CISM Practice Test 35 — 15 Questions

Question 1

During a policy exception review, the CISO identifies that multiple exceptions have been granted for the same control due to business constraints. What is the best course of action?

Accepted Answer

Revise the policy to accommodate the business need. When multiple exceptions are granted for the same control due to recurring business constraints, the control itself is likely misaligned with business reality, so the best action is to revise the policy to accommodate the legitimate business need. This addresses the root cause rather than repeatedly managing exceptions. It also reduces risk by bringing the activity under a formally approved, monitored policy instead of a patchwork of exceptions.

Answer

Escalate to the board for approval

Answer

Increase monitoring of excepted systems

Answer

Reject all future exceptions for that control

Question 2

Refer to the exhibit. A security manager notices that several contractors have been granted access to a financial system without documented exceptions. Based on the policy, what is the most likely governance deficiency?

Accepted Answer

Lack of documentation for approved exceptions.. The policy requires documented exceptions for any access granted outside standard provisioning rules. The security manager observed that contractors had access without such documentation, which directly violates the governance requirement for maintaining an audit trail of approved exceptions. Without this documentation, the organization cannot demonstrate that access was properly authorized, creating a compliance gap.

Answer

The policy does not specify quarterly review of access rights.

Answer

The data owner did not approve the exceptions.

Answer

Contractors should not have any access to financial systems.

Question 3

An organization is designing a third-party risk management (TPRM) program. They have identified a vendor that stores sensitive customer data. According to best practices, what should be the minimum requirement for this vendor's contract?

Accepted Answer

Contractual security requirements and right to audit. For a vendor storing sensitive customer data, the contract must include explicit security requirements (e.g., encryption, access controls, breach notification) and a right to audit, which gives the organization the legal ability to verify compliance. This is the minimum contractual safeguard recommended by TPRM best practices. Without these clauses, the organization has no enforceable mechanism to ensure the vendor protects data.

Answer

Vendor's insurance certificate

Answer

Annual self-assessment questionnaire only

Answer

SOC 2 Type II report without contractual clauses

Question 4

A multinational corporation has a decentralized information security program. Each business unit has its own security team and budget, and they report to their respective business unit leaders. The CISO has limited authority over these teams. A recent incident revealed inconsistent security controls across business units, and the board is concerned about the overall risk posture. Which of the following should the CISO recommend to improve the program's effectiveness?

Accepted Answer

Establish a federated security model with a central governance framework and common standards, while allowing business units to implement controls tailored to their specific risks.. A federated security model with central governance and common standards addresses the inconsistency while respecting the decentralized structure. It allows the CISO to set minimum requirements and oversight without stripping business units of their autonomy. This approach is practical given the CISO's limited authority and the need for tailored controls based on specific business unit risks.

Answer

Implement a security awareness program across all business units to improve adherence to policies.

Answer

Outsource all security operations to a managed security service provider (MSSP) to achieve uniform controls.

Answer

Centralize all security functions under the CISO to ensure consistent implementation of controls.

Question 5

During third-party risk assessment, a vendor is found to have access to sensitive customer data. The vendor's own supply chain includes a critical fourth-party component. What is the BEST way to address this nth-party risk?

Accepted Answer

Request the vendor to assess and pass through security requirements to its suppliers. The organization cannot directly assess every fourth party in its vendor's supply chain, but it can contractually require the vendor to flow down security requirements and assess its own suppliers. This is the standard nth-party risk management approach recommended by frameworks like NIST SP 800-161 and ISO 28000. It maintains accountability through the vendor while extending controls to the fourth party.

Answer

Ignore the fourth party as it is outside the organization's scope

Answer

Conduct a direct assessment of the fourth party

Answer

Terminate the contract with the vendor

Question 6

Which document should be reviewed and updated at least annually?

Accepted Answer

Incident response plan. The incident response plan is a living document that must be reviewed and updated at least annually to reflect changes in the organization's environment, threat landscape, and lessons learned from incidents. Regular updates ensure that contact information, escalation procedures, and response strategies remain current and effective. This annual review is a core requirement of frameworks like NIST SP 800-61 and ISO 27001.

Answer

Vendor contracts

Answer

Network topology diagram

Answer

User manuals

Question 7

Which board-level committee typically receives security reports to provide oversight?

Accepted Answer

Audit/risk committee. The audit/risk committee is typically responsible for overseeing risk management, internal controls, and compliance, making it the natural board-level committee to receive security reports. This committee ensures that security risks are aligned with the organization's risk appetite and that mitigation strategies are effective. Other committees like nominating or compensation focus on governance structure and executive pay, not security oversight.

Answer

Nominating committee

Answer

Compensation committee

Answer

Finance committee

Question 8

Which of the following is a LEADING indicator of security performance?

Accepted Answer

Patch compliance percentage. Patch compliance percentage is a leading indicator because it measures proactive security hygiene—the proportion of systems with current patches—which predicts future breach likelihood. Leading indicators are forward-looking and actionable, allowing organizations to prevent incidents before they occur. MTTD, incident counts, and breach costs are lagging indicators that measure past performance.

Answer

Cost of a data breach

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 9

A CISO is establishing an information security governance framework for a financial services firm. The board has asked for assurance that the framework will effectively manage risk and comply with regulations such as GDPR and PCI DSS. Which of the following are essential components of an effective information security governance framework? (Choose two.)

