CISM Practice Test 3 — 30 Questions

Question 1

Which TWO of the following are indicators of a potential security incident?

Accepted Answer

Multiple unexpected system reboots.. Option B is correct because multiple unexpected system reboots can indicate malicious activity such as a rootkit, bootkit, or attacker-triggered crash/restart to cover tracks or disrupt availability, and repeated reboots are a classic anomaly in incident detection. Option E is correct because unusual outbound network traffic from a server often signals command-and-control (C2) communication, data exfiltration, or malware beaconing, making it a strong indicator of compromise. Option A is not correct because low disk space is typically a capacity/performance issue, not a security incident indicator. Option C is not correct because a vendor releasing a new software version is a normal patch/update event, not an incident. Option D is not correct because a successful login by an authorized user is expected behavior and only becomes suspicious with additional context such as impossible travel or unusual time.

Answer

Low disk space on a file server.

Answer

A new version of a critical software released.

Answer

A successful login by an authorized user.

Question 2

During an incident, the incident response team needs to preserve evidence for legal proceedings. Which of the following is the MOST important action to take?

Accepted Answer

Create a forensic image of affected systems using write-blockers.. Creating a forensic image of affected systems using write-blockers is the most important action because it preserves the original data in a bit-for-bit, unaltered state, ensuring the evidence is admissible in legal proceedings. Write-blockers prevent any write operations to the source drive, maintaining the integrity of the evidence chain of custody. Without a forensically sound image, any subsequent analysis could be challenged as tampered or unreliable.

Answer

Document the incident in a free-form text.

Answer

Take screenshots of system logs.

Answer

Notify law enforcement immediately.

Question 3

Which THREE of the following are key components of an incident response plan? (Select THREE)

Accepted Answer

Communication and escalation matrix. Option C, the communication and escalation matrix, is a core component because it defines who must be notified, in what order, and through which channels (e.g., phone, email, secure messaging) during an incident, ensuring timely escalation to management, legal, and other stakeholders. Option D, incident response procedures, is essential because it provides the documented, repeatable steps for detecting, containing, eradicating, recovering from, and reviewing incidents, typically aligned with frameworks such as NIST SP 800-61. Option E, roles and responsibilities of team members, is required to establish clear ownership and accountability across the incident response team, such as incident commander, communications lead, and forensic analysts, preventing gaps or duplicated effort during an incident. Option A does not belong because a full list of all employees' contact information is not a key component of an incident response plan; only relevant escalation contacts and on-call personnel are needed. Option B does not belong because an annual budget for incident response tools is a financial or management consideration, not a structural component of the incident response plan itself.

Answer

List of all employees' contact information

Answer

Annual budget for incident response tools

Question 4

Refer to the exhibit. An organization uses these firewall rules. After a breach, the IR team finds that the attacker gained access via SSH from an external IP. Which rule is most likely misconfigured?

Accepted Answer

SSH is allowed from any source instead of only internal. The firewall rule allowing SSH from any source (0.0.0.0/0) is misconfigured because it permits external attackers to attempt brute-force or credential-based access via TCP port 22. The principle of least privilege dictates that SSH should be restricted to specific internal IP ranges or management jump hosts, not exposed to the internet. The IR team's finding that the attacker gained access via SSH from an external IP directly confirms this rule as the root cause.

Answer

MySQL should be blocked entirely

Answer

RDP should not be allowed

Answer

HTTPS should be inspected

Question 5

During a data breach investigation, an organization engages an external forensics firm. To preserve attorney-client privilege, which of the following is the BEST practice?

Accepted Answer

Engage the forensics firm under the direction of legal counsel.. Engaging the forensics firm under the direction of legal counsel is the best practice because it extends attorney-client privilege to the investigation. When counsel directs the work, communications and findings are protected as work product, preventing disclosure in litigation. This is a foundational principle in incident response legal strategy.

Answer

Have the forensics firm work independently to maintain objectivity.

Answer

Ensure the forensics firm signs a non-disclosure agreement only.

Answer

Have the forensics firm report directly to the CISO.

Question 6

During a P1 incident, the crisis management team (CMT) is activated and meets within the first hour. Which communication practice is most appropriate for the CMT to follow when providing updates to the board of directors?

