CISM Practice Test 33 — 15 Questions

Question 1

An organization has a mature security program with documented policies and standards. However, during a recent audit, it was found that several business units are not following the mandated data classification standard. What is the MOST likely root cause?

Accepted Answer

Lack of enforcement mechanisms. The correct answer is B because a mature security program with documented policies and standards indicates that the classification rules are already defined. The audit finding that business units are not following the mandated standard points to a failure in enforcement mechanisms—such as automated Data Loss Prevention (DLP) rules, access control policies, or mandatory labeling in SharePoint—rather than a lack of awareness or outdated policy. Without enforcement (e.g., Group Policy Objects blocking unclassified data uploads or SIEM alerts for missing classification tags), even well-trained staff may bypass the standard.

Answer

Inadequate security awareness training

Answer

Outdated data classification policy

Answer

Insufficient budget for security tools

Question 2

A security audit has identified several governance weaknesses. Which TWO of the following are most likely to indicate a lack of effective information security governance? (Choose two.)

Accepted Answer

Risk assessments are not performed on a regular basis.. A is correct because regular risk assessments are a foundational requirement of information security governance, as they ensure that security controls remain aligned with evolving threats and business objectives. Without periodic risk assessments, the organization cannot demonstrate due diligence or maintain an accurate risk profile, which is a direct indicator of governance failure.

Answer

The information security policy is not available on the intranet.

Answer

Employees have not completed annual security awareness training.

Answer

Antivirus software is not updated on all endpoints.

Question 3

A large enterprise experiences a data breach involving personal identifiable information (PII) of customers. The incident response team has contained the breach and is now in the eradication phase. The CISO wants to ensure that the same vulnerability cannot be exploited again. Which action is MOST critical?

Accepted Answer

Patch the specific vulnerability identified.. Patching the specific vulnerability is the most critical action during the eradication phase because it permanently removes the root cause of the breach. Without this step, the same attack vector (e.g., an unpatched SQL injection flaw or a known CVE in a web server) remains exploitable, rendering containment efforts temporary. The CISO's goal to prevent recurrence directly requires eliminating the technical weakness, not just mitigating its symptoms.

Answer

Change all passwords of affected accounts.

Answer

Notify affected customers about the breach.

Answer

Deploy additional endpoint protection software.

Question 4

Which of the following is the PRIMARY role of the board of directors in information security governance?

Accepted Answer

Providing strategic direction and oversight of the security program.. The board of directors holds the ultimate fiduciary responsibility for the organization, including its information security posture. Their primary role is to provide strategic direction and oversight, ensuring that the security program aligns with business objectives, risk appetite, and regulatory requirements. This includes approving the overall security strategy, reviewing key risk indicators, and holding management accountable for security performance, not executing tactical tasks.

Answer

Managing the day-to-day security operations.

Answer

Implementing security controls and technologies.

Answer

Developing detailed security policies and procedures.

Question 5

During a merger, the acquiring company's CISO must integrate the security governance of the target company. The target company has no formal security governance. What is the FIRST step the CISO should take?

Accepted Answer

Perform a comprehensive risk assessment of the target company's security posture.. Without a formal security governance structure, the CISO must first understand the target company's current security posture through a comprehensive risk assessment. This step identifies vulnerabilities, threats, and gaps in controls, providing the baseline data needed to prioritize integration efforts and align with the acquirer's governance framework. Skipping this assessment risks implementing policies that are irrelevant or ineffective against the target's actual risks.

Answer

Conduct a security awareness training for the target company's employees.

Answer

Align the target company's security policies with the acquirer's policies.

Answer

Implement the acquirer's security governance framework immediately.

Question 6

Based on the incident response policy exhibit, which phase should include notifying external stakeholders such as law enforcement?

Accepted Answer

Post-Incident. B is correct because the post-incident phase is the appropriate time to notify external stakeholders such as law enforcement, as it occurs after containment and eradication are complete. During this phase, the incident is fully documented, evidence is preserved, and legal obligations (e.g., breach notification laws like GDPR Article 33 or HIPAA Breach Notification Rule) are fulfilled. Notifying law enforcement earlier could compromise forensic integrity or operational continuity, so it is deliberately deferred to the post-incident stage.

Answer

Recovery

Answer

Detection

Answer

Containment

Question 7

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select exactly three.)

Accepted Answer

Risk transfer (sharing). Option B is correct because ISO 31000 defines risk transfer (sharing) as a valid risk treatment option, where the risk is shifted to another party, such as through insurance or outsourcing. This is a standard approach in information security risk management to reduce the financial impact of a risk event.

Answer

Risk elimination

Answer

Risk deferral

Question 8

An organization's information security program has been operational for two years. The security manager is asked to propose changes to improve effectiveness. Which approach should the manager take first?

Accepted Answer

Conduct a maturity assessment of the current program.. Before making any changes, the security manager must first understand the current state of the program. A maturity assessment (e.g., using the CMMI or COBIT framework) evaluates the effectiveness, gaps, and capability levels of existing processes and controls. This baseline ensures that subsequent improvements are targeted and justified, rather than arbitrary or misaligned with the organization's actual needs.

Answer

Implement new security controls based on industry best practices.

Answer

Increase the security awareness training budget.

