CISM Practice Test 34 — 15 Questions

Question 1

What is the primary purpose of a vulnerability management program?

Accepted Answer

To identify, assess, and remediate security weaknesses in systems. Vulnerability management aims to identify, classify, and remediate vulnerabilities to reduce the attack surface.

Answer

To enforce access control policies

Answer

To detect and respond to security incidents

Answer

To manage third-party security risks

Question 2

An organization is updating its information security strategy. Which THREE elements should be included to ensure alignment with business objectives? (Select THREE)

Accepted Answer

Risk appetite and tolerance levels defined by the board. Option A is correct because risk appetite and tolerance levels defined by the board translate business objectives into an explicit statement of how much risk the organization is willing to accept, which is the foundation for aligning security strategy with business goals. Option B is correct because compliance requirements from applicable regulations (e.g., GDPR, HIPAA, PCI DSS) are mandatory business constraints that the security strategy must incorporate to avoid legal, financial, and reputational consequences. Option E is correct because a multi-year roadmap with key milestones provides the strategic planning horizon and measurable checkpoints that connect security initiatives to long-term business objectives and enable governance oversight. Option C is not appropriate here because a daily SOC monitoring schedule is a tactical operational artifact, not a strategic alignment element. Option D is also not appropriate because a detailed list of firewall ports to block is a low-level technical control, not a strategic component of an information security strategy.

Answer

Daily monitoring schedule for security operations center

Answer

A detailed list of firewall ports to block

Question 3

In a defence-in-depth strategy, which control is considered a compensating control when a critical application cannot be patched immediately due to operational constraints?

Accepted Answer

Network segmentation. Network segmentation is a compensating control because it reduces the attack surface and lateral movement potential of an unpatched application by isolating it from other systems, thereby mitigating the risk that the vulnerability could be exploited to reach critical assets. When patching is delayed by operational constraints, segmentation provides an alternative risk-reduction mechanism that addresses the same underlying exposure.

Answer

Configuration management

Answer

Intrusion detection system (IDS)

Answer

Vulnerability scanning

Question 4

An incident response team is conducting an exercise to test its playbook for a ransomware incident. Which of the following is the PRIMARY benefit of such an exercise?

Accepted Answer

Validating the incident response plan and identifying areas for improvement. The primary purpose of a tabletop or simulation exercise is to validate that the incident response plan works in practice and to surface gaps, ambiguities, and missing roles before a real ransomware event occurs. Exercises reveal whether contact lists are current, escalation paths are clear, and playbook steps are executable — findings that directly feed plan improvement.

Answer

Documenting the exercise for future reference

Answer

Complying with regulatory requirements

Answer

Testing the technical skills of the team

Question 5

Refer to the exhibit. An audit reveals that 20% of privileged accounts were approved by the same manager without secondary review. Which control deficiency is MOST relevant to this finding?

Accepted Answer

Segregation of duties. The finding that 20% of privileged accounts were approved by the same manager without secondary review directly violates the principle of segregation of duties (SoD). In privileged access management (PAM), SoD requires that the approval of privileged account access be performed by a different individual than the requester or the manager who supervises the requester, to prevent a single point of failure and reduce the risk of unauthorized access or fraud. Without a secondary review, a single manager could approve accounts for themselves or their subordinates without independent oversight, undermining the control objective of preventing conflicts of interest.

Answer

Access review frequency

Answer

Provisioning delay

Answer

Audit log retention

Question 6

Refer to the exhibit. The security analyst observes these alerts. What is the MOST likely sequence of events?

Accepted Answer

Attacker compromised jsmith's credentials, established C2, and exfiltrated data. The correct sequence is that an attacker compromised jsmith's credentials, established command-and-control (C2) communication, and then exfiltrated data. The alerts show a brute-force or credential-stuffing attempt from an external IP (10.0.0.45) against jsmith's account, followed by an outbound C2 beacon (e.g., DNS or HTTP) from jsmith's workstation, and finally a large data transfer to an external destination. This matches the typical kill chain: initial access via compromised credentials, persistence via C2, and data exfiltration as the final objective.

Answer

Insider threat: jsmith intentionally exfiltrated data

Answer

Network scan from 10.0.0.45 triggered false positives

Answer

Malware downloaded on jsmith's workstation and exfiltrated data

Question 7

A large enterprise experiences a data breach involving personal identifiable information (PII) of customers. The incident response team has contained the breach and is now in the eradication phase. The CISO wants to ensure that the same vulnerability cannot be exploited again. Which action is MOST critical?

Accepted Answer

Patch the specific vulnerability identified.. Patching the specific vulnerability is the most critical action during the eradication phase because it permanently removes the root cause of the breach. Without this step, the same attack vector (e.g., an unpatched SQL injection flaw or a known CVE in a web server) remains exploitable, rendering containment efforts temporary. The CISO's goal to prevent recurrence directly requires eliminating the technical weakness, not just mitigating its symptoms.

Answer

Change all passwords of affected accounts.

Answer

Notify affected customers about the breach.

Answer

Deploy additional endpoint protection software.

Question 8

You are the CISO of a mid-sized manufacturing company. The company has grown rapidly through acquisitions, and each subsidiary has its own information security program. There is no centralized governance, and recent security incidents have occurred due to inconsistent policies. The board has asked you to create a unified information security program that balances flexibility with control. Each subsidiary has unique operational processes and varying levels of security maturity. You have limited budget and cannot replace all local security teams. Which approach should you take?

