CISM Practice Test 32 — 15 Questions

Question 1

Based on the exhibit, what is the MOST appropriate next step for the information security manager?

Accepted Answer

Recommend implementing multifactor authentication to reduce the risk. Multifactor authentication (MFA) directly mitigates the most likely attack vector for the identified risk—credential theft or brute-force attacks—by requiring a second factor (e.g., a one-time password from a hardware token or biometric) in addition to the password. Since the exhibit (not shown) indicates a moderate likelihood but high impact, implementing MFA reduces the likelihood to a more acceptable level without requiring a change in risk appetite or transferring the risk. This aligns with the CISM principle of applying cost-effective controls to reduce residual risk to within the organization's risk tolerance.

Answer

Accept the risk because the likelihood is only moderate

Answer

Reassess the risk with a higher risk appetite threshold

Answer

Transfer the risk by purchasing cyber insurance

Question 2

A multinational corporation is establishing an information security governance framework. The board has approved a top-down approach where security policies are created at the corporate level and adapted locally. Which of the following is a key benefit of this approach?

Accepted Answer

It ensures a consistent baseline of security controls while allowing for local regulatory adjustments.. A top-down governance approach ensures that a consistent baseline of security controls is mandated at the corporate level, which is critical for managing risk across a multinational enterprise. By allowing local adaptation, the framework can incorporate region-specific legal requirements (e.g., GDPR in Europe, CCPA in California) without deviating from the core security posture. This balance between uniformity and flexibility is the primary benefit, as it prevents fragmented security while respecting jurisdictional mandates.

Answer

It allows each subsidiary to develop security policies that best fit their local legal environment.

Answer

It reduces the time required to implement security policies across the entire organization.

Answer

It minimizes the need for local security teams to understand the corporate strategy.

Question 3

Given the exhibit output from a web server, which connection is MOST suspicious and likely indicates a command-and-control (C2) channel?

Accepted Answer

Connection to 203.0.113.5:44333. Connection to 203.0.113.5:44333 is the most suspicious because it uses a non-standard high port (44333) to an external IP address, which is a common technique for C2 traffic to evade detection by blending with HTTPS-like traffic. Legitimate web servers typically connect to well-known ports (e.g., 80, 443) or internal services, not arbitrary external high ports. The exhibit likely shows a netstat output where this outbound connection to an external IP on an unusual port stands out as anomalous.

Answer

Connection to 10.0.0.1:54321

Answer

The listening socket on port 443

Answer

Connection to 10.0.0.2:54322

Question 4

Which TWO of the following are key responsibilities of an information security governance committee?

Accepted Answer

Approve major changes to information security policies.. The information security governance committee is a high-level body responsible for strategic oversight. Approving major changes to information security policies (Option C) is a core governance function, ensuring that policy updates align with business objectives and regulatory requirements before implementation. This is distinct from operational tasks like vulnerability assessments or daily monitoring.

Answer

Perform vulnerability assessments on critical systems.

Answer

Set the organization's risk appetite.

Answer

Conduct daily monitoring of security events.

Question 5

Based on the SIEM alert exhibit, which immediate action should the incident responder take?

Accepted Answer

Lock the user account 'jsmith'. The SIEM alert indicates a successful brute-force login from source IP 10.0.0.55 to the destination server using the account 'jsmith'. Locking the user account immediately stops the attacker from further exploiting the compromised credentials, which is the most direct containment action. Blocking the IP alone would not prevent re-authentication if the attacker switches IPs, and contacting the user wastes critical time during an active incident.

Answer

Block the source IP 10.0.0.55 at the firewall

Answer

Increase logging level for the destination server

Answer

Contact the user 'jsmith' to verify activity

Question 6

Which TWO of the following are essential components of an information security governance framework according to ISACA's COBIT?

Accepted Answer

Value delivery. Value delivery is a core component of ISACA's COBIT framework for information security governance, as it ensures that security investments directly support business objectives and provide measurable benefits. COBIT defines value delivery as the process of optimizing security-related costs while maximizing the return on investment through effective risk management and resource allocation. This aligns with the governance objective of balancing value creation with risk mitigation.

Answer

Performance measurement

Answer

Incident response playbook

Answer

Firewall configuration

Question 7

Arrange the steps for deploying a security patch to critical servers in a production environment.

Accepted Answer

First identify and assess the patch, then test it in a non-production environment, then backup critical systems and data, then deploy the patch to production, and finally verify the patch installation and system functionality.. Patch management involves identification, testing, backup, deployment, and verification.

Answer

First identify and assess the patch, then backup critical systems, then test the patch in non-production, then deploy, then verify.

Answer

First identify and assess the patch, then test, then deploy, then backup, then verify.

Answer

First identify, then test, then verify, then backup, then deploy.

Question 8

An organization's incident response plan includes a call tree. During an incident, the primary contact is unreachable. What should happen?

Accepted Answer

Move to the next person in the call tree. A call tree is designed to ensure rapid, sequential notification during an incident. If the primary contact is unreachable, the plan should automatically move to the next person in the call tree to maintain the speed and reliability of the notification process. This avoids delays that could compromise incident response SLAs.

