CISM Practice Test 37 — 15 Questions

Question 1

A company is implementing a risk management program and needs to define risk appetite. Which of the following is the MOST appropriate statement of risk appetite for a financial institution?

Accepted Answer

The organization will accept up to $5M in potential loss for operational risks. A risk appetite statement for a financial institution must be quantifiable and specific to operational risk, aligning with regulatory frameworks like Basel III which require explicit loss thresholds. Stating a maximum acceptable loss of $5M provides a clear, measurable boundary for risk-taking decisions, enabling the board and management to balance risk and reward effectively.

Answer

The organization will mitigate all risks to a low level

Answer

The organization will not invest in high-risk projects

Answer

The organization accepts no level of risk

Question 2

Which of the following are essential components of an information security program governance framework? (Select TWO.)

Accepted Answer

A security steering committee with executive representation.. A security steering committee with executive representation is essential because it provides strategic oversight, aligns security initiatives with business objectives, and ensures resource allocation and governance accountability. This committee typically includes C-level executives who approve security policies, review risk posture, and enforce compliance across the organization.

Answer

A formal risk appetite statement.

Answer

An incident response plan.

Question 3

Which security control framework is organized into Implementation Groups (IG1, IG2, IG3) based on organizational risk profile and resources?

Accepted Answer

CIS Controls v8. The CIS Controls v8 (Center for Internet Security Critical Security Controls) are organized into Implementation Groups (IG1, IG2, IG3) that are tailored to organizations based on their risk profile and resources. IG1 is for small organizations with limited resources, IG2 for medium, and IG3 for large organizations with mature security programs. This structure is unique to CIS Controls.

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Question 4

During a DDoS attack, the incident response team determines that the attack cannot be mitigated within the maximum tolerable downtime (MTD). What should happen next?

Accepted Answer

Activate business continuity and disaster recovery plans. When a DDoS attack cannot be mitigated within the Maximum Tolerable Downtime (MTD), the organization has exhausted its incident response capability and the outage will exceed the threshold the business can absorb. At that point, the correct action is to transition from incident response to business continuity and disaster recovery (BC/DR) — activating alternate processing sites, failover systems, or manual workarounds to keep critical business functions running. This is the standard escalation path defined in the Business Impact Analysis (BIA) and BC/DR plans.

Answer

Notify the board of directors

Answer

Continue current mitigation efforts

Answer

Declare a disaster immediately

Question 5

A security manager is developing OKRs for the security team. Which TWO key results are appropriate leading indicators? (Select TWO)

Accepted Answer

Complete 100% of privileged access reviews quarterly. Option A is correct because completing 100% of privileged access reviews quarterly is a proactive, measurable activity that the security team directly controls and that reduces the likelihood of credential misuse before any incident occurs, making it a classic leading indicator. Option D is correct because achieving 95% patch compliance within 30 days of release is likewise an actionable, preventive process metric that the team can drive and that lowers exploitability of known CVEs, so it predicts future risk reduction. By contrast, option B (zero critical vulnerabilities in external scans) is an outcome/target state rather than a controllable activity, option C (reduce data breaches by 20%) is a lagging outcome that only materializes after incidents, and option E (decrease MTTD to under 1 hour) measures detection performance after events have already occurred, so all three are lagging or outcome-oriented rather than leading indicators.

Answer

Achieve zero critical vulnerabilities in external scans

Answer

Reduce number of data breaches by 20%

Answer

Decrease mean time to detect (MTTD) to under 1 hour

Question 6

An organization's IR plan is tested annually. After a test, many gaps are identified. What is the best next step?

Accepted Answer

Update the IR plan based on lessons learned and schedule a follow-up test. Updating the plan based on lessons learned and scheduling a follow-up test improves preparedness.

Answer

Train all employees on the plan

Answer

Wait for the next scheduled test in one year

Answer

Purchase additional security tools

Question 7

A policy exception management process allows a business unit to temporarily deviate from a security policy. What is the MOST important requirement for such an exception?

Accepted Answer

Implementation of compensating controls. The most important requirement for a policy exception is the implementation of compensating controls. While documentation, approval, and expiration are important, compensating controls ensure that the risk introduced by the exception is mitigated to an acceptable level. Without compensating controls, the exception could expose the organization to unacceptable risk, undermining the purpose of the policy.

Answer

Documentation of the exception

Answer

Approval by the CISO only

Answer

A fixed expiration date

Question 8

When designing phishing simulations, which approach best balances user learning and operational disruption?

Accepted Answer

Start with low-difficulty simulations, increase difficulty over time, and require remediation training for clickers. A progressive difficulty model — starting easy, increasing over time, and requiring remediation training for clickers — balances learning with operational disruption. It builds user awareness gradually, reinforces learning through targeted training, and avoids overwhelming users with high-difficulty simulations that could cause frustration or distrust. This approach aligns with adult learning principles and security awareness best practices.

Answer

Send high-difficulty simulations monthly without training

Answer

Use low-difficulty simulations quarterly with no follow-up

Answer

Send random-difficulty simulations weekly and report clickers to management

Question 9

An organization has experienced a credential compromise incident. Which playbook should the incident response team primarily use?

