CISM Practice Test 35 — 15 Questions

Question 1

During an incident, the CIRT leader decides to contain a compromised server by disconnecting it from the network. However, this action may result in loss of volatile forensics data. What should the CIRT leader do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Collect volatile data (memory, processes) before disconnecting. Volatile data (e.g., memory contents, running processes, network connections) is lost when power is removed or the network interface is disabled. The CIRT leader must follow the order of volatility (RFC 3227) and capture this data first to preserve forensic evidence before containment actions that alter the system state.

Answer

Proceed with disconnection immediately to prevent further damage

Answer

Keep the server connected but block all inbound/outbound traffic

Answer

Perform a full disk imaging before disconnection

Question 2

During a major cybersecurity incident, the crisis management team (CMT) is activated. Which THREE roles are typically part of the CMT? (Select THREE.)

Accepted Answer

Chief executive officer (CEO). The CEO is correct because as the highest-ranking executive, they provide strategic direction, authorize critical decisions (e.g., public disclosure, resource allocation), and serve as the primary liaison to the board of directors during a major incident. The GC is correct because they manage legal risks, ensure compliance with breach notification laws (e.g., GDPR, CCPA), and oversee communications with regulators and law enforcement. The CFO is correct because they assess financial impacts, approve emergency budgets, and coordinate with insurance carriers for cyber liability claims.

Answer

Security analyst

Answer

Incident response manager

Question 3

A CISO is building a business case for a new security tool. Which approach BEST quantifies the value of the investment?

Accepted Answer

Risk reduction value and breach cost avoidance. Comparing the cost of the tool against the average cost of a data breach (e.g., $4.35M) provides a clear financial justification.

Answer

Industry analyst recommendations

Answer

Number of features compared to competitors

Answer

Total cost of ownership (TCO) analysis

Question 4

Which of the following is a LEADING indicator of security performance?

Accepted Answer

Patch compliance percentage. Leading indicators predict future performance. Patch compliance measures proactive security posture.

Answer

Cost of a data breach

Answer

Mean time to respond (MTTR)

Answer

Number of security incidents

Question 5

In a security operations center (SOC), which function is PRIMARILY responsible for analyzing alerts and determining whether they represent actual security incidents?

Accepted Answer

Tier 2 SOC analyst. Tier 2 SOC analysts are primarily responsible for deep-dive analysis of alerts escalated from Tier 1, using threat intelligence, log correlation, and forensic techniques to determine if an alert represents a genuine security incident. They possess the technical expertise to differentiate false positives from true positives by examining raw packet captures, endpoint artifacts, and SIEM event details that Tier 1 analysts may lack the context or authority to investigate fully.

Answer

Tier 1 SOC analyst

Answer

Incident response manager

Answer

Security architect

Question 6

Refer to the exhibit. An information security manager reviews the risk register and sees that Risk ID R001 has a residual risk of High with a treatment of Accept. Which of the following best explains why this situation may indicate a governance failure?

Accepted Answer

Accepting a high residual risk likely exceeds the board-approved risk appetite.. Accepting a high residual risk means the organization has decided to tolerate a level of risk that likely exceeds the board-approved risk appetite. This is a governance failure because the board sets the risk appetite, and management must ensure that all accepted risks fall within that threshold. If the residual risk is high and the treatment is 'Accept,' it indicates a disconnect between the risk acceptance process and the governance framework.

Answer

The risk register should not contain risks with residual risk above low.

Answer

The control effectiveness rating of 'Partially effective' is too vague.

Answer

The risk owner should be a business unit head, not the CISO.

Question 7

Refer to the exhibit. A system administrator reviews the log and notices repeated failed SSH attempts from the same IP address. What is the most appropriate risk response?

Accepted Answer

Implement account lockout after 3 failed attempts.. Implementing an account lockout policy after 3 failed attempts directly mitigates brute-force SSH attacks by preventing further authentication attempts from the same IP address. This is a standard risk response (risk reduction) that limits the attacker's ability to guess credentials without requiring changes to the SSH protocol or disabling remote access entirely.

Answer

Change the password policy to require 12-character passwords.

Answer

Increase logging verbosity to capture more details.

Answer

Disable SSH access and use console only.

Question 8

An organization's intrusion detection system alerts on a potential C2 communication from an internal host. Which phase of the incident response lifecycle should be initiated first?