Accepted Answer

Develop a minimum security standard (MSS) and a phased implementation roadmap based on risk.. Correct answer is B because developing a minimum security standard (MSS) and a phased implementation roadmap based on risk allows each subsidiary to implement controls based on their unique risk profiles while ensuring a common baseline. This approach balances flexibility with control, respects varying maturity levels, and avoids disruption. Option A (immediate enterprise-wide policy) ignores diverse operational processes and may cause resistance. Option C (centralize all security operations) is costly and impractical given the budget and local teams. Option D (adopt the most mature subsidiary's program) may not fit the context of less mature units.

Answer

Immediately mandate compliance with a new enterprise-wide security policy.

Answer

Centralize all security operations and disband local teams.

Answer

Adopt the most mature subsidiary's program as the enterprise standard.

Question 9

An organization has a decentralized governance model where each business unit manages its own security team. The CISO reports to the CIO. Which of the following is the GREATEST risk associated with this structure?

Accepted Answer

Inconsistent enforcement of security policies across business units. In a decentralized governance model where each business unit runs its own security team and the CISO reports to the CIO (rather than the board or CEO), the greatest risk is inconsistent enforcement of security policies across business units. Decentralization without a strong central authority or common control framework leads to divergent interpretations, uneven risk postures, and gaps that attackers can exploit across the enterprise. This is a governance and risk aggregation issue, which outweighs cost or staffing concerns.

Answer

Difficulty in achieving economies of scale for security operations

Answer

Lack of skilled security personnel in some business units

Answer

Increased cost due to duplication of security tools

Question 10

A CISO is evaluating a cloud provider's security posture. Which of the following should be the MOST important consideration in the vendor risk assessment?

Accepted Answer

The provider's certifications and SOC 2 reports. Independent third-party attestations such as SOC 2 reports and certifications (ISO 27001, FedRAMP, PCI DSS) provide verifiable evidence of the provider's security controls, making them the most important consideration in a vendor risk assessment. They allow the CISO to evaluate the provider's actual control environment rather than relying on marketing claims, brand reputation, or pricing.

Answer

The provider's data center locations

Answer

The provider's market share and brand reputation

Answer

The provider's pricing compared to competitors

Question 11

A company has recently adopted COBIT 2019 as its governance framework. The board is requesting a concise report on the effectiveness of the security program. Which reporting structure best aligns with COBIT's guidance?

Accepted Answer

Dashboard showing alignment of security goals with enterprise goals, using KRIs and KPIs. COBIT 2019 emphasizes the alignment of IT and security goals with enterprise goals through a cascading goals cascade. A dashboard that maps security goals to enterprise goals using Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) directly reflects this principle, providing a concise, strategic view of program effectiveness rather than operational details.

Answer

List of all security incidents and their impacts

Answer

Compliance status with all applicable regulations

Answer

Detailed technical vulnerabilities discovered during penetration tests

Question 12

A financial institution is designing its information security governance to comply with multiple regulations. The board has limited risk appetite. Which approach BEST ensures effective governance while minimizing conflict?

Accepted Answer

Implement a harmonized control framework that maps to all regulations. A harmonized control framework (e.g., ISO 27001, NIST CSF) maps common controls across multiple regulations (e.g., GDPR, PCI DSS, SOX), reducing duplication and conflict. This aligns with the board's limited risk appetite by providing a single, consistent set of controls that satisfy all requirements, avoiding the inefficiency and potential gaps of siloed approaches.

Answer

Assign different compliance teams for each regulation

Answer

Adopt a single regulatory framework and ignore others

Answer

Create separate governance committees for each regulation

Question 13

A security manager needs to justify an increase in the security budget. Which metric is MOST compelling to demonstrate the value of security investments to the board?

Accepted Answer

Return on investment (ROI) from avoided breach costs. Return on investment (ROI) from avoided breach costs translates security spending into financial terms that the board understands, showing how investments prevent losses. This metric directly ties security to business value by quantifying the cost avoidance from prevented incidents, which is more compelling than activity-based metrics. Boards are accountable for financial performance and risk, so ROI resonates with their fiduciary responsibilities.

Answer

Number of phishing simulations conducted

Answer

Percentage of IT budget allocated to security

Answer

Number of security tools deployed

Question 14

Which of the following is the BEST reporting structure for a CISO to ensure independent oversight and alignment with business strategy?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board ensures the CISO has the authority and independence to influence security strategy without conflicting priorities from IT operations.

Answer

Reporting to the CIO

Answer

Reporting to the head of legal

Answer

Reporting to the CFO

Question 15

During a security incident, the incident response team discovers that an attacker has exfiltrated data via an encrypted tunnel over HTTPS. Which log source is MOST likely to provide evidence of the exfiltration?

Accepted Answer

Proxy logs. Proxy logs are the most likely source because they can record the full URL and HTTP headers of HTTPS requests, including the destination host and path, even though the payload is encrypted. Since the attacker exfiltrated data over an encrypted tunnel, the proxy log can show the outbound connection to the command-and-control server or data storage endpoint, providing evidence of the exfiltration activity.

Answer

Web server access logs

Answer

Firewall logs

Answer

Intrusion detection system (IDS) logs