CISM Practice Test 36 — 15 Questions

Question 1

An organization has experienced a ransomware attack that encrypted critical servers. The incident has been classified as P1. Which of the following is the FIRST action the incident response team should take according to the IR plan?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Contain the incident by isolating affected systems from the network.. For a P1 incident, the IR plan dictates immediate containment to prevent further spread, followed by notification to the executive sponsor and activation of the crisis management team.

Answer

Perform root cause analysis to determine how the ransomware entered.

Answer

Begin forensic imaging of all affected servers for evidence preservation.

Answer

Notify the CEO and activate the crisis management team.

Question 2

An organization is determining the risk treatment for a critical business process that has a high inherent risk. Which of the following is the MOST effective risk treatment strategy when the cost to mitigate exceeds the potential loss?

Accepted Answer

Risk acceptance. Risk acceptance is the most effective strategy when the cost to mitigate exceeds the potential loss, as it is more cost-effective to accept the risk rather than spend more on controls than the expected loss. Risk avoidance (A) is incorrect because it would mean discontinuing the critical business process, which may not be feasible or desirable. Risk reduction (B) is incorrect because it involves implementing controls that are not cost-effective in this scenario. Risk transfer (D) is incorrect because transferring risk (e.g., via insurance) may still involve premiums that exceed the potential loss or are otherwise not cost-justified.

Answer

Risk avoidance

Answer

Risk reduction

Answer

Risk transfer

Question 3

A financial institution has an incident involving a suspected data breach of customer PII. The incident response team contains the breach. What should be the NEXT priority according to legal and regulatory requirements?

Accepted Answer

Assess the extent of the breach.. After containment, legal and regulatory requirements typically mandate assessing the scope and impact of the breach to determine notification obligations and regulatory reporting. This assessment is critical for prioritizing next steps such as customer notification (C) and public relations (B), which follow after the extent is known. Root cause analysis (D) is important but is a later step in the incident management process.

Answer

Engage a public relations firm.

Answer

Notify affected customers.

Answer

Perform a root cause analysis.

Question 4

Refer to the exhibit.
The exhibit shows network traffic from a server to a database. What does this pattern MOST likely indicate?

Accepted Answer

SQL injection attempt. The exhibit shows a pattern of repeated SQL query-like strings in the network traffic, such as 'SELECT * FROM users WHERE id = 1 OR 1=1', which is a classic SQL injection payload. This indicates an attacker is attempting to manipulate the SQL query to bypass authentication or extract data, not a normal application load or performance issue. The sudden spike in similar requests with malicious syntax confirms an active SQL injection attempt.

Answer

Query optimization issue

Answer

Normal application load

Answer

Database server crash

Question 5

An organization has experienced a P2 incident. According to standard incident severity definitions, which response timeframe is typically expected?

Accepted Answer

Response during business hours. P2 (high) incidents require a response during business hours, as they have significant but not critical impact.

Answer

Scheduled remediation at the next maintenance window

Answer

Response within 72 hours

Answer

24/7 response until resolved

Question 6

When an incident cannot be resolved within the maximum tolerable downtime (MTD), what is the appropriate action regarding business continuity and disaster recovery (BC/DR)?

Accepted Answer

Escalate to the BC/DR team for possible activation of continuity plans. If the MTD is at risk, the incident response team should escalate to BC/DR to activate continuity or recovery plans. This ensures business functions are restored.

Answer

Ignore the MTD and focus solely on incident eradication

Answer

Continue incident response until full recovery

Answer

Declare a disaster immediately without further analysis

Question 7

Which is a key component of an information security program?

Accepted Answer

Security policy. A security policy is the foundational component of an information security program because it defines the organization's strategic direction, governance structure, and high-level principles for protecting information assets. Unlike specific technologies (encryption, firewalls, antivirus), the policy establishes the rules, roles, and responsibilities that drive the selection and implementation of all security controls. Without a policy, technical measures lack context, authority, and alignment with business objectives.

Answer

Encryption technology

Answer

Firewall

Answer

Antivirus software

Question 8

During a major cybersecurity incident, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). Which of the following actions should be taken next?

Accepted Answer

Declare a disaster and activate the BC/DR plan. When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation to restore operations.

