CISM Practice Test 34 — 15 Questions

Question 1

An organization's incident response (IR) policy should be approved by which of the following to ensure authority and accountability?

Accepted Answer

The board of directors or executive management. The IR policy requires senior management approval to demonstrate organizational commitment and allocate necessary resources.

Answer

The incident response manager

Answer

The legal counsel

Answer

The IT director

Question 2

After containing a security incident, the team conducts a root cause analysis. They find the breach originated from a compromised third-party vendor account. What is the most effective long-term mitigation?

Accepted Answer

Implement vendor access reviews and enforce MFA. Implementing vendor access reviews and enforcing MFA addresses the root cause of unauthorized access.

Answer

Increase logging on vendor accounts

Answer

Change all passwords manually

Answer

Terminate the vendor relationship

Question 3

Refer to the exhibit.
Given the exhibit, which type of incident is MOST likely occurring?

Accepted Answer

Insider threat. The exhibit shows a user logging in from an unusual location, attempting unauthorized access, and then exfiltrating sensitive data. This pattern is indicative of an insider threat, as it involves a legitimate user performing malicious actions. Option C (Insider threat) is correct.

Answer

Phishing campaign

Answer

Ransomware attack

Answer

DDoS attack

Question 4

Which TWO of the following are appropriate actions to take during the detection phase of incident management?

Accepted Answer

Activate the incident response team. During detection, the team activates the incident response team and collects/analyzes logs to confirm the incident. Root cause analysis occurs later, evidence preservation is during containment, and rebuilding is recovery.

Answer

Rebuild systems from backups

Answer

Conduct root cause analysis

Answer

Preserve evidence

Question 5

An organization's governance framework requires regular reporting to the board. Which reporting frequency and format is MOST effective for a board with limited security expertise?

Accepted Answer

Quarterly report summarizing key risk indicators and business impact. A quarterly report summarizing key risk indicators (KRIs) and business impact is most effective for a board with limited security expertise because it aligns with the board's strategic oversight role, focusing on risk exposure and business outcomes rather than technical details. This frequency balances timeliness with the board's typical meeting cadence, ensuring actionable insights without overwhelming non-technical members.

Answer

Monthly dashboard of technical control effectiveness metrics

Answer

Annual presentation of the overall security risk register

Answer

Weekly technical briefings on incidents and vulnerabilities

Question 6

An organization wants to implement a defense-in-depth strategy for its web application. Which set of controls best exemplifies this approach?

Accepted Answer

Web application firewall (WAF), input validation, and security awareness training. Defense-in-depth uses multiple layers: network, host, application, and monitoring controls.

Answer

Single sign-on and multi-factor authentication

Answer

Encryption at rest and in transit

Answer

Intrusion detection system and vulnerability scanner

Question 7

A multinational corporation is migrating its on-premises data center to a hybrid cloud environment. The organization processes highly sensitive financial data subject to strict regulatory requirements (e.g., GDPR, SOX). During the risk assessment, the information security manager discovers that the cloud service provider (CSP) stores data in multiple geographic regions, some of which do not meet the organization's data residency requirements. Additionally, the CSP's encryption key management is not fully under the organization's control, and the incident response plan does not include specific procedures for cloud-based breaches. The organization's risk appetite is low, and the board has mandated that all risks must be mitigated to an acceptable level. Which of the following is the BEST course of action?

Accepted Answer

Require the CSP to provide dedicated hardware security modules and restrict data storage to approved regions through contractual terms. It directly addresses the root causes: data residency non-compliance and lack of control over encryption keys. Requiring dedicated hardware security modules (HSMs) and restricting data storage to approved regions through contractual terms ensures that the organization retains control over key management and meets regulatory requirements. This aligns with the low risk appetite and the board's mandate to mitigate risks to an acceptable level.

Option B (accept the risk) is incorrect because it contradicts the board's mandate to mitigate all risks, and certifications alone do not guarantee compliance.
Option C (cancel migration) is too drastic and costly; the organization can achieve compliance with the CSP rather than abandoning the cloud migration.
Option D (transfer risk via insurance) does not achieve regulatory compliance; fines may still be imposed regardless of insurance coverage.

Answer

Accept the risk because the CSP has strong security certifications and the likelihood of a breach is low

Answer

Cancel the cloud migration and build a new private data center in a compliant location

Answer

Transfer the risk by purchasing cyber insurance that covers regulatory fines

Question 8

Which of the following is the best indicator that an organization has effective information security governance?

Accepted Answer

Security metrics are reviewed by the board quarterly. (ISO 27001 certification) indicates compliance, not necessarily governance performance. Option B (security budget increased) does not guarantee effectiveness. Option C (low number of incidents) could be due to luck. Option D (board review of metrics) demonstrates governance oversight and strategic alignment.

