CISM Practice Test 35 — 15 Questions

Question 1

A financial institution is hit by a Distributed Denial of Service (DDoS) attack that is overwhelming their internet-facing services. The incident response team activates the plan, but the attack continues to escalate. The CEO is under pressure and asks the incident response manager whether they should pay the ransom demand (the attackers also sent an extortion note demanding payment to stop the attack). The manager must advise the CEO on the best course of action.

Accepted Answer

Engage a DDoS scrubbing service to filter malicious traffic. Using DDoS scrubbing services (cloud-based or on-premise) is the recommended technical defense. Paying the ransom encourages future attacks and does not guarantee the attack will stop. Rate limiting may affect legitimate traffic. Shutting down external access is too drastic and impacts business.

Answer

Implement rate limiting on the firewall

Answer

Shut down all external-facing services

Answer

Pay the ransom to stop the attack immediately

Question 2

A multinational financial institution uses a third-party Managed Security Service Provider (MSSP) for 24/7 monitoring of its security infrastructure. During a targeted attack, the MSSP’s analysts detected anomalous activity on a critical server at 2:00 AM. However, due to the service level agreement (SLA) which allows up to 12 hours for notification of lower-priority incidents, the MSSP classified the incident as medium severity and did not notify the internal incident response team until 2:00 PM. By then, the attacker had exfiltrated sensitive customer data. The internal team is conducting a post-incident review. What is the PRIMARY issue that led to the delay?

Accepted Answer

The SLA for notification of medium-severity incidents was too long. The SLA had a notification window that was too long for this type of incident. The classification as medium severity might have been appropriate, but the SLA aggravated the delay. The team's availability and the MSSP's technical skills are secondary or not the root cause.

Answer

The MSSP analysts lacked technical skills to recognize the incident's true severity

Answer

The incident severity was incorrectly classified as medium

Answer

The internal incident response team was not available until 2:00 PM

Question 3

A small marketing firm with 50 employees experiences a ransomware attack. The IT administrator quickly isolates the infected workstations by disconnecting them from the network. The company has a backup strategy that performs nightly backups to an on-premises NAS device. The administrator restores the affected systems from the most recent backup, but some files remain encrypted. The users report that the backups from the last two days show corruption as well. The firm does not have a formal incident response plan. The owner is anxious to get back to work and asks the administrator what to do next. What should the administrator do?

Accepted Answer

Restore from an older backup taken before the infection. Restoring from an older backup (before the ransomware infection occurred) is the most likely way to get clean data. Paying the ransom is not recommended as it encourages attackers and there is no guarantee. Contacting law enforcement is a good step but not the immediate technical solution. Running an antivirus scan is insufficient for decryption.

Answer

Contact law enforcement immediately

Answer

Pay the ransom to get the decryption key

Answer

Run a full antivirus scan on the restored systems

Question 4

A large enterprise with a centralized Security Information and Event Management (SIEM) system is experiencing a high volume of false positive alerts. The security team is overwhelmed and has started to ignore many alerts. During a recent incident, a critical alert indicating lateral movement by an attacker was missed because it was buried among hundreds of false positives. The incident escalated significantly before it was discovered. The CISO has asked the incident response manager to recommend improvements to prevent this from happening again. What should the manager recommend as the primary action?

Accepted Answer

Tune SIEM rules to eliminate known false positives. Tuning the SIEM rules to reduce false positives is the most direct way to improve alert quality without losing coverage. Increasing thresholds may cause missed real alerts. Hiring more staff is a longer-term solution. Disabling non-critical alerts could remove important detection capabilities.

Answer

Increase all alert thresholds to reduce volume

Answer

Hire additional security analysts to handle the load

Answer

Disable all non-critical alert categories

Question 5

A healthcare organization suffers a ransomware attack that encrypts critical patient data. The incident response team activates the incident response plan. The backup administrator reports that the most recent backups are from three days ago and are stored on a disconnected tape drive. However, the organization's legal counsel advises that according to regulatory requirements, patient data must be recoverable within 24 hours. The CEO is considering paying the ransom to avoid extended downtime and regulatory penalties. As the incident manager, what should you recommend?

Accepted Answer

Restore from the tape backups and accept the three-day data loss.. Option B is correct because restoring from known-good offline backups is the best practice, even with a three-day data loss. Paying the ransom (A) is discouraged and may not guarantee recovery. Negotiating (C) is risky and time-consuming. Waiting for law enforcement (D) delays recovery and may not provide a decryption key in time.

Answer

Pay the ransom to ensure quick recovery and avoid regulatory penalties.

Answer

Report the incident to law enforcement and wait for a decryption key.

Answer

Attempt to negotiate with the attackers for a lower ransom while simultaneously working on backup restoration.