Answer

Conduct a root cause analysis

Answer

Notify the executive sponsor and continue response efforts

Answer

Increase the number of incident responders

Question 9

When implementing security controls, which approach ensures that multiple layers of defense are applied so that if one control fails, others compensate?

Accepted Answer

Defense-in-depth. Defense-in-depth (option D) is the correct approach because it implements multiple, overlapping layers of security controls (e.g., firewalls, IDS/IPS, endpoint protection, access controls) so that if one layer fails or is bypassed, subsequent layers continue to provide protection. This layered strategy reduces the likelihood of a single point of failure compromising the entire security posture, aligning with the CISM principle of risk mitigation through redundancy.

Answer

Business-enabling controls

Answer

Critical controls first

Answer

Compensating controls

Question 10

Which TWO of the following are key components of an effective incident response plan?

Accepted Answer

A clear chain of command and escalation procedures.. A clear chain of command and escalation procedures ensure that during an incident, decision-making authority and notification paths are predefined, reducing confusion and enabling rapid, coordinated response. This aligns with NIST SP 800-61 incident response guidelines, which emphasize the need for defined roles and communication hierarchies to avoid delays or missteps in critical situations.

Answer

Automatic detection and response tools.

Answer

Predefined response scripts for every possible incident.

Question 11

During an incident, the incident response team needs to preserve evidence for legal proceedings. Which of the following is the MOST important action to take?

Accepted Answer

Create a forensic image of affected systems using write-blockers.. Creating a forensic image of affected systems using write-blockers is the most important action because it preserves the original data in a bit-for-bit, unaltered state, ensuring the evidence is admissible in legal proceedings. Write-blockers prevent any write operations to the source drive, maintaining the integrity of the evidence chain of custody. Without a forensically sound image, any subsequent analysis could be challenged as tampered or unreliable.

Answer

Document the incident in a free-form text.

Answer

Take screenshots of system logs.

Answer

Notify law enforcement immediately.

Question 12

A multinational corporation is designing a global information security program. Which governance structure best ensures consistent security while allowing regional flexibility?

Accepted Answer

Federated governance: global standards with local implementation and oversight.. Federated governance (Option C) is the correct choice because it establishes a global security framework with mandatory standards (e.g., ISO 27001 controls, encryption baselines like AES-256) while delegating implementation and oversight to regional units. This structure balances consistency with local legal requirements (e.g., GDPR in Europe, PIPL in China) and operational needs, avoiding the rigidity of full centralization or the fragmentation of full decentralization.

Answer

Outsource security governance to a managed security service provider (MSSP).

Answer

Fully centralized security governance with global standards enforced uniformly.

Answer

Fully decentralized security governance, each region independent.

Question 13

During the detection and analysis phase of incident response, which two activities are essential? (Choose two.)

Accepted Answer

Identifying indicators of compromise.. Options A and E are correct because identifying indicators of compromise and determining the scope of the incident are key activities during the detection and analysis phase. Option C (notifying regulatory bodies) occurs later, typically after containment and eradication. Restoration (B) and patching (D) are part of the recovery phase.

Answer

Restoring systems from backup.

Answer

Notifying regulatory bodies.

Answer

Applying security patches.

Question 14

Which TWO of the following are key indicators that an organization's information security governance is effective?

Accepted Answer

High percentage of risk treatment plans implemented on time.. Timely implementation of risk treatment plans directly demonstrates that the organization is actively managing identified risks according to its risk appetite and governance framework. Effective governance requires not just planning but execution; a high percentage of on-time plan completion indicates that risk owners are accountable and that the risk management process is operational, which is a core objective of information security governance.

Answer

Low variance between the approved security budget and actual spending.

Answer

The number of security policies that have been published.

Answer

High completion rate for security awareness training.

Question 15

A financial institution is designing an incident response plan. They want to ensure that during a ransomware incident, critical transaction systems can be restored within 4 hours. Which metric should be used to measure this requirement?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable downtime after a disaster or incident, which directly aligns with the requirement to restore critical transaction systems within 4 hours. In incident management, RTO is the metric used to set the target for system recovery, ensuring business continuity. For ransomware incidents, RTO drives the restoration strategy and resource allocation to meet the 4-hour window.

Answer

Mean Time to Repair (MTTR)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)