Answer

Escalate to senior management

Answer

Use a different communication method like email

Answer

Wait for the primary to become available

Question 9

You are the IT governance officer at a regional bank with 1,200 employees. The bank has a security policy that requires annual security awareness training for all staff. However, the compliance rate is only 60%. The board is concerned about regulatory risk and wants to improve compliance. The current training is a generic online module that takes 30 minutes to complete. Employees complain that the training is boring and not relevant to their roles. The training is managed by the HR department, which sends reminders but does not enforce consequences. Which of the following is the BEST course of action to improve training compliance and governance?

Accepted Answer

Redesign the training to be role-specific and mandate completion in the security governance framework with consequences for non-compliance.. It addresses both the root cause (irrelevant training) and the governance gap (lack of enforcement). By redesigning training to be role-specific, employees see direct relevance, which improves engagement and retention. Mandating completion within the security governance framework and attaching consequences (e.g., access revocation) creates accountability, directly driving compliance from 60% toward the board's target.

Answer

Outsource the training to a third-party provider.

Answer

Increase the frequency of reminder emails from monthly to weekly.

Answer

Implement a learning management system (LMS) to track completion.

Question 10

During incident response, a team discovers that a phishing email successfully compromised a user's credentials. Which containment strategy would BEST limit further damage?

Accepted Answer

Disable the user account. Disabling the user account immediately stops any ongoing misuse of the compromised credentials, preventing the attacker from accessing additional resources. Option A is correct.

Answer

Restore the user's system from a backup

Answer

Block the sender's IP address at the firewall

Answer

Change all user passwords

Question 11

Your organization is a multinational corporation with a hybrid cloud infrastructure, including on-premises data centers and AWS, Azure, and GCP environments. You have a distributed incident response team and a central SIEM that aggregates logs from all sources. You are the incident manager on duty when an alert fires indicating that a high-privilege user account (a domain admin) has been observed logging in from an IP address in a country where the company has no operations, at 3:00 AM local time. Subsequent investigation reveals that the same account also has a successful logon from the corporate headquarters at the same time, which is geographically impossible. The SIEM shows a single event for the suspicious logon, and no other indicators of compromise are present. The account has not been used for months. What is the BEST course of action?

Accepted Answer

Immediately disable the account and reset the password, then begin a forensic investigation to determine the scope of compromise.. The simultaneous logon from two geographically impossible locations indicates a classic credential theft and replay attack, likely using a pass-the-hash or token theft technique. Disabling the account and resetting the password immediately stops the attacker's access, which is the highest priority in incident response. A forensic investigation must follow to identify the attack vector (e.g., Kerberos ticket theft, LSASS dump) and assess the scope of compromise, as the absence of other indicators does not rule out lateral movement or persistence.

Answer

Restore the domain controller from a recent backup to ensure any malware is removed.

Answer

Contact the employee who owns the account to ask if they recently traveled or used a VPN.

Answer

Ignore the alert as it is likely a false positive due to SIEM misconfiguration or time zone discrepancy.

Question 12

During an incident, the response team collects volatile data from a compromised server. Which of the following should be collected FIRST to minimize loss of evidence?

Accepted Answer

Contents of RAM. Volatile data, such as the contents of RAM, is lost when a system is powered off. The first priority during incident response is to capture this data because it contains running processes, network connections, encryption keys, and malware that exist only in memory. Collecting RAM first ensures that this critical evidence is preserved before any other actions that might alter the system state.

Answer

Contents of hard drive

Answer

Event logs

Answer

Network configuration

Question 13

An organization is developing an incident response plan. The CISO wants to ensure that the plan aligns with industry best practices. Which framework should the CISO use as a primary reference?

Accepted Answer

NIST SP 800-61. NIST SP 800-61 (Computer Security Incident Handling Guide) is the definitive U.S. government standard for incident response processes, covering preparation, detection, containment, eradication, and recovery. It provides detailed, step-by-step guidance for building an incident response plan, making it the primary reference for aligning with industry best practices.

Answer

ISO 31000

Answer

NIST Cybersecurity Framework

Answer

ITIL

Question 14

A company is considering outsourcing its security operations center (SOC). Which governance consideration is MOST critical before finalizing the decision?

Accepted Answer

The ability to maintain oversight and accountability for security outcomes.. Governance requires that the organization retains ultimate responsibility for security outcomes, even when functions are outsourced. Without the ability to maintain oversight and accountability, the company cannot ensure that its security posture aligns with business risk tolerance and regulatory compliance requirements. This is a fundamental principle of information security governance, as the board and senior management cannot delegate accountability.

Answer

The vendor's service level agreements (SLAs) for incident response times.

Answer

The vendor's technical expertise and certifications.

Answer

The cost savings compared to in-house operations.

Question 15

Which TWO are key indicators of a data breach? (Choose two.)

Accepted Answer

Unusual outbound network traffic. Unusual outbound network traffic is a key indicator of a data breach because it often signals data exfiltration, where an attacker is transferring stolen data to an external command-and-control (C2) server or a cloud storage endpoint. This traffic may involve unexpected protocols (e.g., DNS tunneling, HTTPS to unknown IPs) or large volumes of data leaving the network at odd hours, which can be detected by network traffic analysis tools like NetFlow or intrusion detection systems (IDS).

Answer

System performance degradation

Answer

Increased spam emails to the organization

Answer

Multiple failed login attempts from a single user