CISM Practice Test 30 — 15 Questions

Question 1

Based on the exhibit, which role is missing from the governance policy that would be essential for enforcing accountability?

Accepted Answer

A role with authority to enforce compliance and impose consequences. The governance policy lacks a role with explicit authority to enforce compliance and impose consequences, which is essential for accountability. Without such enforcement, policies become aspirational rather than binding, as no mechanism exists to address non-compliance or ensure corrective actions. This aligns with the CISM principle that governance requires clear accountability structures, including disciplinary measures for violations.

Answer

External auditor

Answer

Internal audit function

Answer

Chief compliance officer

Question 2

An organization's incident response plan requires that evidence be preserved for potential litigation. Which of the following actions is MOST critical to ensure the admissibility of digital evidence?

Accepted Answer

Documenting the chain of custody for all evidence collected.. Admissibility of digital evidence in court hinges on demonstrating that the evidence has not been tampered with from the moment of collection to presentation. The chain of custody is the legally mandated documentation that tracks every person who handled the evidence, the time and date of each transfer, and the purpose of each action. Without a complete and verifiable chain of custody, the opposing counsel can successfully argue that the evidence may have been altered, making it inadmissible regardless of how securely it was stored or imaged.

Answer

Storing evidence in a secure, access-controlled location.

Answer

Creating forensic images of all affected systems before remediation.

Answer

Encrypting all evidence files to prevent unauthorized access.

Question 3

A small business cannot afford a dedicated security team. Which governance model is most appropriate?

Accepted Answer

Hire a virtual CISO and outsource security operations. For a small business without the budget for a dedicated security team, the most appropriate governance model is to hire a virtual CISO (vCISO) and outsource security operations. This provides access to expert strategic guidance and managed security services (e.g., SIEM monitoring, incident response) at a fraction of the cost of a full-time internal team, aligning with the principle of risk-based resource allocation in information security governance.

Answer

Implement a full security program based on ISO 27001

Answer

Ignore security until a breach occurs

Answer

Delegate security to the IT manager with periodic board updates

Question 4

Which of the following is the PRIMARY purpose of having a pre-established contract with a digital forensics firm before an incident occurs?

Accepted Answer

To reduce the time required to engage the firm during an incident. The primary purpose of a pre-established contract with a digital forensics firm is to eliminate procurement delays during an incident. When an incident occurs, time is critical; having a signed contract in place allows the firm to be engaged immediately without waiting for legal or administrative approvals, which directly supports the incident response goal of minimizing damage and preserving evidence.

Answer

To ensure attorney-client privilege is automatically applied

Answer

To ensure the firm is available 24/7

Answer

To guarantee a discounted rate

Question 5

A security analyst discovers that an employee's credentials were used to access a sensitive database containing customer PII. The analyst immediately disables the account and begins remediation. Which incident category best describes this scenario?

Accepted Answer

Account compromise. The incident involves unauthorized use of legitimate credentials to access a sensitive database, which is the defining characteristic of an account compromise. The immediate disabling of the account and remediation aligns with standard incident response procedures for credential theft, where the attacker has gained authenticated access without authorization. This is distinct from a data breach, which focuses on the exfiltration or exposure of data, not the method of access.

Answer

Data breach

Answer

Physical security

Answer

Insider threat

Question 6

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 — Critical. P1 — Critical incidents, such as a complete system outage or data breach, require immediate executive notification and a 24/7 response because they pose an imminent threat to business operations, legal compliance, or data integrity. This severity level triggers the highest escalation path, often involving the CEO, CISO, and legal counsel, with round-the-clock resource allocation to contain and remediate the issue.

Answer

P3 — Medium

Answer

P4 — Low

Answer

P2 — High

Question 7

A financial institution is designing its information security governance to comply with multiple regulations. The board has limited risk appetite. Which approach BEST ensures effective governance while minimizing conflict?

Accepted Answer

Implement a harmonized control framework that maps to all regulations. A harmonized control framework (e.g., ISO 27001, NIST CSF) maps common controls across multiple regulations (e.g., GDPR, PCI DSS, SOX), reducing duplication and conflict. This aligns with the board's limited risk appetite by providing a single, consistent set of controls that satisfy all requirements, avoiding the inefficiency and potential gaps of siloed approaches.

Answer

Assign different compliance teams for each regulation

Answer

Adopt a single regulatory framework and ignore others

Answer

Create separate governance committees for each regulation

Question 8

During a P1 incident, the crisis management team (CMT) is activated and meets within the first hour. Which communication practice is most appropriate for the CMT to follow when providing updates to the board of directors?