Answer

Revise the information security policy.

Question 9

Which of the following is the primary purpose of an Information Security Program?

Accepted Answer

To align security with business objectives and manage risk. The primary purpose of an Information Security Program is to align security initiatives with business objectives and manage risk to an acceptable level. While technology implementation, compliance, and risk elimination are components, they are means to the end of supporting the organization's mission and risk appetite. A program that does not align with business goals will lack executive support and fail to prioritize resources effectively.

Answer

To implement the latest security technologies

Answer

To comply with all applicable regulations

Answer

To eliminate all security risks

Question 10

You are the incident response manager for a multinational corporation that processes sensitive financial data. The company has a mature security operations center (SOC) that monitors network traffic, endpoints, and cloud services. At 2:00 AM local time, the SOC alerts you to a critical incident: an internal server (IP 10.10.10.50) is communicating with an external IP address (198.51.100.23) known to be associated with a ransomware group. The server hosts a financial database that is replicated to a secondary site every 6 hours. The last successful replication was at 1:00 AM. The SOC has already isolated the server from the network by blocking its outbound traffic at the firewall. However, the server is still running. The initial investigation suggests that the communication started 30 minutes ago. The database contains customer PII and transactional data. Your incident response plan includes steps for containment, eradication, recovery, and post-incident review. The CEO is being notified and expects a recommendation on the best course of action. The company has a cyber insurance policy that requires timely notification and preservation of evidence. The legal department advises that any action that could destroy evidence must be carefully considered. Which of the following is the BEST course of action?

Accepted Answer

Take a forensic image of the server's memory and disk for analysis, then rebuild the server from a known good backup.. Option A is correct because it balances forensic preservation (memory and disk imaging) with recovery from a known good backup, ensuring evidence is intact for legal and insurance requirements while restoring operations. The server is isolated, so imaging can be done safely without risk of further compromise, and the 1:00 AM backup (just one hour before the 2:00 AM communication started) is likely clean, minimizing data loss.

Answer

Reconnect the server to the network and attempt to negotiate with the attacker if ransomware is detected.

Answer

Immediately wipe the server and restore from the 1:00 AM backup to minimize downtime.

Answer

Leave the server isolated but running to monitor the attacker's actions and gather intelligence.

Question 11

An organization is conducting a risk assessment for a new cloud-based HR system. Which THREE of the following are key considerations when evaluating the inherent risk?

Accepted Answer

Likelihood of threat actors targeting the system. Inherent risk is the risk level before any security controls are applied. When evaluating inherent risk for a new cloud-based HR system, the likelihood of threat actors targeting the system (B) is a key factor because it directly influences the probability of a risk event occurring, independent of any existing or planned controls. This assessment considers the system's exposure, attractiveness to attackers, and the threat landscape specific to cloud HR platforms.

Answer

Organization's risk appetite

Answer

Effectiveness of existing security controls

Question 12

An organization's information security program has been in place for two years. During a recent audit, several findings indicated that security controls are not consistently applied across business units. The CISO has been asked to improve the program. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a risk assessment to identify gaps and prioritize remediation.. Conducting a risk assessment first (Option C) is the correct initial step because it systematically identifies where controls are failing or missing across business units, quantifies the associated risks, and prioritizes remediation based on business impact. Without this foundational analysis, any subsequent actions—such as automation, policy updates, or new controls—would lack direction and could waste resources on low-priority areas. This aligns with the CISM program lifecycle, where risk assessment drives all other program improvements.

Answer

Automate security compliance monitoring across all business units.

Answer

Update the information security policy to mandate compliance.

Answer

Implement additional security controls across all business units.

Question 13

Which THREE of the following are essential components of an information security governance framework?

Accepted Answer

Strategic alignment of security with business objectives.. Strategic alignment of security with business objectives (Option C) is essential because an information security governance framework must ensure that security initiatives directly support and enable the organization's mission and goals. Without this alignment, security becomes a siloed cost center rather than a strategic enabler, leading to misallocated resources and reduced executive sponsorship. This principle is foundational to the CISM governance domain, where security is viewed as a business function, not just a technical discipline.

Answer

A process for conducting security incident response.

Answer

Implementation of technical security controls such as firewalls.

Question 14

Based on the exhibit, which role is responsible for notifying affected users about the phishing attack?

Accepted Answer

Communications Lead. The Communications Lead is responsible for notifying affected users about the phishing attack because this role manages external and internal communications, including user notifications, during an incident. In the exhibit, the Communications Lead is explicitly assigned the task of 'Notify affected users' under the communication plan, ensuring timely and accurate messaging to reduce further risk.

Answer

Technical Lead

Answer

Legal Counsel

Answer

Incident Response Manager

Question 15

An information security manager is designing a program for a healthcare organization. Which of the following should be the FIRST step in establishing the program?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment is the foundational first step because it identifies and prioritizes the specific threats and vulnerabilities facing the healthcare organization's sensitive data (e.g., PHI under HIPAA). Without this baseline understanding, any subsequent policies, controls, or metrics would be misaligned with actual risk exposure, leading to ineffective or wasteful security investments.

Answer

Develop information security policies and procedures

Answer

Select and implement security controls

Answer

Define security metrics and reporting