CISM Practice Test 34 — 15 Questions

Question 1

You are the CISM for a mid-sized e-commerce company that processes credit card transactions. The company recently experienced a security incident where an attacker exploited a vulnerability in the web application to gain access to the customer database containing payment card information. The incident response team contained the breach, but the root cause analysis revealed that the vulnerability had been identified in a penetration test six months ago but was not remediated due to competing priorities. The company's risk management framework defines risk appetite as 'moderate' for information security risks. The board is concerned and has asked you to recommend improvements to prevent recurrence. The company has a limited budget and cannot implement all possible controls. Current environment: web application developed in-house, hosted on-premises, with a mix of virtual and physical servers. The security team consists of three people responsible for monitoring, incident response, and vulnerability management. The development team follows an agile methodology with bi-weekly sprints. The company has cyber liability insurance that covers breach response costs up to $2 million. Based on this scenario, what is the most effective course of action?

Accepted Answer

Implement a formal vulnerability management program with defined remediation SLAs based on risk severity.. Option B is correct because a formal vulnerability management program with defined remediation SLAs directly addresses the root cause: the known vulnerability was not patched due to competing priorities. By tying remediation timelines to risk severity (e.g., critical vulnerabilities patched within 7 days, high within 30 days), the company operationalizes its 'moderate' risk appetite and ensures that penetration test findings are acted upon before they can be exploited. This is the most cost-effective approach given the limited budget, as it leverages existing staff and processes rather than requiring new hires or expensive rewrites.

Answer

Hire two additional security analysts to improve monitoring and incident response.

Answer

Increase cyber liability insurance coverage to $5 million to cover potential breach costs.

Answer

Rewrite the web application using a secure development framework to eliminate vulnerabilities.

Question 2

You are the incident response manager for a financial services company. The company has a hybrid infrastructure with on-premises servers and cloud services. At 2:00 AM, the SIEM generates a critical alert: a database server in the DMZ is communicating with a known malicious IP address on port 443. The server contains customer PII. The on-call security analyst reports that the server is running and the connection is active. The incident response plan states that any confirmed compromise of PII must be reported to the regulator within 72 hours. You have the following options: A) Immediately isolate the server by disconnecting it from the network, then begin forensic analysis. B) Leave the server connected to gather more intelligence about the attacker's actions, but block only the malicious IP at the firewall. C) Shut down the server to preserve evidence and prevent data exfiltration. D) Copy the server's disk over the network for forensic analysis before taking any action. Which option is the BEST course of action?

Accepted Answer

Block the malicious IP and monitor the server. Option D is the best course of action because it balances the need to stop the immediate data exfiltration threat with the preservation of forensic evidence and the regulatory requirement to report a PII breach within 72 hours. By blocking only the malicious IP at the firewall, you sever the active command-and-control (C2) channel on port 443 while keeping the server running, which allows you to collect volatile data (e.g., memory, active processes, network connections) and perform live forensics without destroying evidence. This approach also avoids the risk of losing critical evidence that would occur with a hard shutdown or isolation, and it provides time to confirm the scope of the compromise before the 72-hour clock starts for regulatory reporting.

Answer

Isolate the server immediately

Answer

Shut down the server

Answer

Copy the disk over the network

Question 3

A retail company's security governance includes a policy that all software must be approved by a security committee. This delays critical business applications. The CIO complains. How should the CISO adjust governance?

Accepted Answer

Implement a risk-based approval process with expedited paths. Option B is correct because a risk-based approval process with expedited paths balances security and agility. Option A removes control. Option C automates but may not address the root. Option D increases frequency but not efficiency.

Answer

Increase committee meeting frequency

Answer

Remove the approval requirement

Answer

Automate software approval

Question 4

BankOne has a mature security governance program but recently failed a regulatory audit because the board had not formally approved the risk appetite statement. The CISO argues that risk appetite is reviewed annually and was verbally approved. To prevent recurrence, what governance change is most effective?

Accepted Answer

Require board resolution for risk appetite annually. Option D is correct because requiring a formal board resolution annually ensures documented approval. Option A is passive. Option B automates but does not address approval. Option C reduces indicators, which may be counterproductive.

Answer

Automate risk appetite monitoring

Answer

Reduce the number of risk indicators

Answer

Document all board approvals in minutes

Question 5

Refer to the exhibit. Based on the risk register extract, which risk should the information security manager prioritize for additional treatment?

Accepted Answer

R-002 only. R-002 has a residual risk rating of 'High', which exceeds the organization's risk appetite of 'Low'. R-001's residual risk is 'Medium', which still may be acceptable depending on further analysis. Therefore, R-002 requires immediate attention.

Answer

R-001 only

Answer

Neither risk requires additional treatment

Answer

Both R-001 and R-002

Question 6

An information security manager is implementing a risk management program. Which TWO of the following activities should be performed as part of the risk assessment process?

Accepted Answer

Analyzing threats and vulnerabilities. Risk assessment includes the identification and analysis of threats, vulnerabilities, and existing controls. Options C and E are directly part of risk assessment; the others belong to subsequent phases.

Answer

Determining acceptable risk levels

Answer

Monitoring incident response plans

Answer

Selecting controls to mitigate risks

Question 7

An organization is updating its information security program to align with business objectives. Which of the following is the PRIMARY benefit of integrating security risk management into the strategic planning process?

Accepted Answer

Aligns security investments with business priorities. Option C is correct because integrating security risk management into strategic planning ensures that security investments are prioritized based on business impact, aligning resources with the most critical risks. Option A is wrong because compliance is a legal requirement, not the primary benefit of integration. Option B is wrong because reducing incidents is a desirable outcome but not the primary benefit of integration. Option D is wrong because awareness is an operational benefit, not strategic.

