CISM Practice Test 2 — 30 Questions

Question 1

Order the steps for implementing a security awareness training program.

Accepted Answer

Needs Assessment, then Content Development, then Delivery, then Evaluation, then Continuous Improvement. Training programs start with needs assessment, then content development, delivery, evaluation, and continuous improvement.

Answer

Content Development, then Needs Assessment, then Delivery, then Evaluation, then Continuous Improvement

Answer

Needs Assessment, then Content Development, then Delivery, then Continuous Improvement, then Evaluation

Answer

Needs Assessment, then Content Development, then Evaluation, then Delivery, then Continuous Improvement

Question 2

Match each security framework to its primary purpose.

Accepted Answer

COBIT: A framework for IT governance and management.. COBIT is for IT governance, ISO 27001 for ISMS, and NIST CSF for cybersecurity risk management. The distractors swap definitions between COBIT and ISO 27001.

Answer

COBIT: A standard for information security management systems.

Answer

ISO 27001: A framework for IT governance and management.

Question 3

Which THREE of the following are challenges in implementing information security governance in a decentralized organization?

Accepted Answer

Redundant security controls and tools. In a decentralized organization, each business unit often selects its own security tools and controls, leading to redundant security controls and tools across the enterprise. This redundancy increases costs, creates management complexity, and can introduce gaps in coverage due to inconsistent integration. The lack of centralized oversight means that duplicate solutions for the same function (e.g., multiple endpoint protection platforms) are common, making unified monitoring and maintenance difficult.

Answer

Unified risk reporting

Answer

Centralized incident response

Question 4

A company is evaluating its risk management process. The CISM notices that risks are being assessed based on qualitative scales (low, medium, high) but decisions require quantitative data. What is the most effective action to improve the process?

Accepted Answer

Use a hybrid approach that includes both qualitative and quantitative assessments.. A hybrid approach (Option B) is most effective because it leverages qualitative scales for initial, rapid risk identification and prioritization, while quantitative data (e.g., ALE, SLE, ARO) provides the monetary rigor needed for cost-benefit analysis and management decisions. This aligns with ISACA's guidance that risk assessment should be tailored to the decision context, not purely one method.

Answer

Switch to a fully quantitative risk assessment methodology.

Answer

Replace qualitative scales with precise monetary values.

Answer

Continue using qualitative method since it is simpler.

Question 5

After a security incident, the incident response team identifies that the root cause was a phishing email that bypassed the email filter. The email contained a malicious macro that executed PowerShell commands. Which control would be MOST effective in preventing similar incidents in the future?

Accepted Answer

Disable macros in documents originating from external sources. Disabling macros in documents from external sources directly addresses the attack vector: the malicious macro that executed PowerShell commands. This control prevents the macro from running, regardless of the email filter's failure, by blocking the execution environment at the endpoint level. It is a preventive technical control that stops the attack before it can proceed.

Answer

Implement network segmentation for sensitive systems

Answer

Deploy additional antivirus software on endpoints

Answer

Conduct security awareness training for all employees

Question 6

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 7

Which of the following is the PRIMARY goal of incident containment?

Accepted Answer

To prevent further damage and limit the scope of the incident.. The primary goal of incident containment is to stop the incident from spreading and to limit the scope of damage. This is the immediate priority because, without containment, the attacker may continue to compromise additional systems, exfiltrate data, or escalate privileges. Options A, B, and C are important subsequent steps but are secondary to the urgent need to halt the incident's progression.

Answer

To gather evidence for prosecution.

Answer

To recover systems to normal operation.

Answer

To identify the root cause.

Question 8

A company's incident response team uses a SIEM to detect security events. Which SIEM capability is MOST critical for early detection of a potential incident?

Accepted Answer

Correlation rules. Correlation rules are the most critical SIEM capability for early detection because they allow the incident response team to define specific patterns of activity (e.g., multiple failed logins followed by a successful login from a different geographic location) that indicate a potential security incident. Unlike raw log review or simple alerting, correlation rules reduce false positives by combining multiple data sources and time-based conditions, enabling the SIEM to identify complex attack chains at the earliest possible stage. Without correlation, the team would rely on manual log analysis or isolated alerts, which significantly delays detection.

