CISM Practice Test 31 — 15 Questions

Question 1

A CISO wants to present a high-level security status to the board using a one-page dashboard. Which of the following metrics is MOST appropriate for this audience?

Accepted Answer

Phishing click rate and patch compliance percentage. Leading indicators like phishing click rate and patch compliance are actionable and forward-looking, suitable for board-level oversight.

Answer

Mean time to detect (MTTD) for incidents

Answer

Detailed vulnerability counts by severity

Answer

Total number of security controls implemented

Question 2

Which THREE of the following are typical steps in a qualitative risk assessment?

Accepted Answer

Estimate likelihood and impact using rating scales. Qualitative risk assessment uses ordinal rating scales (e.g., 1-5 or Low-Medium-High) to estimate likelihood and impact based on expert judgment, not precise numerical values. This approach is standard in frameworks like ISO 27005 and NIST SP 800-30, which define qualitative analysis as relying on subjective categorization rather than hard financial data.

Answer

Calculate annualized loss expectancy (ALE)

Answer

Assign monetary values to impact

Question 3

An organization's security program has been in place for two years, but recently several security incidents occurred due to lack of user awareness. What is the most likely root cause?

Accepted Answer

The awareness program is not regularly updated or evaluated for effectiveness.. The scenario states the security program has been in place for two years, yet incidents persist due to lack of user awareness. This indicates the awareness program exists but is not being regularly updated or evaluated for effectiveness, which is a common root cause in mature programs where content becomes stale and fails to address evolving threats like phishing or social engineering.

Answer

Lack of a security awareness program.

Answer

Insufficient budget for security tools.

Answer

Insufficient firewall rules.

Question 4

An organization wants to establish a security champions program. What is the primary benefit of embedding security advocates in development teams?

Accepted Answer

Improving secure coding adoption and collaboration. Security champions serve as liaisons, promoting security practices and facilitating communication between security and development teams.

Answer

Eliminating the need for vulnerability assessments

Answer

Replacing the role of security architects

Answer

Reducing the need for a SOC

Question 5

Refer to the exhibit. The dashboard shows the incident response plan test is overdue. What is the MOST immediate risk?

Accepted Answer

Increased likelihood of a successful breach due to untested procedures. An untested incident response plan may have invalidated or outdated procedures, increasing the likelihood that a real incident will succeed due to ineffective response. Option A is wrong: loss of cyber insurance coverage is a potential consequence but not the most immediate risk—testing overdue does not instantly void coverage. Option B is wrong: regulatory fines may follow non-compliance, but the immediate operational risk is higher. Option C is wrong: extended recovery time is a possible outcome, but the primary immediate risk is the increased chance of a successful breach.

Answer

Loss of cyber insurance coverage

Answer

Regulatory fines for non-compliance with testing requirements

Answer

Extended recovery time during an incident

Question 6

During a security incident, the incident response team discovers that an attacker used a previously unknown vulnerability (zero-day) in a widely used software. Which action should the team take to address this vulnerability in the short term?

Accepted Answer

Implement a virtual patch through an intrusion prevention system (IPS). A virtual patch via an IPS provides immediate, temporary protection against a zero-day vulnerability by inspecting traffic for exploit patterns or anomalous behavior and blocking malicious payloads before they reach the vulnerable software. This buys time for the organization to assess the risk and plan a permanent fix without disrupting operations, as the IPS can be updated with signatures or rules specific to the newly discovered vulnerability.

Answer

Recompile the software with additional security controls

Answer

Immediately disable the software across the organization

Answer

Deploy a vendor patch as soon as it becomes available

Question 7

An organization's information security program has been in place for two years. During a recent audit, several findings indicated that security controls are not consistently applied across business units. The CISO has been asked to improve the program. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a risk assessment to identify gaps and prioritize remediation.. Conducting a risk assessment first (Option C) is the correct initial step because it systematically identifies where controls are failing or missing across business units, quantifies the associated risks, and prioritizes remediation based on business impact. Without this foundational analysis, any subsequent actions—such as automation, policy updates, or new controls—would lack direction and could waste resources on low-priority areas. This aligns with the CISM program lifecycle, where risk assessment drives all other program improvements.

Answer

Automate security compliance monitoring across all business units.

Answer

Update the information security policy to mandate compliance.

Answer

Implement additional security controls across all business units.

Question 8

Which incident category typically involves an employee intentionally or accidentally causing harm to the organization's information systems?

Accepted Answer

Insider threat. An insider threat is the correct category because it specifically involves harm caused by individuals within the organization, whether through malicious intent (e.g., data exfiltration, sabotage) or accidental actions (e.g., misconfiguration, phishing click). This aligns with the CISM definition of insider threats as incidents originating from employees, contractors, or trusted partners who have authorized access to information systems.