Answer

Reduces the number of security incidents

Answer

Increases employee awareness of security policies

Answer

Ensures compliance with regulatory requirements

Question 8

During an audit of the information security program, the auditor identifies that several critical systems are not included in the incident response plan. Which of the following are the MOST appropriate actions for the security manager to take? (Select TWO.)

Accepted Answer

Update the incident response plan to include all critical systems. Options B and D are correct. Escalating to senior management ensures proper awareness and authorization (B), and updating the plan to include all critical systems directly addresses the finding (D). Option A is wrong because implementing compensating controls is a temporary measure and does not solve the root cause. Option C is wrong because immediately removing systems from production is too drastic and not justified. Option E is wrong because accepting risk without analysis bypasses proper risk management.

Answer

Implement compensating controls on the excluded systems

Answer

Document the finding and accept the risk

Answer

Immediately remove the excluded systems from production

Question 9

An information security manager reviews the suspicious activity log shown in the exhibit. The payroll file is supposed to be encrypted and only accessible internally. What is the MOST likely cause for the failed download?

Accepted Answer

The user lacked permission to decrypt the file. Option D is correct because the status 'Encryption key not found' indicates that the user does not have the necessary decryption key, likely due to lack of permission. Option A is wrong because certificate expiry would show a different error. Option B is wrong because if the file were not encrypted, it would download successfully. Option C is wrong because if the external IP were blocked, the download would not initiate.

Answer

The user's encryption certificate has expired

Answer

The file was not encrypted before being uploaded

Answer

The external IP is blocked by the firewall

Question 10

Refer to the exhibit. An organization is implementing access controls for a new data repository that will store financial reports classified as Category C. Which of the following is the MOST appropriate control to include?

Accepted Answer

Require encryption of data in transit. Option B is correct because Category C requires encryption for transmission; encryption at rest is not mandated but optional. Option A (role-based access) is implied by 'need-to-know' but not explicitly stated; Option C (dual control) is for Category D; Option D (quarterly audits) is for Category D.

Answer

Implement role-based access control (RBAC)

Answer

Enforce dual control for access

Answer

Conduct quarterly access reviews

Question 11

Which TWO of the following are key performance indicators (KPIs) commonly used to measure the effectiveness of incident management processes?

Accepted Answer

Mean Time to Detect (MTTD). Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) are standard KPIs for incident management effectiveness. The other options are either volume metrics or not specific to incident management.

Answer

Percentage of incidents resolved within SLA

Answer

Total cost of incidents

Answer

Number of incidents per month

Question 12

Based on the log entries, what is the most likely scenario?

Accepted Answer

A brute-force attack against the root account. The rapid succession of failed SSH login attempts for the root account from the same IP indicates a brute-force attack. Option A is not supported by the logs. Option B is unlikely due to the speed of attempts. Option C is less likely than an active attack.

Answer

A remote code execution attempt

Answer

A legitimate user repeatedly mistyping their password

Answer

A misconfiguration causing duplicate log entries

Question 13

Which TWO of the following are typically considered key components of an information security governance framework?

Accepted Answer

Adoption of a formal risk management process. Correct: B and D. A performance measurement system (B) ensures governance effectiveness, and a risk management process (D) is core to governance. Option A (specific technical controls) is too narrow; C (detailed incident response plan) is operational; E (penetration testing schedule) is a tactic, not a governance component.

Answer

Scheduling of regular penetration tests

Answer

Development of a detailed incident response plan

Answer

Implementation of specific technical controls

Question 14

A company's incident response team is handling a confirmed ransomware infection that has encrypted files on several servers. The IT director requests that the team immediately restore data from backups to minimize downtime. However, the team suspects that the backup repository may also be compromised because the attacker had administrative credentials. What is the BEST course of action?

Accepted Answer

Rebuild the servers from scratch and restore from an offline backup taken before the compromise.. Option C is correct because restoring from a known clean offline backup (taken before compromise) ensures the malware is not reintroduced. Option A risks re-infection. Option B cleans the backup repository but may still restore compromised data. Option D delays recovery unnecessarily.

Answer

Proceed with restoration from the most recent backup to restore operations quickly.

Answer

First, clean the backup repository and verify integrity before restoring to prevent re-infection.

Answer

Engage law enforcement before any restoration activities.

Question 15

Your organization is a multinational corporation with a hybrid cloud infrastructure, including on-premises data centers and AWS, Azure, and GCP environments. You have a distributed incident response team and a central SIEM that aggregates logs from all sources. You are the incident manager on duty when an alert fires indicating that a high-privilege user account (a domain admin) has been observed logging in from an IP address in a country where the company has no operations, at 3:00 AM local time. Subsequent investigation reveals that the same account also has a successful logon from the corporate headquarters at the same time, which is geographically impossible. The SIEM shows a single event for the suspicious logon, and no other indicators of compromise are present. The account has not been used for months. What is the BEST course of action?

Accepted Answer

Immediately disable the account and reset the password, then begin a forensic investigation to determine the scope of compromise.. Option C is correct because immediate containment (disable account, reset password) is critical to prevent further unauthorized access, followed by forensic investigation. Option A is risky as it may delay action. Option B could alert a potential attacker. Option D is premature and not targeted.

Answer

Restore the domain controller from a recent backup to ensure any malware is removed.

Answer

Contact the employee who owns the account to ask if they recently traveled or used a VPN.

Answer

Ignore the alert as it is likely a false positive due to SIEM misconfiguration or time zone discrepancy.