Answer

Real-time alerting

Answer

User and entity behavior analytics (UEBA)

Answer

Long-term log retention

Question 9

Refer to the exhibit. The CISO wants to improve the program. Which recommendation BEST addresses the main gap shown in the dashboard?

Accepted Answer

Implement automated patching for high-risk vulnerabilities. The dashboard shows high-risk vulnerability remediation at 88%, which is below the target. Implementing automated patching for high-risk vulnerabilities would directly address this gap by ensuring faster and more consistent remediation. Option B is incorrect because reducing the compliance target does not fix the underlying issue. Option C is incorrect because critical vulnerability remediation is already high. Option D is incorrect because increasing patch frequency for all systems may not specifically target the high-risk vulnerability gap.

Answer

Reduce the compliance target for high-risk vulnerabilities to 90 days

Answer

Focus on critical vulnerability remediation

Answer

Increase patch frequency for all systems

Question 10

An organization wants to measure the effectiveness of its security awareness programme. Which metric is a leading indicator of improved security culture?

Accepted Answer

Number of phishing emails reported by employees. An increase in the number of phishing emails reported by employees indicates that they are actively recognizing and reporting suspicious activity, which is a leading indicator of improved security awareness and culture.

Answer

Number of security incidents attributed to human error

Answer

Percentage of employees who completed annual training

Answer

Average score on knowledge assessment tests

Question 11

A large enterprise is implementing a new governance framework. The board has approved a risk appetite statement. What is the MOST important next step for the information security manager?

Accepted Answer

Define risk acceptance criteria and thresholds. Once the board has approved a risk appetite statement, the information security manager must translate that high-level appetite into actionable risk acceptance criteria and thresholds. This step is critical because it defines the specific boundaries (e.g., maximum acceptable monetary loss per incident, maximum tolerable downtime) that guide all subsequent risk treatment decisions. Without these criteria, technical controls (Option A) and training (Option D) cannot be properly scoped, and audit plans (Option B) would lack measurable benchmarks.

Answer

Implement technical controls to reduce risks

Answer

Develop an audit plan to monitor risk levels

Answer

Conduct security awareness training for employees

Question 12

A security analyst receives an alert from the SIEM indicating a high number of failed login attempts from a single external IP address targeting a public-facing web server. The analyst checks the logs and sees that the attempts are using common usernames. What is the MOST appropriate immediate response?

Accepted Answer

Block the IP address at the firewall.. The immediate response to a brute-force attack from a single external IP is to block that IP at the firewall. This stops the attack at the network perimeter, preventing further authentication attempts without affecting legitimate users (assuming the IP is not a known legitimate source). Delaying action could allow the attacker to compromise an account via password guessing, especially since common usernames are being targeted.

Answer

Ignore the alert as it is likely a false positive.

Answer

Disable the web server.

Answer

Notify law enforcement.

Question 13

After an incident is contained and eradicated, the incident response team conducts a post-incident review. Which of the following is the PRIMARY objective of this review?

Accepted Answer

Identify process improvements. The primary objective of a post-incident review is to identify process improvements that enhance the organization's incident response capabilities. This aligns with the CISM focus on continuous improvement, ensuring that lessons learned are captured and applied to prevent recurrence or improve future response efficiency.

Answer

Update security policies

Answer

Determine the financial impact

Answer

Assign blame to the responsible parties

Question 14

A company's IDS alerts on a potential breach. The incident response team is called. What should they do immediately?

Accepted Answer

Verify the alert and assess scope. The immediate priority upon receiving an IDS alert is to verify the alert's validity and assess the scope of the potential breach. This ensures the incident response team does not waste resources on false positives and can accurately determine the affected systems, data, and network segments before taking containment actions. Verification typically involves correlating the IDS signature with actual packet captures, logs, and system telemetry to confirm malicious activity.

Answer

Disconnect all network cables

Answer

Notify law enforcement

Answer

Reimage affected systems

Question 15

Arrange the steps for responding to a data breach involving personally identifiable information (PII).

Accepted Answer

Step 1: Containment, Step 2: Evidence Preservation, Step 3: Internal Notification, Step 4: Impact Assessment, Step 5: External Notification. Incident response begins with containment, then evidence preservation, internal notification, impact assessment, and external notification.