Accepted Answer

A comprehensive set of security policies and standards.. An effective information security governance framework must include a documented risk appetite statement approved by executive management and a comprehensive set of security policies and standards. The risk appetite guides risk-based decisions and ensures alignment with business strategy, while policies and standards establish the rules and expectations for protecting information. These components provide direction, oversight, and accountability, which are the hallmarks of governance.

Answer

A formal security awareness and training program for all employees.

Answer

A real-time security operations center (SOC) with 24/7 monitoring.

Answer

A detailed inventory of all IT assets with assigned owners.

Question 10

Which TWO of the following are key performance indicators (KPIs) for measuring the effectiveness of an information security program?

Accepted Answer

Mean time to detect (MTTD) security incidents.. Option B is correct because Mean Time to Detect (MTTD) is a recognized operational security KPI that quantifies how quickly an organization identifies security incidents, directly reflecting the effectiveness of monitoring, SIEM, and detection capabilities. Option D is correct because the percentage of critical systems patched within 30 days is a vulnerability-management KPI that measures how promptly known vulnerabilities are remediated, a core indicator of an information security program's preventive effectiveness. Option A is not a true effectiveness KPI because counting approved policies measures documentation activity, not whether controls actually reduce risk or improve security outcomes. Option C is unrelated to security program performance, as employee satisfaction is an HR metric rather than a security indicator. Option E is a budgeting/spending ratio that describes resource allocation, not the effectiveness of the security program's controls or outcomes.

Answer

Number of security policies approved.

Answer

Employee satisfaction score from annual survey.

Answer

Percentage of security budget spent on tools.

Question 11

During an incident investigation, the response team discovers that the attacker exploited a known vulnerability for which a patch was available but not applied. What should be the team's primary focus during the recovery phase?

Accepted Answer

Applying the missing patch and ensuring all systems are updated.. The primary goal of the recovery phase is to restore secure operations and prevent recurrence. Applying the missing patch directly remediates the exploited vulnerability, eliminating the attacker's entry point and hardening the system against future exploitation of that specific CVE. This aligns with the NIST SP 800-61 recovery step of 'removing artifacts and restoring systems to a secure state'.

Answer

Disciplining the employee responsible for patch management.

Answer

Conducting a lessons-learned meeting.

Answer

Reporting the incident to law enforcement.

Question 12

A security analyst detects unusual outbound traffic from a critical server to an unknown external IP address during business hours. Which step should be taken FIRST in the incident response process?

Accepted Answer

Contact the server owner to verify the traffic. The first step in incident response is to verify and validate the alert. Contacting the server owner to confirm whether the outbound traffic is authorized prevents unnecessary disruption and false positives. This aligns with the NIST SP 800-61 incident response lifecycle, where identification and initial triage precede containment or escalation.

Answer

Notify law enforcement about the potential breach

Answer

Isolate the server from the network immediately

Answer

Report the incident to senior management

Question 13

Which TWO of the following are key components of an effective incident response plan?

Accepted Answer

A clear chain of command and escalation procedures.. Option A is correct because an effective incident response plan must define a clear chain of command and escalation procedures, ensuring that roles, decision authority, and handoff paths (for example, from Tier 1 to Tier 2 to the IR lead) are unambiguous during a high-pressure event. Option D is correct because a communication plan for internal and external stakeholders governs who is notified, when, and through which channels, covering obligations such as breach notification to regulators, customers, and law enforcement, and preventing conflicting or premature disclosures. Options B and C are not key components: automated detection and response tools are supporting technologies that enable the plan rather than constituting it, and predefined scripts for every possible incident are impractical since incidents vary and rigid scripts can hinder adaptive response.

Answer

Automatic detection and response tools.

Answer

Predefined response scripts for every possible incident.

Question 14

A global e-commerce company is designing its information security program. The CISO wants to implement a defense-in-depth strategy for the web application layer. Which combination of controls best achieves this objective?

Accepted Answer

WAF, input validation, and security logging. Defense-in-depth for the web application layer requires multiple overlapping controls: a WAF filters malicious HTTP traffic, input validation prevents injection attacks at the application layer, and security logging provides detection and forensic capability. Together they address prevention, detection, and response. This combination covers network, application, and monitoring layers.

Answer

SSL/TLS encryption and VPN access

Answer

Web application firewall (WAF) and intrusion detection system (IDS)

Answer

Regular patching and vulnerability scanning

Question 15

An organization is designing a security metrics dashboard for the board of directors. Which THREE metrics are most appropriate for board-level reporting?

Accepted Answer

Patch compliance percentage for critical systems. Option B (Patch compliance percentage for critical systems) is correct because it expresses vulnerability-management effectiveness as a single risk-oriented ratio the board can track over time, showing how much of the most important estate is protected rather than raw operational detail. Option C (Mean time to respond (MTTR) to incidents) is correct because it is a standard resilience KPI that quantifies how quickly the organization contains and recovers from incidents, which is a governance-level measure of response capability. Option E (Security investment as a percentage of IT budget) is correct because it frames security spending in business and financial terms, letting the board judge whether resourcing is proportionate to risk appetite and peer benchmarks. Option A is not appropriate because average patch age in days is a granular operational/tactical metric better suited to security operations or IT management than the board. Option D is not appropriate because the raw daily count of intrusion detection alerts is a high-volume operational metric that reflects sensor tuning and noise, not strategic security posture or business risk.

Answer

Average age of security patches in days

Answer

Number of intrusion detection alerts per day