CISM Practice Test 32 — 15 Questions

Question 1

A CISO at a healthcare payer is revising the incident response plan after a tabletop exercise exposed confusion about who may commit the organization to public statements and remediation costs during a major breach. The board wants clarity on governance-level decision rights that must exist before the next incident. Which TWO activities should be assigned to the crisis management team rather than to the tactical incident response team? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorizing external legal counsel engagement and regulatory disclosure strategy. The crisis management team exists to make strategic, enterprise-wide decisions that tactical responders lack the authority to make. Authorizing legal counsel and disclosure strategy commits the organization externally, while approving continuity activation and recovery prioritization allocates business resources across functions. Both require executive judgment about legal exposure, reputation, and operational trade-offs. Host forensics, SIEM tuning, and ticket logging are operational execution tasks that remain with the tactical incident response and security operations teams.

Answer

Isolating affected network segments and collecting volatile memory from compromised hosts

Answer

Tuning SIEM correlation rules to reduce false positives from the newly deployed endpoint agent

Answer

Updating the incident ticketing system with containment timestamps for each affected host

Question 2

Which TWO of the following are key components of an information security governance framework? (Choose two.)

Accepted Answer

Security policy and standards.. Security policy and standards are foundational components of an information security governance framework because they establish the high-level direction, principles, and mandatory requirements that guide the organization's security posture. The risk management process is equally critical as it provides a structured methodology for identifying, assessing, and treating risks, ensuring that security decisions are aligned with business objectives and risk appetite. Together, they form the strategic and operational backbone of governance, enabling accountability and continuous improvement.

Answer

Intrusion detection system (IDS) configuration.

Answer

Firewall rule set.

Answer

Payment Card Industry Data Security Standard (PCI DSS) compliance report.

Question 3

A CISO is preparing a business case for a new security investment. Which TWO elements are most important to include to justify the investment?

Accepted Answer

Breach cost avoidance based on industry benchmarks. Option A (Breach cost avoidance based on industry benchmarks) is correct because a business case must translate security spending into financial terms executives understand, and using industry benchmarks such as the IBM/Ponemon Cost of a Data Breach figures quantifies the potential loss avoided, directly justifying the investment's ROI. Option D (Risk reduction value) is correct because it expresses how the investment lowers the probability and/or impact of threats, typically through quantified risk exposure (ALE = SLE × ARO) or residual-risk reduction, which is the core justification for any security control. Options B, C, and E are not primary justification elements: vendor reputation is a selection criterion rather than a financial or risk rationale, ease of implementation affects project feasibility but not the value proposition, and the number of security team members is a resourcing detail that does not by itself demonstrate business value.

Answer

Vendor reputation

Answer

Ease of implementation

Answer

Number of security team members

Question 4

A CISO is deciding on the organizational structure for the information security team. Which reporting structure is most likely to ensure the security function has sufficient independence and authority?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board of directors ensures the information security function operates independently from operational and IT management, preventing conflicts of interest where security decisions could be overridden by cost or performance pressures. This structure aligns with the CISM principle that the CISO must have sufficient authority to enforce security policies across the entire organization without reporting to a function that may prioritize other objectives over security.

Answer

Reporting to the Chief Information Officer (CIO)

Answer

Reporting to the Chief Operating Officer (COO)

Answer

Reporting to the Chief Financial Officer (CFO)

Question 5

What is the primary purpose of a security incident near-miss reporting culture?

Accepted Answer

To identify and address security gaps proactively. A near-miss reporting culture encourages employees to report events that could have caused harm but did not, so the organisation can analyse root causes and close gaps before a real incident occurs. It is fundamentally proactive: it surfaces latent weaknesses in controls, processes, and human factors. Blame-free reporting is essential because fear of punishment suppresses disclosure and destroys the data needed for improvement.

Answer

To increase the security budget

Answer

To reduce the number of security policies

Answer

To assign blame for potential incidents

Question 6

An organization is designing a security operations center (SOC). Which of the following functions is PRIMARILY responsible for analyzing alerts and determining if they represent genuine threats?

Accepted Answer

Security Analyst. The Security Analyst (often Tier 1 or Tier 2) is primarily responsible for monitoring alerts, triaging them, and determining whether they represent genuine threats. This role performs the initial analysis and escalates confirmed incidents to incident responders. The SOC Manager oversees operations, the Security Architect designs controls, and the Incident Responder handles confirmed incidents.

Answer

SOC Manager

Answer

Security Architect

Answer

Incident Responder

Question 7

Which of the following is a leading indicator for security performance?

Accepted Answer

Patch compliance percentage. Leading indicators are proactive measures that predict future performance. Patch compliance is a leading indicator because it shows current security posture that influences future incidents.

Answer

Mean time to recover (MTTR)

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 8

Which TWO of the following are primary responsibilities of the board of directors with regard to information security governance? (Select exactly two.)

Accepted Answer

Ensuring security strategy aligns with business goals. Option C is correct because the board of directors is responsible for governance, which means ensuring that the organization's information security strategy is aligned with and supports the overall business goals and objectives. Option D is correct because setting and approving the organization's risk appetite—the amount and type of risk it is willing to accept—is a core governance responsibility that belongs to the board, which then guides management's security decisions. Options A, B, and E are incorrect because performing vulnerability scans, implementing security controls, and conducting daily security monitoring are operational, hands-on tasks carried out by security practitioners and management, not by the board of directors.