Accepted Answer

Detection and Analysis. When an IDS alerts on potential C2 communication, the organization must first verify the alert and determine the scope of the incident. The Detection and Analysis phase is the initial step in the incident response lifecycle, as defined by NIST SP 800-61, because it involves confirming the alert, analyzing indicators of compromise (IoCs), and assessing the severity before any containment actions are taken. Without proper detection and analysis, containment efforts could be misdirected or ineffective.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 9

During an incident investigation, the response team discovers that the attacker exploited a known vulnerability for which a patch was available but not applied. What should be the team's primary focus during the recovery phase?

Accepted Answer

Applying the missing patch and ensuring all systems are updated.. The primary goal of the recovery phase is to restore secure operations and prevent recurrence. Applying the missing patch directly remediates the exploited vulnerability, eliminating the attacker's entry point and hardening the system against future exploitation of that specific CVE. This aligns with the NIST SP 800-61 recovery step of 'removing artifacts and restoring systems to a secure state'.

Answer

Disciplining the employee responsible for patch management.

Answer

Conducting a lessons-learned meeting.

Answer

Reporting the incident to law enforcement.

Question 10

An organization is updating its incident response plan. Which TWO components are essential to include for effective insider threat management? (Select TWO.)

Accepted Answer

Procedures for coordinating with human resources and legal departments.. Insider threats require specific playbooks and involvement of HR and legal for proper handling.

Answer

A dedicated ransomware recovery procedure.

Answer

A list of all employee passwords for investigation purposes.

Answer

Contact information for the DDoS mitigation service provider.

Question 11

During a security program review, the auditor finds that incident response procedures have not been tested in over two years. What is the MOST significant risk arising from this finding?

Accepted Answer

Ineffective response leading to greater damage during an incident. Untested incident response procedures may be ineffective or outdated, leading to a failed response during an actual incident, which can result in greater damage. This is the most significant risk because it directly impacts the organization's ability to contain and mitigate incidents. Option A (non-compliance) is possible but not the most significant risk. Option B (higher costs) is a secondary consequence. Option C (increased recovery time) is a symptom of ineffective response but not as severe as the potential for greater damage.

Answer

Non-compliance with regulatory requirements

Answer

Higher financial costs due to inefficiencies

Answer

Increased recovery time after an incident

Question 12

An organization has a security program that is aligned with ISO 27001. During an internal audit, it is discovered that several controls are not being applied consistently across all departments. The MOST effective corrective action is to:

Accepted Answer

Establish a centralized security oversight function. The core issue is inconsistent control application across departments, which indicates a lack of governance and oversight rather than a policy or awareness deficiency. Establishing a centralized security oversight function directly addresses this by creating a single authority to enforce, monitor, and standardize control implementation, ensuring alignment with ISO 27001 requirements for management commitment and resource allocation (Clause 5.1 and 7.1). This corrective action provides the necessary organizational structure to drive consistent execution, which is the most effective long-term solution.

Answer

Update the information security policy

Answer

Increase security awareness training frequency

Answer

Conduct a risk assessment for each department

Question 13

A security program lacks executive support. What is the best strategy to gain support?

Accepted Answer

Show risk quantification in business terms. C is correct because executive stakeholders prioritize business outcomes over technical details. By quantifying risks in financial terms (e.g., potential loss exposure, ROI of mitigation), the security manager aligns with the organization's strategic language, making the case for investment compelling and actionable. This approach directly addresses the root cause—lack of perceived business value—rather than relying on technical arguments or fear.

Answer

Hire a security consultant to advise

Answer

Implement quick-win security improvements

Answer

Threaten regulatory fines for non-compliance

Question 14

Which TWO of the following are essential components of a security program governance structure?

Accepted Answer

Security charter. Options A and C are correct. A security charter establishes the authority and scope of the security program, forming a foundational governance document. A security steering committee provides oversight and strategic direction, ensuring alignment with business objectives. Option B (vulnerability scanning schedule) is an operational activity, not part of governance. Option D (incident response plan) is an operational plan, not a governance component. Option E (help desk ticketing system) is a tool for operational support, not governance.

Answer

Vulnerability scanning schedule

Answer

Incident response plan

Answer

Help desk ticketing system

Question 15

A security manager is designing a metrics dashboard for executive management. Which of the following metrics is MOST useful for demonstrating the value of the security program?

Accepted Answer

Mean time to detect incidents. Mean time to detect (MTTD) incidents is a direct measure of the security program's effectiveness in identifying threats, which demonstrates its value by showing how quickly the organization can respond to potential breaches. Metrics like budget percentage (A), patches applied (B), or policies created (C) are operational or input-focused and do not reflect the program's outcome or business impact.

Answer

Percentage of budget spent on security

Answer

Number of security patches applied

Answer

Number of security policies created