CISM Practice Test 33 — 15 Questions

Question 1

Which THREE of the following are essential roles in an effective information security governance structure? (Choose three.)

Accepted Answer

Board of directors.. The board of directors is essential because it holds ultimate accountability for the organization's risk posture and must approve the information security strategy, policies, and resource allocation. Without board-level oversight, security governance lacks the authority to enforce compliance and align security objectives with business goals. This aligns with the CISM framework's emphasis on top-down governance, where the board provides strategic direction and ensures adequate funding for security initiatives.

Answer

Help desk manager.

Answer

Network administrator.

Question 2

An organization has decided to adopt a risk-based approach to information security. What is the FIRST step the information security manager should take to implement this approach?

Accepted Answer

Identify and assess information assets and their associated threats and vulnerabilities.. The first step in implementing a risk-based approach is to identify and assess information assets along with their associated threats and vulnerabilities. This foundational activity provides the necessary context for all subsequent risk management decisions, including defining risk appetite, selecting a framework, and implementing controls. Without a clear understanding of what assets exist and what risks they face, any further steps would be based on assumptions rather than evidence.

Answer

Define the organization's risk appetite and risk tolerance levels.

Answer

Implement security controls based on industry best practices.

Answer

Select a risk management framework such as ISO 31000 or NIST RMF.

Question 3

An organization's incident response team is conducting a lessons learned meeting after a major incident. Which outcome is MOST critical to document?

Accepted Answer

Root cause analysis. The root cause analysis is the most critical outcome to document because it identifies the underlying technical failure that allowed the incident to occur, enabling the organization to implement permanent corrective actions. Without a documented root cause, the incident response process cannot transition from containment to prevention, and the organization risks repeating the same failure. In CISM's Incident Management domain, the lessons learned phase specifically aims to improve future response capability by addressing systemic weaknesses, which requires a clear understanding of why the incident happened.

Answer

Detailed timeline of events

Answer

List of tools used

Answer

Total cost of the incident

Question 4

Based on the exhibit, which of the following is the MOST likely attack vector?

Accepted Answer

Privilege escalation via a compromised account. The exhibit shows a user account with administrative privileges being used from an unusual geographic location at an anomalous time, followed by lateral movement to a domain controller. This pattern indicates that the initial access was gained through a compromised account, which was then leveraged for privilege escalation to move laterally and access sensitive systems. The attack vector is the misuse of valid credentials, not an injection or social engineering attack.

Answer

SQL injection attack

Answer

Phishing email with malicious attachment

Answer

Denial of service attack

Question 5

During a risk assessment, an organization identifies a critical vulnerability in a legacy system that cannot be patched. The system's availability is crucial for business operations. Which of the following risk treatment strategies is MOST appropriate?

Accepted Answer

Risk acceptance with formal sign-off by senior management. When a critical vulnerability cannot be patched and the system must remain available for business operations, risk acceptance is the most appropriate strategy because it formally acknowledges the residual risk after all feasible controls have been considered. Senior management sign-off is required because the risk exceeds the organization's risk appetite, and acceptance documents the decision to operate with the known vulnerability. This approach aligns with the CISM principle that risk acceptance is a valid treatment when the cost of other treatments exceeds the benefit or when no other treatment is feasible.

Answer

Risk mitigation by implementing compensating controls

Answer

Risk transfer through cyber insurance

Answer

Risk avoidance by decommissioning the system

Question 6

An organization has implemented a new security policy requiring multi-factor authentication for all remote access. Several users complain about the inconvenience. What is the BEST course of action for the security manager?

Accepted Answer

Provide training on the importance of MFA. Providing training helps users understand the necessity of MFA for security, addressing their concerns and gaining buy-in. Allowing exceptions (A) weakens security, delaying implementation (B) postpones protection, and revoking access (C) is too punitive as a first step.

Answer

Allow exceptions for senior executives

Answer

Delay implementation until user acceptance improves

Answer

Revoke remote access for non-compliant users

Question 7

A multinational corporation has just detected a ransomware attack that encrypted critical files on a file server. The incident response team has been activated. Which of the following should be the FIRST action taken by the team?