Accepted Answer

Credential compromise playbook. Playbooks are tailored to incident types; credential compromise has its own specific playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 10

Following a ransomware incident where data was encrypted and exfiltrated, the root cause analysis reveals that the initial access occurred through a phishing email that bypassed email filters due to a misconfiguration. The misconfiguration was not identified because the security team lacked a formal process to review firewall rule changes. Which of the following is the most appropriate management/governance failure to document in the lessons learned?

Accepted Answer

The security team did not have a change management process for security control configurations.. The technical cause is the phishing email, the process failure is the lack of review of email filter configurations, and the management/governance failure is the absence of a change management process for security controls.

Answer

Employees should have been trained to recognize phishing emails.

Answer

The email filter vendor did not provide adequate support.

Answer

The incident response plan was not followed during the incident.

Question 11

When selecting security controls, a company must prioritize which controls first?

Accepted Answer

Controls that address the highest risks and are critical to business operations. Controls should be prioritized based on their ability to address the highest risks and support critical business operations. CISM emphasizes a risk-based approach where resources are allocated to mitigate the most significant threats first, ensuring that security investments align with business objectives and risk appetite. This prevents wasted effort on low-impact controls while critical exposures remain unaddressed.

Answer

Controls that are least expensive

Answer

Controls that are easiest to implement

Answer

All controls from the chosen framework equally

Question 12

An organization is preparing for a potential supply chain incident. According to CISM best practices, which THREE elements should be included in the supply chain incident playbook? (Select THREE.)

Accepted Answer

Procedures for isolating affected systems and networks.. Option B is correct because a supply chain incident playbook must include containment procedures that isolate compromised systems and network segments (e.g., disabling switch ports, applying ACLs, or quarantining VLANs) to prevent lateral movement and further propagation from a compromised vendor. Option D is correct because timely, pre-approved communication templates ensure consistent notification of affected partners and customers, satisfying contractual, regulatory, and reputational obligations during a supply chain breach. Option E is correct because contacting legal counsel is essential for assessing liability, regulatory reporting duties, and breach-notification requirements, and this escalation path must be predefined in the playbook. Option A is not appropriate because CISM best practices never prescribe ransom payment procedures; paying ransoms is discouraged and would not be a standard playbook element. Option C does not belong because a list of approved DDoS mitigation vendors is a procurement/vendor-management artifact, not a core incident response playbook element for a supply chain incident.

Answer

A step-by-step guide for paying ransoms to cybercriminals.

Answer

A list of approved vendors for DDoS mitigation services.

Question 13

An organization's incident response plan includes a ransomware playbook. After detecting ransomware on a critical server, which of the following should be the FIRST action according to best practices?

Accepted Answer

Disconnect the server from the network and isolate it.. The immediate priority in ransomware containment is to prevent lateral movement and further encryption of systems. Disconnecting the server from the network (e.g., unplugging the Ethernet cable or disabling the virtual switch port) stops the ransomware from communicating with its command-and-control (C2) server and encrypting additional network shares. This aligns with the NIST SP 800-61 incident response containment strategy, which emphasizes isolation before any other action.

Answer

Notify the CEO and legal counsel before taking any action.

Answer

Pay the ransom immediately to regain access.

Answer

Immediately reboot the server to remove the ransomware.

Question 14

A large enterprise with a centralized Security Information and Event Management (SIEM) system is experiencing a high volume of false positive alerts. The security team is overwhelmed and has started to ignore many alerts. During a recent incident, a critical alert indicating lateral movement by an attacker was missed because it was buried among hundreds of false positives. The incident escalated significantly before it was discovered. The CISO has asked the incident response manager to recommend improvements to prevent this from happening again. What should the manager recommend as the primary action?

Accepted Answer

Tune SIEM rules to eliminate known false positives. The root cause of the missed critical alert is alert fatigue caused by a high volume of false positives. Tuning SIEM correlation rules to eliminate known false positives directly reduces noise while preserving detection of genuine threats like lateral movement. This is the primary, sustainable action that improves signal-to-noise ratio without weakening detection coverage.

Answer

Increase all alert thresholds to reduce volume

Answer

Hire additional security analysts to handle the load

Answer

Disable all non-critical alert categories

Question 15

Which TWO of the following are essential components of an incident response programme?

Accepted Answer

Incident response plan. An incident response plan (A) is essential because it defines the documented, step-by-step procedures, roles, communication paths, and escalation criteria that guide the team through detecting, containing, eradicating, and recovering from a security incident. An incident response policy (B) is equally essential because it is the governing document that establishes the organization's mandate, scope, objectives, authority, and management commitment for incident handling, which the plan then implements. Together, the policy provides the 'why and who' while the plan provides the 'how and when,' forming the foundational pair of any incident response programme. By contrast, an annual penetration test (C) and a vulnerability scanning schedule (D) are proactive vulnerability-management activities that feed the programme but are not core structural components of it, and security awareness training (E) is a preventive control that supports the programme rather than constituting an essential incident response component.

Answer

Annual penetration test

Answer

Vulnerability scanning schedule

Answer

Security awareness training