CISM Practice Test 31 — 15 Questions

Question 1

A company is assessing nth-party risk from a critical cloud provider. Which approach should be taken to manage this risk effectively?

Accepted Answer

Require the cloud provider to contractually manage and report on their subcontractors. The correct approach is to require the cloud provider to contractually manage and report on their subcontractors. Under CISM's governance principles, an organization cannot feasibly audit every nth-party (subcontractor) directly, so it must extend its risk management through contractual flow-down clauses. This ensures the provider assumes responsibility for vetting, monitoring, and reporting on its own supply chain, giving the customer visibility and accountability without overstepping operational boundaries.

Answer

Replace the cloud provider with an in-house solution

Answer

Conduct a direct audit of the provider's subcontractors

Answer

Ignore nth-party risk as it is out of scope

Question 2

During an incident, the incident response team determines that a compromised account was used to exfiltrate data. The account has been disabled. What is the NEXT best action to prevent similar incidents?

Accepted Answer

Perform a root cause analysis. Performing a root cause analysis (RCA) is the next best action because it systematically identifies the underlying vulnerability or control weakness that allowed the account compromise. Without understanding how the attacker gained access—whether through phishing, credential stuffing, or a software vulnerability—simply disabling the account does not prevent recurrence. The RCA will inform targeted remediation, such as patching, policy changes, or implementing multi-factor authentication (MFA).

Answer

Notify potentially affected customers

Answer

Reset passwords for all user accounts

Answer

Review authentication logs for other anomalies

Question 3

During a post-incident review, the incident response team identifies that the root cause of a data breach was a misconfigured firewall rule that allowed unrestricted inbound access from the internet. Which corrective action BEST addresses this issue?

Accepted Answer

Implement a change management process for firewall modifications. The root cause was a misconfigured firewall rule that allowed unrestricted inbound access. The best corrective action is to implement a change management process for firewall modifications, ensuring all future changes are reviewed, approved, and tested before implementation. This prevents recurrence by addressing the systemic gap in change control.

Answer

Increase the frequency of penetration tests

Answer

Conduct a one-time review of all firewall rules

Answer

Restore the firewall configuration from the last known good backup

Question 4

Based on the exhibit, what is the MOST likely issue?

Accepted Answer

A system is infected with malware that is beaconing to a command and control server.. The exhibit likely shows network traffic with periodic connections to an external IP address, which is characteristic of malware beaconing to a command and control (C2) server. Beaconing typically involves regular, small outbound connections at fixed intervals, often to a specific IP or domain. Streaming video would show high bandwidth usage to a known streaming service. Software updates would be sporadic and to legitimate update servers. A network scan from an internal IP would show many outbound connection attempts to multiple IPs, not periodic beaconing.

Answer

A user is streaming video from a legitimate site.

Answer

A software update is being downloaded from an external site.

Answer

A network scan is being performed from the internal IP.

Question 5

A multinational corporation experiences a security breach involving customer PII. The incident response team needs to determine notification requirements. Which factor is MOST important in deciding which regulatory bodies to inform?

Accepted Answer

Location of the affected individuals. Data privacy regulations (e.g., GDPR, CCPA, LGPD) base their notification requirements on the residency or location of the affected data subjects, not on where the breach originated or where the company's executives sit. The incident response team must map the affected PII to the specific jurisdictions whose laws impose breach notification duties, making the location of the affected individuals the primary driver for determining which regulatory bodies to inform.

Answer

Location of the attacker

Answer

Location of the company's CIO

Answer

Location of the data custodian

Question 6

Which TWO elements are key components of a security culture measurement program?

Accepted Answer

Phishing simulation click rates. A security culture measurement program focuses on gauging how people think and behave regarding security, so phishing simulation click rates (C) are a key component because they provide a behavioral metric of how susceptible employees are to real-world social-engineering attacks. Training completion rates (E) are also a key component because they measure the reach and engagement of security awareness education, which is a foundational driver of culture. The other options are technical or volume-based operational metrics rather than culture indicators: the number of security policies (A) reflects documentation, not employee mindset; vulnerability scan frequency (B) is a vulnerability-management cadence metric; and firewall log size (D) is a raw technical/logging volume measure, none of which directly assess human security attitudes or behaviors.

Answer

Number of security policies

Answer

Vulnerability scan frequency

Answer

Firewall log size

Question 7

Which TWO of the following are typical notification deadlines for regulatory reporting of a data breach? (Select two.)

Accepted Answer

4 business days (SEC proposed). Option A (4 business days, SEC proposed) is correct because the U.S. Securities and Exchange Commission's proposed rules for public companies would require disclosure of material cybersecurity incidents on Form 8-K within four business days of determining that the incident is material. Option C (72 hours, GDPR) is correct because Article 33 of the EU General Data Protection Regulation requires controllers to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it. The remaining options do not match these regulatory frameworks: 30 days (B) is not the standard GDPR or SEC notification deadline, 7 days (D) is not specified by either regime, and 24 hours (E) is a shorter window than either the SEC's four-business-day or GDPR's 72-hour requirement.

Answer

30 days

Answer

7 days

Answer

24 hours

Question 8

A CISO is designing a security scorecard for the board of directors. Which metric is most appropriate to include for a one-page executive dashboard?

Accepted Answer

Percentage of systems patched within SLA. The board needs high-level, strategic metrics. Percentage of systems patched within SLA provides a clear, concise view of vulnerability management status, which is critical for risk reduction.