Accepted Answer

Send a brief status report every hour, avoiding speculation and including legal counsel review. During a P1 incident, the CMT must provide timely, concise updates to the board to maintain trust and enable strategic decisions. Option A is correct because it balances frequency (hourly) with content discipline (avoiding speculation) and includes legal counsel review, which is critical for compliance and liability management. This aligns with the CISM Incident Management domain's emphasis on clear, non-technical communication to senior leadership.

Answer

Provide detailed technical updates every hour

Answer

Provide speculative root cause analysis to demonstrate competence

Answer

Wait until the incident is fully understood before any communication

Question 9

In the context of incident severity classification, which of the following best describes a P3 (medium) incident?

Accepted Answer

Limited impact with standard response and no immediate escalation. A P3 (medium) incident is defined as having limited impact on business operations, allowing for a standard response during normal business hours without requiring immediate escalation. This classification typically applies to incidents that do not affect critical systems or sensitive data, and can be resolved through normal change management processes without urgent intervention.

Answer

Significant impact requiring management notification and business hours response

Answer

Minimal impact with scheduled remediation

Answer

Critical business impact requiring 24/7 response and executive notification

Question 10

Which of the following are key components of an information security program? (Select TWO)

Accepted Answer

A set of security policies and standards. A set of security policies and standards is a key component because it establishes the governance framework that defines acceptable use, access control, and compliance requirements for the entire organization. Without documented policies and standards, the security program lacks the authoritative baseline to enforce controls or measure effectiveness. These documents are the foundation for all other security activities, including training, audits, and incident response.

Answer

A network architecture diagram

Answer

An incident response log

Question 11

A security administrator reports that the VPN tunnel to the remote peer (10.1.1.1) intermittently fails. Which of the following is the most likely cause?

Accepted Answer

Improper NAT traversal configuration. The intermittent failure suggests NAT traversal is not properly configured. NAT traversal (NAT-T) is used to encapsulate VPN traffic (ESP) in UDP to traverse NAT devices. If the remote peer is behind a NAT device and NAT-T is not correctly enabled or configured, packets may be dropped, causing intermittent tunnel failures.

Answer

Mismatched IKE phase 1 parameters

Answer

Expired digital certificate

Answer

Incorrect firewall access control list

Question 12

An organization wants to ensure its information security program is aligned with business objectives. Which of the following is the BEST approach?

Accepted Answer

Involve business stakeholders in the security steering committee. Involving business stakeholders in the security steering committee ensures that security initiatives are directly aligned with business objectives, as stakeholders provide input on risk tolerance, regulatory requirements, and strategic goals. This collaborative governance model allows the security program to prioritize resources and controls based on business impact, rather than operating in isolation. It is the most effective approach because it integrates security decision-making with business planning, which is a core principle of the CISM framework.

Answer

Implement a security incident response plan

Answer

Perform regular vulnerability scans

Answer

Conduct annual security awareness training

Question 13

Which THREE of the following are critical success factors for implementing an information security program?

Accepted Answer

Risk-based approach to prioritize controls.. A risk-based approach (B) is critical because it ensures that security controls are prioritized based on the actual threats and vulnerabilities facing the organization, rather than applying controls uniformly. This aligns resources with the highest risks, optimizing the cost-benefit ratio of the security program and directly supporting business resilience.

Answer

Compliance as the primary driver.

Answer

Deployment of the latest security technology.

Question 14

Which of the following is the BEST reporting structure for a CISO to ensure independent oversight and alignment with business strategy?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board ensures the CISO has the authority and independence to influence security strategy without conflicting priorities from IT operations.

Answer

Reporting to the CIO

Answer

Reporting to the head of legal

Answer

Reporting to the CFO

Question 15

A global company is establishing an information security governance committee. Which membership composition BEST ensures alignment between security and business strategy?

Accepted Answer

Senior leaders from each business unit, the CISO, and the Chief Risk Officer. It ensures that the information security governance committee includes senior leaders from each business unit, the CISO, and the Chief Risk Officer. This composition directly aligns security initiatives with business strategy by integrating business objectives, risk appetite, and security expertise at the strategic decision-making level, which is essential for effective governance as defined by ISACA's CISM framework.

Answer

IT operations managers and the CISO

Answer

Chief Information Security Officer (CISO) and IT directors only

Answer

Chief Financial Officer (CFO), General Counsel, and CISO