CISM Practice Test 33 — 15 Questions

Question 1

Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)

Accepted Answer

Risk scenarios with likelihood and impact ratings. Option B is correct because a risk assessment report must document identified risk scenarios together with their likelihood and impact ratings, which are the core analytical outputs that let stakeholders understand and prioritize each risk. Option D is correct because the report should provide risk treatment recommendations (such as mitigate, transfer, avoid, or accept) so decision-makers know how each identified risk should be addressed. Options A, C, and E are not key components of a risk assessment report: vendor security assessment ratings belong to third-party/vendor risk management artifacts, detailed control testing results are outputs of control testing or audit reports, and a complete asset inventory is an input to the risk assessment process rather than a required section of the report itself.

Answer

Vendor security assessment ratings

Answer

Detailed results of control testing

Answer

Complete asset inventory

Question 2

A security operations center analyst receives an alert from the SIEM indicating a possible data exfiltration. The analyst is unsure if it is a true positive. What is the MOST appropriate action?

Accepted Answer

Review additional logs to confirm. The analyst must first validate the alert by reviewing additional logs (e.g., firewall, proxy, DNS, or endpoint logs) to confirm whether the SIEM alert represents a true positive. Jumping to containment or escalation without confirmation risks unnecessary disruption and false alarms, which violates the incident response principle of 'verify before acting.' The SIEM may have triggered on a benign pattern (e.g., a large file transfer to a trusted cloud service), and only correlated log analysis can establish intent and context.

Answer

Escalate to the incident response manager

Answer

Immediately block the source IP

Answer

Quarantine the affected system

Question 3

A security manager is evaluating OKRs for the vulnerability management team. Which key result best aligns with an objective to reduce risk from vulnerabilities?

Accepted Answer

Reduce mean time to remediate critical vulnerabilities by 30%. Reducing mean time to remediate (MTTR) critical vulnerabilities by 30% is a direct risk-reduction outcome — it shortens the window of exposure and is measurable, time-bound, and tied to the objective. OKRs require key results that measure outcomes, not activities. MTTR is a standard risk metric that security leadership uses to demonstrate reduced exposure.

Answer

Conduct quarterly penetration tests

Answer

Achieve 95% scan coverage of assets

Answer

Increase the number of scans by 20%

Question 4

An organization is implementing a third-party risk management (TPRM) program. Which approach best addresses nth-party risk?

Accepted Answer

Requiring that key vendors include security requirements in contracts with their subcontractors. Nth-party risk refers to risks from suppliers of your suppliers. Contractual requirements that cascade down the supply chain are essential to manage this risk.

Answer

Performing on-site audits of all third parties

Answer

Accepting the risk since it is outside the organization's control

Answer

Conducting annual assessments of all direct vendors only

Question 5

After a security incident, which step should be taken first?

Accepted Answer

Containment. In incident management, containment is the immediate priority after detection because it stops the spread of the threat and limits damage. Without containment, the attacker may continue to move laterally, exfiltrate data, or destroy evidence, making recovery and eradication ineffective. CISM emphasizes that containment must precede eradication and recovery to preserve forensic integrity and reduce business impact.

Answer

Recovery

Answer

Lessons learned

Answer

Eradication

Question 6

During an incident investigation, the security team discovers that an attacker exfiltrated sensitive customer data via encrypted DNS tunneling over a period of three months. The data loss was only noticed after a routine audit. Which of the following weaknesses MOST likely allowed the attacker to remain undetected for so long?

Accepted Answer

Inadequate monitoring of DNS traffic for anomalies. DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.

Answer

Weak password policies

Answer

Unpatched web server software

Answer

Lack of data-at-rest encryption

Question 7

In the context of defense-in-depth, which control provides protection at the network layer to prevent unauthorized access?

Accepted Answer

Firewalls. Firewalls operate at the network layer (Layer 3) and transport layer (Layer 4) to filter traffic based on IP addresses, ports, and protocols, preventing unauthorized network access. They are a core component of defense-in-depth at the network perimeter and internal segments. This directly matches the requirement for network-layer protection.

Answer

Encryption of data at rest

Answer

Antivirus software

Answer

Security awareness training

Question 8

Which THREE of the following are best practices for handling evidence during an incident investigation?

Accepted Answer

Document all actions taken during evidence collection.. Option A is correct because documenting every action taken during evidence collection creates an auditable record that preserves the integrity and admissibility of the evidence, showing exactly who did what and when. Option B is correct because a chain of custody log tracks the seizure, transfer, and storage of evidence, ensuring it has not been tampered with and remains admissible in legal or disciplinary proceedings. Option D is correct because creating a forensic image (a bit-for-bit copy, typically verified with a hash such as MD5 or SHA-256) allows analysis to be performed on the copy while preserving the original evidence in its unaltered state. Option C is not a best practice because analyzing evidence directly on live systems can alter timestamps, memory contents, and file metadata, destroying or contaminating potential evidence; analysis should be done on forensic copies. Option E is not a best practice because evidence should be collected, documented, and stored securely in a controlled location rather than left in place, where it could be modified, lost, or compromised.

Answer

Analyze evidence directly on live systems to avoid delays.

Answer

Store evidence in its original location to avoid disturbance.

Question 9

When an incident cannot be resolved within the maximum tolerable downtime (MTD), what is the appropriate action regarding business continuity and disaster recovery (BC/DR)?