Answer

Achievement of ISO 27001 certification

Answer

The security budget has increased year over year

Answer

Low number of security incidents

Question 9

During a merger, two companies with different information security programs are being integrated. The combined entity must maintain compliance with PCI DSS and GDPR. The CISO is concerned about gaps in coverage due to differing maturity levels. Which of the following is the BEST approach to harmonize the programs?

Accepted Answer

Perform a gap analysis against the requirements and prioritize remediation.. A gap analysis identifies where controls are missing or insufficient, allowing for a prioritized remediation plan. Option A is wrong because adopting the higher standard may be unnecessary and costly. Option B is wrong because merging without analysis could introduce risks. Option C is wrong because a new framework from scratch may not leverage existing investments.

Answer

Adopt the more stringent security program from the acquirer across the entire entity.

Answer

Merge the two programs by combining all controls from each.

Answer

Implement a completely new framework that meets both regulations.

Question 10

Which TWO of the following are key responsibilities of the crisis management team (CMT) during a major cybersecurity incident?

Accepted Answer

Approving external communications and public statements. The crisis management team (CMT) is responsible for high-level strategic decisions, including approving external communications and public statements to manage reputation and legal exposure during a major cybersecurity incident. This aligns with the CMT's role in coordinating response efforts and ensuring consistent messaging, as defined in incident management frameworks like NIST SP 800-61.

Answer

Restoring backups of affected servers

Answer

Analyzing log files to identify the attack vector

Answer

Conducting technical forensic analysis of compromised systems

Question 11

Which TWO of the following are recommended practices when conducting a post-incident review? (Select TWO)

Accepted Answer

Document lessons learned and improvement actions. Documenting lessons learned and improvement actions is a core output of a post-incident review, enabling the organization to refine security controls, processes, and training. This practice aligns with the continuous improvement cycle in incident management, ensuring that each incident contributes to stronger defenses. Without this documentation, the same vulnerabilities or procedural gaps may be exploited repeatedly.

Answer

Update the incident response plan immediately

Answer

Assign blame to responsible individuals

Answer

Reimage all affected systems

Question 12

After a security incident, the board holds the CISO accountable. The CISO argues that the incident was caused by a failure in the third-party risk management process. Which of the following governance deficiencies is most likely the root cause?

Accepted Answer

There was no board-approved policy for assessing and monitoring third-party risk.. The board holds the CISO accountable because governance ultimately flows from the board's approval of policies. Without a board-approved third-party risk management policy, there is no authoritative mandate to enforce security requirements, conduct assessments, or monitor vendors. This governance gap means the organization lacks the foundational directive that drives all downstream processes, making it the most likely root cause of the incident.

Answer

The third-party contract did not specify security requirements.

Answer

The organization did not implement technical controls to monitor third-party access.

Answer

The incident response plan did not cover third-party related incidents.

Question 13

Order the steps for a risk assessment process according to ISACA's risk management framework.

Accepted Answer

Step 1: Risk Identification, Step 2: Risk Analysis, Step 3: Risk Evaluation, Step 4: Risk Treatment, Step 5: Risk Monitoring. Risk assessment starts with identification, then analysis, evaluation, treatment, and continuous monitoring.

Answer

Step 1: Risk Identification, Step 2: Risk Evaluation, Step 3: Risk Analysis, Step 4: Risk Treatment, Step 5: Risk Monitoring

Answer

Step 1: Risk Analysis, Step 2: Risk Identification, Step 3: Risk Evaluation, Step 4: Risk Treatment, Step 5: Risk Monitoring

Answer

Step 1: Risk Identification, Step 2: Risk Analysis, Step 3: Risk Evaluation, Step 4: Risk Monitoring, Step 5: Risk Treatment

Question 14

Which TWO of the following are primary responsibilities of the board of directors in information security governance?

Accepted Answer

Approving the organization's information security risk appetite.. The board of directors is responsible for setting the organization's risk appetite, which defines the acceptable level of risk in information security. This is a strategic governance decision that guides all subsequent security activities. Approving the risk appetite ensures that security investments align with business objectives and regulatory requirements.

Answer

Implementing security controls to mitigate identified risks.

Answer

Designing the technical security architecture for the organization.

Answer

Conducting internal security audits of the information systems.

Question 15

A multinational corporation is assessing the risk of data breaches from third-party vendors. The CISM is tasked with selecting a risk treatment strategy. The organization has a low risk appetite for data breaches. Which strategy should be prioritized?

Accepted Answer

Avoid the risk by not engaging vendors that cannot meet security requirements.. Given the organization's low risk appetite for data breaches, the most appropriate strategy is to avoid the risk entirely by not engaging vendors that cannot meet security requirements. This aligns with the principle that when risk exceeds the acceptable threshold, avoidance is the prioritized treatment. Avoidance eliminates the risk source, whereas other strategies like mitigation or transfer still retain some residual risk that may be unacceptable.

Answer

Mitigate the risk by conducting regular vendor audits.

Answer

Transfer the risk by requiring vendors to have cyber insurance.

Answer

Accept the risk because third-party risks are unavoidable.