Accepted Answer

Send a brief status report every hour, avoiding speculation and including legal counsel review. During a P1 incident, the CMT must provide timely, concise updates to the board to maintain trust and enable strategic decisions. Option A is correct because it balances frequency (hourly) with content discipline (avoiding speculation) and includes legal counsel review, which is critical for compliance and liability management. This aligns with the CISM Incident Management domain's emphasis on clear, non-technical communication to senior leadership.

Answer

Provide detailed technical updates every hour

Answer

Provide speculative root cause analysis to demonstrate competence

Answer

Wait until the incident is fully understood before any communication

Question 7

Which of the following is the PRIMARY reason for having a pre-established forensic retainer agreement before an incident occurs?

Accepted Answer

To reduce the time needed to bring forensic experts on board during an incident.. The primary reason for a pre-established forensic retainer agreement is to reduce the time needed to bring forensic experts on board during an incident. In incident management, every minute of delay can allow an attacker to exfiltrate data or destroy evidence; a retainer bypasses the procurement and contracting process, enabling immediate deployment of the forensic team to preserve volatile memory and capture network artifacts.

Answer

To ensure the forensic firm is familiar with the organization's environment.

Answer

To lock in a favorable pricing structure.

Answer

To ensure the forensic firm has the necessary certifications.

Question 8

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 9

During a data breach investigation, the incident response team discovers that a backup was encrypted by ransomware. The team needs to determine the sequence of events leading to the encryption. Which of the following documentation is MOST critical to preserve for potential litigation?

Accepted Answer

The chain of custody for the backup media. Chain of custody documentation is essential to prove the integrity and admissibility of digital evidence in court.

Answer

The communication logs between team members

Answer

The forensic tools used in the investigation

Answer

The incident response plan version used during the incident

Question 10

During a major incident, the incident response team discovers that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Accepted Answer

Escalate to activate the business continuity and disaster recovery plans. When an incident cannot be resolved within the MTD, it triggers the transition to business continuity and disaster recovery (BC/DR) plans to maintain critical operations.

Answer

Continue incident response efforts until resolution regardless of time

Answer

Declare the incident a disaster and shut down all systems

Answer

Notify the insurance provider immediately

Question 11

An information security manager is building a risk register for a newly formed risk management program. Which TWO of the following elements are essential components of each documented risk entry? (Choose two.)

Accepted Answer

The likelihood and impact ratings used to determine the risk level.. A risk register entry must identify who owns the risk and how severe it is. The named owner provides accountability for treatment and reporting, while likelihood and impact ratings establish the risk level that drives prioritization. Supporting details such as product versions, access lists, and network diagrams live in other repositories and should be referenced rather than embedded in the register.

Answer

The complete network diagram of the data center hosting the asset.

Answer

The specific antivirus product version deployed on affected endpoints.

Answer

The names of every employee who has access to the affected system.

Question 12

In a vendor tiering system for third-party risk management, which factor is most critical for determining the tier?

Accepted Answer

Vendor's data access and service criticality. The vendor's access to sensitive data and the criticality of the service to business operations are the primary factors for tiering, as they directly impact risk exposure.

Answer

Vendor's annual revenue

Answer

Vendor's geographic location

Answer

Vendor's number of employees

Question 13

An information security manager is designing a security awareness program. Which approach BEST addresses the different learning needs of various employee groups?

Accepted Answer

Deliver role-based training: secure coding for developers, social engineering for executives, and basic awareness for all. Role-based training ensures that each group receives content relevant to their responsibilities.

Answer

Use only phishing simulations as training

Answer

Focus training only on high-risk groups such as system administrators

Answer

Provide the same annual training to all employees to ensure consistency

Question 14

During an incident, the CIRT leader decides to contain a compromised server by disconnecting it from the network. However, this action may result in loss of volatile forensics data. What should the CIRT leader do?

Accepted Answer

Collect volatile data (memory, processes) before disconnecting. Volatile data (e.g., memory contents, running processes, network connections) is lost when power is removed or the network interface is disabled. The CIRT leader must follow the order of volatility (RFC 3227) and capture this data first to preserve forensic evidence before containment actions that alter the system state.