Question 6

A manufacturing company has an incident response plan that includes a communication plan. However, during a recent ransomware incident, the team realized that the external legal counsel was not listed in the plan. The incident requires consultation with legal due to potential regulatory implications. The incident response manager needs to address this gap quickly. What should the manager do?

Accepted Answer

Add the legal counsel to the incident response plan immediately. The manager should add legal counsel to the communication plan immediately to ensure they are included in future incidents. Ignoring them or delaying notification could worsen regulatory consequences. Using internal legal might not be sufficient for external counsel needs.

Answer

Notify legal counsel after the incident is resolved

Answer

Use only internal legal department instead of external counsel

Answer

Ignore legal counsel involvement for this incident

Question 7

A bank detects unusual activity on a server containing sensitive financial data. The activity appears to be from a compromised vendor account that has legitimate remote access to the server for maintenance. The incident manager must decide on containment while maintaining business operations. The vendor account has elevated privileges and is used for routine updates. Disabling the account would delay critical maintenance. What is the BEST course of action?

Accepted Answer

Isolate the affected server from the network while allowing necessary access through a jump box.. Option C is correct because isolating the server and using a jump box allows controlled access while preventing further compromise. Option A is too disruptive. Option B may block legitimate vendors. Option D does not address the immediate threat.

Answer

Contact the vendor to ask about the unusual activity.

Answer

Disable the vendor's account immediately.

Answer

Block all remote access from external IPs.

Question 8

An organization's incident response policy requires preserving evidence in its original state. During a live incident on a critical server, the incident response team needs to capture volatile data, such as running processes and network connections, which would be lost if the system were shut down. The team has a forensic workstation with various tools. What tool should the team use to capture the volatile data before taking the system offline?

Accepted Answer

Memory dump tool (e.g., winpmem). Volatile data from memory is best captured using a dedicated memory acquisition tool like winpmem or similar. FTK Imager and WinHex are primarily for disk imaging. The dd command is used for disk copying, not memory. Memory dumps capture volatile data.

Answer

WinHex

Answer

dd command

Answer

FTK Imager

Question 9

After successfully containing an incident, the incident response team discovers that the attacker exploited a previously unknown vulnerability in a web application. The vulnerability is not yet patched by the vendor. The organization's management is concerned about the risk of another attack using the same vulnerability. What should the team recommend as the immediate action to reduce this risk?

Accepted Answer

Implement a workaround to mitigate the vulnerability. Implementing a workaround (such as a web application firewall rule or configuration change) reduces the immediate risk while waiting for a vendor patch. Developing a patch in-house is not advisable due to complexity and risk. Reporting to vendor is important but does not provide immediate protection. Disabling the service may be too disruptive.

Answer

Disable the web application until a patch is available

Answer

Report the vulnerability to the software vendor

Answer

Develop an in-house patch for the vulnerability

Question 10

Acme Corp, a global manufacturer, has a decentralized security governance model. Each business unit manages its own security, resulting in inconsistent policies and repeated audit findings. The new CISO proposes a federated model where a central team sets minimum standards and each unit can add local controls. However, the European unit's head insists on full autonomy due to GDPR strictness. The board is concerned about compliance costs. What should the CISO do first?

Accepted Answer

Conduct a risk assessment to identify where local controls are truly needed. Option C is correct because conducting a risk assessment will identify where local controls are truly necessary and justify the federated model. Option A ignores local concerns. Option B undermines the federation goal. Option D is a tactical fix, not strategic.

Answer

Implement the federated model immediately and require all units to comply

Answer

Allow the European unit to keep full autonomy while others follow the model

Answer

Hire a GDPR expert for the European unit

Question 11

A multinational financial services company is implementing a new regulatory requirement that mandates enhanced encryption for all customer data in transit. The organization currently uses TLS 1.2, but the regulation requires TLS 1.3. The risk owner for the data transmission system is the head of network operations, who believes the current controls are sufficient and argues that upgrading will cause significant downtime and cost. The information security manager has assessed the risk as high due to potential regulatory fines and reputational damage. The risk owner refuses to accept the risk and insists on deferring the upgrade. The organization has a risk appetite statement that accepts moderate residual risk only after explicit approval from the CRO. The escalation process involves the risk management committee. What is the BEST course of action for the information security manager?

Accepted Answer

Escalate the issue to the risk management committee for a decision on whether to accept, mitigate, or defer the risk.. Given the risk owner's refusal and the high residual risk exceeding appetite, the security manager should formally escalate to the risk management committee for a final decision, as per the established governance process. This ensures proper oversight and documentation.

Answer

Conduct a detailed cost-benefit analysis to convince the risk owner to upgrade, but do not escalate until the analysis is complete.

Answer

Accept the risk owner's decision and update the risk register to reflect the deferred treatment with a note of the risk owner's acceptance.

Answer

Implement a compensating control, such as strong application-layer encryption, to reduce the residual risk to an acceptable level without upgrading TLS.