Accepted Answer

Isolate the affected systems from the network. The first priority in ransomware incident response is containment to prevent the encryption from spreading to other systems. Isolating the affected file server from the network (e.g., disabling the network interface or disconnecting the cable) stops the ransomware from communicating with its command-and-control server and encrypting additional shares. This aligns with the NIST SP 800-61 containment strategy and ensures that the incident response team can safely preserve forensic evidence before any remediation.

Answer

Restore encrypted files from backup

Answer

Reboot the file server to clear the encryption

Answer

Notify law enforcement

Question 8

An incident has been declared as P2 (high severity). According to the incident classification, what is the expected response timeframe and notification requirement?

Accepted Answer

Management notification and response during business hours.. P2 incidents require management notification and response during business hours.

Answer

Scheduled remediation with minimal notification.

Answer

Standard response with no specific notification.

Answer

Executive notification and 24/7 response.

Question 9

What is the primary function of a Security Operations Center (SOC)?

Accepted Answer

Continuous monitoring, detection, and response to security threats. A SOC is responsible for monitoring, detecting, and responding to security incidents.

Answer

Designing the security architecture

Answer

Developing security policies and standards

Answer

Conducting security awareness training

Question 10

A security manager is selecting controls for a new application. Which TWO controls are most important to include in a defense-in-depth strategy? (Select TWO)

Accepted Answer

Role-based access control (RBAC) with least privilege. Defense-in-depth requires multiple layers; input validation prevents injection attacks, and access control ensures least privilege.

Answer

Weekly vulnerability scans

Answer

Single sign-on (SSO) implementation

Answer

Encryption of data at rest

Question 11

During an incident investigation, the team discovers that a compromised account was used to exfiltrate data. Which of the following should the team do NEXT?

Accepted Answer

Determine the scope of the breach by analyzing accessed resources.. The immediate priority after discovering a compromised account is to determine the scope of the breach by analyzing which resources the account accessed. This involves reviewing authentication logs, file access records, and data transfer logs to identify the extent of data exfiltration and potential lateral movement. Without this analysis, the team cannot contain the incident effectively or understand what data was compromised, which is a fundamental step in incident response per NIST SP 800-61.

Answer

Reset the password and re-enable the account immediately.

Answer

Notify the affected users and customers.

Answer

Delete the compromised account from the system.

Question 12

An organization's incident response plan (IRP) is being updated. Which stakeholder should be included in the IRP development to ensure legal and regulatory requirements are met?

Accepted Answer

Legal counsel. Legal counsel ensures the plan complies with relevant laws and regulations, such as breach notification requirements. The CISO (A) oversees security but may not have legal expertise. IT manager (B) focuses on technical aspects. External auditors (D) are not typically involved in plan development.

Answer

External auditors

Answer

Chief Information Security Officer (CISO)

Answer

IT manager

Question 13

A user reports that their computer is behaving oddly, and an IT technician finds a suspicious file in the startup folder. The technician is not sure if this is an incident. What should the technician do FIRST?

Accepted Answer

Escalate to the security team. When unsure, the best practice is to escalate to the security team to investigate further. Deleting the file could destroy evidence, and scanning may not be sufficient. Option B is correct.

Answer

Document the findings and continue monitoring

Answer

Run an antivirus scan

Answer

Delete the suspicious file

Question 14

A small business without a dedicated incident response team experiences a suspected breach. Who should be primarily responsible for leading the incident response efforts?

Accepted Answer

The external cybersecurity consultant on retainer.. In a small business lacking a dedicated incident response team, the external cybersecurity consultant on retainer (Option C) is the most appropriate leader because they possess the specialized expertise, tools, and experience required to manage the technical aspects of incident response, such as forensic analysis, containment, and eradication. The consultant can provide an objective, skilled response without the conflicts of interest or lack of training that internal staff may have, ensuring adherence to industry frameworks like NIST SP 800-61 or SANS PICERL.

Answer

The CEO of the company.

Answer

The IT administrator who discovered the breach.

Answer

The legal counsel.

Question 15

An organization's IR plan is tested annually. After a test, many gaps are identified. What is the best next step?

Accepted Answer

Update the IR plan based on lessons learned and schedule a follow-up test. Updating the plan based on lessons learned and scheduling a follow-up test improves preparedness.

Answer

Train all employees on the plan

Answer

Wait for the next scheduled test in one year

Answer

Purchase additional security tools