Accepted Answer

Escalate to the BC/DR team for possible activation of continuity plans. The Maximum Tolerable Downtime (MTD) is the longest time a business process can be unavailable before causing unacceptable impact. When an incident cannot be resolved within the MTD, the appropriate action is to escalate to the BC/DR team so they can decide whether to activate continuity plans (e.g., failover to alternate sites, manual workarounds). Continuing incident response past the MTD without invoking BC/DR risks exceeding the organization's tolerance for downtime.

Answer

Ignore the MTD and focus solely on incident eradication

Answer

Continue incident response until full recovery

Answer

Declare a disaster immediately without further analysis

Question 10

You are the CISO of a mid-sized financial services firm that processes credit card transactions. The company has recently expanded its operations to include a mobile payment application that stores payment credentials in the cloud. The current information security program was designed primarily for the on-premises environment and has not been updated to address cloud-specific risks. The internal audit team has identified that the cloud service provider (CSP) does not have an independent third-party audit report (e.g., SOC 2) available for review. Additionally, the mobile app development team has been deploying code without formal security review, citing the need for rapid releases to compete in the market. The CEO has expressed concern about the potential for a data breach and has asked you to recommend immediate actions to strengthen the security program while minimizing business disruption. Which of the following should you recommend as the FIRST course of action?

Accepted Answer

Conduct a detailed security assessment of the cloud service provider's controls and contractually require an annual SOC 2 Type II report.. The correct first course of action because the absence of an independent third-party audit report (e.g., SOC 2 Type II) means the organization has no verified assurance that the cloud service provider (CSP) has adequate security controls in place. As CISO, you must immediately assess the CSP's security posture and contractually mandate a SOC 2 Type II report to gain visibility into the effectiveness of the CSP's controls over time, which is foundational before implementing any compensating technical controls. This aligns with the CISM domain of Information Security Program governance, where vendor risk management and due diligence are critical first steps when expanding into cloud environments.

Answer

Encrypt all data in transit and at rest using the organization's own encryption keys.

Answer

Implement compensating controls such as tokenization for all cardholder data stored in the cloud.

Answer

Require the mobile app development team to undergo formal security training and implement a peer review process for all code deployments.

Question 11

A large organization is implementing a security controls framework and wants to prioritize controls that provide the greatest risk reduction with the least operational friction. Which approach should the security manager adopt?

Accepted Answer

Prioritize critical controls that address high-risk areas and enable business operations. A risk-based approach prioritizes controls that address the highest-risk areas while minimizing operational friction, which aligns security investment with business objectives. This ensures the greatest risk reduction per unit of effort and avoids disrupting critical business processes. It also reflects the CISM principle that security must enable the business, not obstruct it.

Answer

Implement all controls from the chosen framework simultaneously

Answer

Implement compensating controls only for legacy systems

Answer

Select controls based on regulatory compliance requirements only

Question 12

After a merger, two companies with different security cultures are being integrated. What is the BEST approach for the information security manager to achieve a unified governance structure?

Accepted Answer

Develop a new framework incorporating strengths from both companies. Merging two distinct security cultures requires a deliberate, collaborative approach that leverages the best practices from both organizations. Developing a new framework that incorporates strengths from both companies ensures buy-in from stakeholders and creates a unified governance structure that is tailored to the combined entity's risk profile, rather than imposing one side's culture or waiting for an uncertain natural convergence.

Answer

Implement a regulatory framework as the baseline

Answer

Maintain separate frameworks until a natural convergence occurs

Answer

Adopt the security framework of the acquiring company

Question 13

A multinational corporation has just detected a ransomware attack that encrypted critical files on a file server. The incident response team has been activated. Which of the following should be the FIRST action taken by the team?

Accepted Answer

Isolate the affected systems from the network. The first priority in ransomware incident response is containment to prevent the encryption from spreading to other systems. Isolating the affected file server from the network (e.g., disabling the network interface or disconnecting the cable) stops the ransomware from communicating with its command-and-control server and encrypting additional shares. This aligns with the NIST SP 800-61 containment strategy and ensures that the incident response team can safely preserve forensic evidence before any remediation.

Answer

Restore encrypted files from backup

Answer

Reboot the file server to clear the encryption

Answer

Notify law enforcement

Question 14

A security metrics program should include key performance indicators (KPIs) for board reporting. Which metric is most appropriate for executive oversight?

Accepted Answer

Mean time to detect (MTTD) incidents. Mean time to detect (MTTD) is a strategic, outcome-oriented metric that measures how quickly the security program identifies incidents, which directly reflects detection capability and risk exposure. It is meaningful to a board because it translates technical operations into a business-risk indicator (dwell time). MTTD is a standard KPI in SOC maturity models and frameworks like NIST CSF.

Answer

Number of firewall rules configured

Answer

Daily log volume

Answer

Patch management tool version

Question 15

After a data breach involving personal data of EU residents, the incident manager must ensure compliance with GDPR notification requirements. Within how many hours must the organization notify the relevant supervisory authority of the breach?

Accepted Answer

72 hours. GDPR Article 33 requires that, in the event of a personal data breach, the controller must notify the relevant supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The 72-hour clock is a hard regulatory deadline, and failure to meet it can trigger significant fines under Article 83. This is why 72 hours is the correct answer for breach notification to the supervisory authority.

Answer

96 hours

Answer

24 hours

Answer

48 hours