Answer

Data breach

Answer

DDoS

Answer

Ransomware

Question 9

A company is implementing an information security program. Which of the following is the PRIMARY reason to align the program with business objectives?

Accepted Answer

To gain management buy-in and support. Aligning the information security program with business objectives is primarily aimed at gaining management buy-in and support. When security initiatives are directly tied to business goals, management is more likely to understand their value and provide the necessary resources and authority. Regulatory compliance (A) is a requirement but not the primary reason; technical controls (B) are a means to an end; cost reduction (C) may be a secondary benefit but not the main driver.

Answer

To ensure regulatory compliance

Answer

To improve technical controls

Answer

To reduce overall security costs

Question 10

Which THREE of the following are typically included in an information security program budget?

Accepted Answer

Incident response retainer. Options A, B, and C are correct as they are common line items in an information security program budget. Incident response retainers cover external support for security incidents, security awareness training materials are essential for educating employees, and vulnerability assessment tools are used to identify weaknesses. Option D (marketing) is not a security cost, and Option E (employee salaries) is typically part of operational budgets, not the specific security program budget.

Answer

Marketing and advertising campaigns

Answer

Employee salaries

Question 11

An organization's security team detects an unusual spike in outbound traffic from a database server to an external IP address during a routine security scan. The database server contains sensitive customer data. Which of the following is the MOST appropriate initial response?

Accepted Answer

Isolate the database server from the network to stop the traffic.. Isolating the database server is the most appropriate initial response because it immediately halts the suspected data exfiltration, containing the incident and preventing further loss of sensitive customer data. In incident management, the priority is to stop the active threat before performing any investigative or notification steps, as per the NIST SP 800-61 incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery). Delaying containment to review logs or run scans allows the exfiltration to continue, increasing the potential damage.

Answer

Notify the data protection officer and legal team.

Answer

Review firewall logs to confirm data exfiltration.

Answer

Run a full antivirus scan on the database server.

Question 12

Based on the exhibit, what is the most likely vulnerability that an attacker could exploit?

Accepted Answer

An attacker could use SQL injection on the web server to extract data directly from the database via the permitted MySQL traffic.. The exhibit shows that MySQL traffic is permitted from the web server to the database server. An attacker who compromises the web server (e.g., via SQL injection) can use that allowed MySQL connection to extract sensitive data directly from the database, bypassing other network controls. This is a classic example of a trust-based vulnerability where internal database access is not sufficiently restricted.

Answer

An attacker could perform a DDoS attack on the external interface to disrupt email services.

Answer

An attacker could exploit the SMTP service to send spam.

Answer

An attacker could sniff traffic on the DMZ segment to capture LDAP credentials.

Question 13

During a simulated phishing exercise, several employees clicked a link and entered their credentials on a fake login page. The security team needs to determine the impact. Which of the following should be the NEXT step?

Accepted Answer

Reset the affected employees' passwords and enable multi-factor authentication. When credentials are compromised in a phishing attack, the immediate priority is to contain the breach by invalidating the exposed credentials. Resetting the affected employees' passwords and enabling multi-factor authentication (MFA) prevents attackers from using the harvested credentials for unauthorized access, especially if the credentials are reused across other systems. This aligns with the Incident Response phase of containment before moving to eradication or recovery.

Answer

Implement a security awareness training program

Answer

Conduct a forensic analysis of the employees' workstations

Answer

Block the phishing domain at the web proxy

Question 14

Which TWO of the following are best practices for preserving digital evidence during an incident? (Select exactly 2)

Accepted Answer

Create a forensic image of the hard drive using a write blocker. Creating a forensic image with a write blocker (Option A) is a best practice because it captures an exact bit-for-bit copy of the storage media without altering the original data. The write blocker intercepts write commands at the hardware or software level, ensuring the integrity of the evidence. This preserves the original state for later analysis and admissibility in legal proceedings.

Answer

Interview witnesses before collecting data

Answer

Run antivirus scans on the affected system

Answer

Reboot the system to clear memory

Question 15

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Accepted Answer

Risk scenarios with likelihood and impact ratings. Risk scenarios with likelihood and impact ratings are a core component of a risk assessment report because they provide a structured narrative of how a threat could exploit a vulnerability, enabling the organization to prioritize risks based on quantitative or qualitative measures. This aligns with ISACA's best practices for risk communication, ensuring decision-makers understand the potential business impact.

Answer

Vendor security assessment ratings

Answer

Detailed results of control testing

Answer

Complete asset inventory