component because it provides a structured, repeatable process for identifying, assessing, and mitigating information security risks. It ensures that security investments and controls are aligned with business objectives and risk appetite, rather than being ad hoc or technology-driven. Without a risk management framework, an information security program lacks the foundational governance to prioritize threats and allocate resources effectively.

Answer

State-of-the-art security tools and technologies

Answer

A large security operations center

Answer

Compliance with all applicable laws