Answer

Step 1: Impact Assessment, Step 2: Containment, Step 3: Evidence Preservation, Step 4: Internal Notification, Step 5: External Notification

Answer

Step 1: External Notification, Step 2: Internal Notification, Step 3: Containment, Step 4: Evidence Preservation, Step 5: Impact Assessment

Answer

Step 1: Evidence Preservation, Step 2: Containment, Step 3: Internal Notification, Step 4: Impact Assessment, Step 5: External Notification

Question 16

During a risk assessment, a company discovers that its data backup process is incomplete: backups are performed daily but stored onsite without encryption. The risk owner proposes to accept this risk due to low likelihood of a physical breach. Which of the following is the BEST reason to challenge this acceptance?

Accepted Answer

The impact of losing both primary and backup data is unacceptably high. The core principle of risk acceptance requires that the residual risk be within the organization's risk appetite. In this scenario, the backup data is stored onsite without encryption, meaning a single physical breach (e.g., fire, theft, or natural disaster) could destroy both primary and backup data simultaneously. The impact of losing all data—potentially leading to business failure—is unacceptably high, outweighing the low likelihood of a physical breach. The risk owner's acceptance is invalid because the risk exceeds the organization's risk tolerance, as per CISM's risk management framework.

Answer

The risk owner does not have authority to accept risks

Answer

Encryption is not required as the facility is secure

Answer

The cost of implementing encrypted offsite backups is minimal

Question 17

After a security incident, the incident response team prepares a report detailing the root cause, impact, and lessons learned. Who is the PRIMARY audience for this report?

Accepted Answer

Senior management and the board of directors. The primary audience for a post-incident report detailing root cause, impact, and lessons learned is senior management and the board of directors. They require this information to make strategic decisions about risk acceptance, resource allocation for remediation, and to fulfill fiduciary duties regarding cybersecurity governance. The report provides the business context and financial impact necessary for executive-level oversight, not the technical details needed by operational teams.

Answer

The affected users

Answer

The IT support team

Answer

External auditors

Question 18

A small accounting firm with 50 employees recently suffered a ransomware attack that encrypted all client data on its file server. The firm had no backup strategy, and the attackers demanded a ransom for decryption. The firm paid the ransom, but many clients left due to loss of trust. The firm’s owner has now hired you as a part-time risk manager. Your first task is to develop a risk management program. What is the most appropriate initial step?

Accepted Answer

Conduct a risk assessment to identify assets, threats, and vulnerabilities. The first step in developing a risk management program, per the CISM framework, is to conduct a risk assessment. This identifies the specific assets (e.g., client data on the file server), threats (e.g., ransomware), and vulnerabilities (e.g., lack of backups, weak access controls) that led to the incident. Without this foundational analysis, any subsequent controls—such as backups or insurance—would be misaligned with the firm's actual risk profile, potentially wasting resources on ineffective measures.

Answer

Purchase a comprehensive cyber insurance policy

Answer

Fire the IT staff responsible for the security failures

Answer

Immediately implement a backup and disaster recovery solution

Question 19

A small business is developing its first information security program. Which approach is most effective?

Accepted Answer

Conduct a risk assessment to identify key assets and threats.. Conducting a risk assessment (Option C) is the foundational step in building an information security program because it identifies the specific assets, threats, vulnerabilities, and impacts unique to the small business. Without this context, any controls or frameworks applied would be misaligned with the actual risk profile, leading to wasted resources and potential security gaps. The CISM framework emphasizes that risk assessment drives the selection of cost-effective, prioritized controls tailored to the organization's needs.

Answer

Hire an external security consultant to design the entire program.

Answer

Adopt a comprehensive framework like ISO 27001 immediately.

Answer

Purchase and deploy a next-generation firewall.

Question 20

An organization has a policy to share indicators of compromise (IoCs) with an Information Sharing and Analysis Center (ISAC). This activity is most closely associated with which phase of incident management?

Accepted Answer

Post-incident activity. Sharing IoCs with ISACs is a post-incident activity aimed at improving collective defense and preventing future incidents.

Answer

Preparation

Answer

Containment, eradication, and recovery

Answer

Detection and analysis