Answer

Proceed with disconnection immediately to prevent further damage

Answer

Keep the server connected but block all inbound/outbound traffic

Answer

Perform a full disk imaging before disconnection

Question 15

An organization wants to ensure its information security program is aligned with business objectives. Which of the following is the BEST approach?

Accepted Answer

Involve business stakeholders in the security steering committee. Involving business stakeholders in the security steering committee ensures that security initiatives are directly aligned with business objectives, as stakeholders provide input on risk tolerance, regulatory requirements, and strategic goals. This collaborative governance model allows the security program to prioritize resources and controls based on business impact, rather than operating in isolation. It is the most effective approach because it integrates security decision-making with business planning, which is a core principle of the CISM framework.

Answer

Implement a security incident response plan

Answer

Perform regular vulnerability scans

Answer

Conduct annual security awareness training

Question 16

During a phishing campaign, several employees clicked a malicious link that downloaded a remote access trojan (RAT). The incident response team has isolated the infected endpoints and is analyzing network traffic. They suspect that data may have been exfiltrated but are unsure. The team needs to determine the extent of data exfiltration as quickly as possible. What action should the team take FIRST?

Accepted Answer

Review DNS logs for outbound connections to unknown destinations. Reviewing DNS logs can reveal connections to known malicious domains or unusual patterns, helping identify data exfiltration. Blocking the domain is a containment step but doesn't aid analysis. Running a network scan may be too broad. Resetting passwords is important but not for detecting exfiltration.

Answer

Block the malicious domain at the firewall

Answer

Reset all employees' passwords

Answer

Run a full network scan for open ports

Question 17

An organization has a security program that is aligned with ISO 27001. During an internal audit, it is discovered that several controls are not being applied consistently across all departments. The MOST effective corrective action is to:

Accepted Answer

Establish a centralized security oversight function. The core issue is inconsistent control application across departments, which indicates a lack of governance and oversight rather than a policy or awareness deficiency. Establishing a centralized security oversight function directly addresses this by creating a single authority to enforce, monitor, and standardize control implementation, ensuring alignment with ISO 27001 requirements for management commitment and resource allocation (Clause 5.1 and 7.1). This corrective action provides the necessary organizational structure to drive consistent execution, which is the most effective long-term solution.

Answer

Update the information security policy

Answer

Increase security awareness training frequency

Answer

Conduct a risk assessment for each department

Question 18

A financial institution is developing an information security program based on the COBIT framework. The board has requested a balanced scorecard to communicate program effectiveness. Which of the following metric categories would best align with the 'Internal Processes' perspective?

Accepted Answer

Percentage of security incidents detected within defined SLAs. The 'Internal Processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of internal operational processes. The percentage of security incidents detected within defined SLAs directly measures the performance of the security monitoring and incident response processes, which are core internal processes in a COBIT-based information security program.

Answer

Cost of security incidents as a percentage of revenue

Answer

Number of security training hours per employee

Answer

Customer satisfaction survey scores on data protection

Question 19

What is the primary purpose of having a pre-established forensic retainer agreement with an external forensics firm?

Accepted Answer

To reduce time to engage during an incident. The primary purpose of a pre-established forensic retainer agreement is to reduce the time to engage during an incident. By having a contract already in place, the organization can bypass procurement and legal review delays, enabling the forensics firm to begin work immediately when an incident occurs, which is critical for preserving volatile evidence and minimizing damage.

Answer

To ensure chain of custody

Answer

To reduce legal liability

Answer

To guarantee confidentiality

Question 20

A multinational corporation is implementing a risk-based approach to information security governance. The chief information security officer (CISO) has been asked to prioritize security initiatives based on business impact. Which of the following actions should the CISO take FIRST to align security governance with business objectives?

Accepted Answer

Conduct a business impact analysis (BIA) to identify critical processes and their security requirements.. Conducting a business impact analysis (BIA) is the foundational step in a risk-based governance approach because it identifies critical business processes, their recovery time objectives (RTOs), and the specific security requirements needed to protect them. Without this analysis, the CISO cannot align security initiatives with business impact, as the BIA directly links security controls to the organization's most valuable assets and operational priorities.

Answer

Enforce multifactor authentication (MFA) for all remote access.

Answer

Implement a compliance management tool to track regulatory requirements.

Answer

Deploy a security information and event management (SIEM) system to centralize log analysis.