Question 12

A multinational corporation with a decentralized information security program has recently experienced a data breach involving customer PII. The breach originated from a regional office that had not implemented the global security baseline due to local IT staff claiming 'unique operational requirements.' The CISO has tasked the security manager with revising the program to prevent recurrence. The organization has 12 regional offices, each with its own IT leadership, and a central security team. The budget is tight, and there is resistance to centralized control. Which of the following is the BEST course of action for the security manager?

Accepted Answer

Establish a mandatory global security baseline with a formal exception process requiring CISO approval for any deviation. Option A is correct because establishing a mandatory global baseline with a formal exception process ensures consistency while allowing for justified deviations that are formally approved. Option B is wrong because allowing each office to maintain its own program would perpetuate the fragmentation that led to the breach. Option C is wrong because increasing audits may detect issues but does not prevent them without enforceable standards. Option D is wrong because training alone does not address the root cause of non-compliance.

Answer

Increase the frequency of security audits for all regional offices

Answer

Provide additional training to regional IT staff on the importance of security baselines

Answer

Allow each regional office to maintain its own security program as long as it meets minimum standards

Question 13

A global financial services firm with 15,000 employees has recently experienced a significant data breach due to inadequate oversight of third-party vendors. The breach originated from a cloud service provider that had been granted elevated access without a formal risk assessment or contract review. The board has directed the CISO to overhaul the information security governance framework to prevent recurrence. Currently, the organization has a decentralized security model where each business unit manages its own vendor relationships. The CISO proposes a centralized governance body. Which of the following is the BEST course of action to establish effective governance over third-party risk?

Accepted Answer

Establish a central third-party risk management program with a defined policy and vendor assessment process. Option C is correct because it directly addresses the root cause: lack of oversight. A formal third-party risk management (TPRM) program with centralized policies and vendor assessments provides consistent governance. Option A (contract clauses) is reactive and not comprehensive; Option B (training) addresses awareness but not process; Option D (penetration testing) is a technical control, not governance.

Answer

Conduct quarterly penetration tests on all third-party systems

Answer

Provide annual security awareness training for employees managing vendors

Answer

Mandate that all vendor contracts include data protection clauses

Question 14

You are the information security manager for a mid-sized e-commerce company with 500 employees. The company recently experienced a data breach where an attacker exploited a vulnerability in a third-party payment processing API, resulting in the exposure of 10,000 customer credit card numbers. The breach was detected by an external forensics team 90 days after the initial compromise. The board is concerned about the company's ability to detect and respond to incidents. Currently, the company has a part-time security team of three people who focus on firewall management and antivirus updates. There is no formal incident response plan, and security monitoring is limited to basic log review once a week. The CISO has asked you to recommend a course of action to improve the security posture, with a focus on governance and oversight. Which of the following is the BEST course of action?

Accepted Answer

Develop and implement an incident response plan, establish a security operations center (SOC) with 24/7 monitoring, and define clear roles and responsibilities.. Option B is correct because the core governance issue is the lack of a formal incident response plan and adequate monitoring. Establishing a SOC with 24/7 monitoring directly addresses the 90-day detection gap, while defining roles and responsibilities ensures accountability and oversight, which are key governance principles. This approach aligns with the CISM focus on establishing processes and oversight rather than just deploying technology.

Answer

Immediately implement a PCI DSS compliance program to ensure all payment data handling meets industry standards.

Answer

Purchase and deploy a next-generation firewall and endpoint detection and response (EDR) tools across the network.

Answer

Outsource all security operations to a managed security service provider (MSSP) with a focus on threat intelligence.

Question 15

You are a security analyst for a mid-sized e-commerce company. The company uses a cloud-based email service. Several employees report receiving phishing emails that appear to come from the CEO, asking them to purchase gift cards. The emails have a spoofed sender address but pass SPF and DKIM checks because the attacker compromised a legitimate email account. The CEO's account has been locked, but the attacker may have set up forwarding rules. You need to ensure the attacker cannot use the account further. You have the following options: A) Change the CEO's password and enable MFA, then remove any forwarding rules. B) Delete the CEO's email account and create a new one. C) Block all emails from the CEO's email address at the gateway. D) Restore the CEO's mailbox from a backup taken before the compromise. Which option is the BEST course of action?

Accepted Answer

Change password, enable MFA, and remove forwarding rules. Option D is the best course of action because the attacker has already compromised the CEO's legitimate account, bypassing SPF and DKIM. Changing the password immediately revokes the attacker's session tokens and access, enabling MFA adds an additional authentication factor to prevent re-entry, and removing any forwarding rules stops the attacker from exfiltrating emails or continuing the phishing campaign through auto-forwarding. This directly addresses the root cause—the compromised account—without disrupting business continuity.

Answer

Block the CEO's email address at the gateway

Answer

Delete the account and create a new one

Answer

Restore from backup