Answer

Detailed list of known vulnerabilities

Answer

Number of phishing simulations conducted

Answer

Names of vendors with critical findings

Question 9

A financial services firm is subject to SOX, PCI DSS, and GDPR. The CISO needs to implement a regulatory change management process. Which THREE steps are essential?

Accepted Answer

Assess impact on existing controls. Option A (Assess impact on existing controls) is correct because a regulatory change management process must first perform a gap analysis to determine how new or amended SOX, PCI DSS, and GDPR requirements affect the firm's current control environment, including whether existing PCI DSS requirements or SOX ITGC controls still satisfy the new obligations. Option D (Monitor regulatory updates from authorities) is correct because the process must continuously track publications from bodies such as the SEC (SOX), the PCI Security Standards Council (PCI DSS), and EU supervisory authorities/EDPB (GDPR) to detect changes in time. Option E (Update policies and controls accordingly) is correct because once impact is assessed, the firm must revise its policies, procedures, and technical controls and then validate them through testing to maintain compliance. Option B is incorrect because enforcing all changes immediately regardless of cost ignores risk-based prioritization, budgeting, and change management discipline. Option C is incorrect because outsourcing compliance to a single vendor does not transfer regulatory accountability and creates concentration risk, so it is not an essential step.

Answer

Immediately enforce all changes regardless of cost

Answer

Outsource compliance to a single vendor

Question 10

An information security program must include elements to ensure continuous improvement. Which TWO of the following are MOST essential for continuous improvement?

Accepted Answer

Annual risk assessment. Annual risk assessments are essential for continuous improvement because they systematically identify, evaluate, and prioritize changes in the threat landscape, business objectives, and regulatory requirements. This process ensures the information security program adapts to new risks and aligns with organizational goals, driving iterative enhancements. Without a periodic risk assessment, the program would lack a data-driven foundation for prioritizing improvements.

Answer

Quarterly board meetings

Answer

Monthly patching

Answer

Regular security awareness training

Question 11

An organization wants to ensure that its security program aligns with business objectives. Which activity is most important?

Accepted Answer

Regularly meeting with business unit leaders to understand needs and risks.. Regularly meeting with business unit leaders to understand needs and risks is the most important activity because it ensures the security program is directly aligned with business objectives, risk appetite, and operational priorities. This engagement allows the CISO to perform a business impact analysis (BIA) and integrate security controls that support strategic goals rather than operating in isolation. Without this alignment, even technically sound security measures may be rejected or underfunded by leadership.

Answer

Conducting vulnerability scans twice a year.

Answer

Developing a security awareness campaign.

Answer

Purchasing an advanced threat detection system.

Question 12

Which security team role is primarily responsible for defining and maintaining security architecture standards?

Accepted Answer

Security architect. The security architect is the role responsible for defining and maintaining security architecture standards, including reference architectures, control frameworks, and design patterns. This role translates business and risk requirements into technical standards that other teams implement.

Answer

GRC analyst

Answer

Security analyst

Answer

Penetration tester

Question 13

A multinational corporation is implementing an information security governance framework. The board has requested a mechanism to ensure that security investments align with business objectives. Which of the following is the BEST approach to achieve this alignment?

Accepted Answer

Develop a risk-based prioritization framework linking security initiatives to business risk appetite.. A risk-based prioritization framework directly maps security initiatives to the organization's risk appetite, ensuring that investments target the most critical business risks. This aligns with the CISM principle that governance must link security activities to business objectives through risk management, not through arbitrary cost-cutting or blanket compliance.

Answer

Minimize security spending to maximize ROI.

Answer

Adopt a best-practice framework such as NIST CSF and implement all controls.

Answer

Focus on regulatory compliance to ensure legal requirements are met.

Question 14

A multinational corporation is expanding its cloud infrastructure across multiple regions. The risk team has identified that the shared responsibility model for cloud security is not well understood by business units. After a recent audit, several misconfigurations led to a data exposure incident that affected one region. The CISO wants to implement a risk management program that ensures consistent control across all regions. As the risk manager, what is the most effective course of action to reduce the risk of similar incidents?

Accepted Answer

Develop and enforce cloud security baseline standards and conduct regular compliance audits.. Developing and enforcing cloud security baseline standards with regular compliance audits directly addresses the root cause: inconsistent controls and misconfigurations across regions. This proactive risk management approach ensures all business units adhere to a unified security posture, reducing the likelihood of data exposure incidents. It aligns with the CISM domain of risk management and control.

Answer

Transfer the risk to cloud providers by renegotiating contracts to include liability clauses.

Answer

Implement a cloud access security broker (CASB) to monitor all cloud activities centrally.

Answer

Accept the risk as inherent to cloud adoption and focus resources on incident response.

Question 15

After a phishing attack, an organization's incident response team identifies that the attacker gained access to an email account and sent internal spear-phishing emails. What is the BEST immediate containment action?

Accepted Answer

Disable the compromised account. Disabling the compromised account immediately stops the attacker from using the authenticated session to send further internal spear-phishing emails. This containment action directly cuts off the attacker's foothold within the email system, preventing lateral movement and further compromise of other users. It is the fastest way to halt the ongoing attack without disrupting the entire user base.

Answer

Reset all user passwords

Answer

Block the attacker's IP address at the firewall

Answer

Increase email filtering rules