Answer

Performing vulnerability scans

Answer

Implementing security controls

Answer

Conducting daily security monitoring

Question 9

During an incident investigation, the incident response team needs to collect volatile data from a compromised server. Which of the following data should be collected FIRST?

Accepted Answer

Contents of system memory (RAM). Volatile data, such as the contents of system memory (RAM), is lost when the system is powered off. Collecting RAM first preserves evidence of running processes, network connections, and encryption keys that would otherwise be destroyed. This follows the order of volatility (RFC 3227), which mandates capturing the most volatile data first.

Answer

Network connection logs from the firewall

Answer

Contents of the hard drive

Answer

Event logs from the system

Question 10

An organization's information security governance committee has not met for the past six months. Which of the following is the most significant risk associated with this situation?

Accepted Answer

Lack of oversight leading to misalignment with business strategy. The governance committee's failure to meet for six months directly undermines the strategic alignment of security initiatives with business objectives. Without regular oversight, security investments and priorities may drift from the organization's risk appetite and strategic goals, leading to misallocation of resources and increased exposure to unmanaged risks. This misalignment is the most significant risk because it affects the entire security program's effectiveness and long-term viability.

Answer

Increased operational costs due to uncoordinated security investments

Answer

Regulatory fines from noncompliance

Answer

Delayed response to security incidents

Question 11

During a P1 incident, the incident response team identifies that the root cause is a misconfigured firewall. According to best practices, which of the following should be the PRIMARY focus of the root cause analysis?

Accepted Answer

Determining why the firewall was misconfigured and why the change management process failed. Root cause analysis should identify not only the technical cause but also the process and management failures that allowed the misconfiguration to occur.

Answer

Patching the firewall immediately

Answer

Conducting a lessons learned meeting immediately

Answer

Restoring the firewall from backup

Question 12

An organization is deciding whether to adopt a centralized or hybrid security governance model. Which factor MOST strongly favors a hybrid model?

Accepted Answer

High degree of autonomy needed by business units with diverse needs. A hybrid security governance model combines centralized standards and oversight with decentralized execution, making it most appropriate when business units need a high degree of autonomy to address diverse needs (e.g., different regulatory regimes, customer segments, or technology stacks). The hybrid model lets the center set baseline policies and risk appetite while allowing units to tailor controls to their specific contexts. This balance is the strongest argument for adopting hybrid over fully centralized or fully decentralized models.

Answer

Minimal security budget

Answer

Low regulatory requirements

Answer

Uniform security across all business units

Question 13

Which component of the incident response programme provides step-by-step technical instructions for handling a specific type of security incident?

Accepted Answer

Incident response playbook. C is correct because an incident response playbook provides detailed, step-by-step technical instructions for handling a specific type of security incident (e.g., ransomware, DDoS, phishing). Unlike the higher-level incident response plan, a playbook contains precise technical actions, such as commands to isolate a host, indicators of compromise (IOCs) to block, and escalation criteria tailored to a particular threat.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication templates

Question 14

You are the CISM for a mid-sized e-commerce company that processes credit card transactions. The company recently experienced a security incident where an attacker exploited a vulnerability in the web application to gain access to the customer database containing payment card information. The incident response team contained the breach, but the root cause analysis revealed that the vulnerability had been identified in a penetration test six months ago but was not remediated due to competing priorities. The company's risk management framework defines risk appetite as 'moderate' for information security risks. The board is concerned and has asked you to recommend improvements to prevent recurrence. The company has a limited budget and cannot implement all possible controls. Current environment: web application developed in-house, hosted on-premises, with a mix of virtual and physical servers. The security team consists of three people responsible for monitoring, incident response, and vulnerability management. The development team follows an agile methodology with bi-weekly sprints. The company has cyber liability insurance that covers breach response costs up to $2 million. Based on this scenario, what is the most effective course of action?

Accepted Answer

Implement a formal vulnerability management program with defined remediation SLAs based on risk severity.. A formal vulnerability management program with defined remediation SLAs directly addresses the root cause: the known vulnerability was not patched due to competing priorities. By tying remediation timelines to risk severity (e.g., critical vulnerabilities patched within 7 days, high within 30 days), the company operationalizes its 'moderate' risk appetite and ensures that penetration test findings are acted upon before they can be exploited. This is the most cost-effective approach given the limited budget, as it leverages existing staff and processes rather than requiring new hires or expensive rewrites.

Answer

Hire two additional security analysts to improve monitoring and incident response.

Answer

Increase cyber liability insurance coverage to $5 million to cover potential breach costs.

Answer

Rewrite the web application using a secure development framework to eliminate vulnerabilities.

Question 15

Which TWO of the following are typically considered key components of an information security governance framework?

Accepted Answer

Adoption of a formal risk management process. Option A (adoption of a formal risk management process) is correct because governance frameworks such as ISO/IEC 27001 and COBIT require an ongoing, structured risk management process to identify, assess, treat, and monitor information security risks, providing the decision-making foundation that governance bodies use to align security with business objectives. Option C (establishment of a performance measurement system) is correct because governance depends on metrics, KPIs, and reporting mechanisms (e.g., COBIT's performance management domain) to monitor whether security controls and objectives are effective and to hold management accountable. The unmarked options do not belong because scheduling regular penetration tests (B), developing a detailed incident response plan (D), and implementing specific technical controls (E) are operational, tactical activities executed under the governance framework rather than components of the governance framework itself.

Answer

Scheduling of regular penetration tests

Answer

Development of a detailed incident response plan

Answer

Implementation of specific technical controls