CISM Practice Test 37 — 15 Questions

Question 1

A security manager is developing metrics for the C-suite dashboard. Which combination of metrics would provide the best view of security program effectiveness, including both leading and lagging indicators?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Phishing click rate and mean time to detect (MTTD). Phishing click rate is a leading indicator that measures user awareness and proactive security posture, while mean time to detect (MTTD) is a lagging indicator that reflects the efficiency of detection processes. Together, they provide a balanced view of program effectiveness for executive oversight.

Answer

Breach count and number of security tools deployed

Answer

Patch compliance and number of vulnerabilities identified

Answer

Number of security incidents and percentage of budget spent

Question 2

An information security manager reviews the suspicious activity log shown in the exhibit. The payroll file is supposed to be encrypted and only accessible internally. What is the MOST likely cause for the failed download?

Accepted Answer

The user lacked permission to decrypt the file. The status 'Encryption key not found' indicates that the user does not have the necessary decryption key, likely due to lack of permission. Option A is wrong because certificate expiry would show a different error. Option B is wrong because if the file were not encrypted, it would download successfully. Option D is wrong because if the external IP were blocked, the download would not initiate.

Answer

The user's encryption certificate has expired

Answer

The file was not encrypted before being uploaded

Answer

The external IP is blocked by the firewall

Question 3

BankOne has a mature security governance program but recently failed a regulatory audit because the board had not formally approved the risk appetite statement. The CISO argues that risk appetite is reviewed annually and was verbally approved. To prevent recurrence, what governance change is most effective?

Accepted Answer

Require board resolution for risk appetite annually. The core issue is the lack of formal, documented board approval of the risk appetite statement, which is a governance requirement. A formal board resolution, passed and recorded annually, creates an auditable record that satisfies regulatory scrutiny and ensures the board's explicit ownership of risk tolerance. This directly addresses the audit failure by moving from informal verbal approval to a legally binding, documented governance process.

Answer

Automate risk appetite monitoring

Answer

Reduce the number of risk indicators

Answer

Document all board approvals in minutes

Question 4

Which of the following are key components of a mature information security program? (Select 2)

Accepted Answer

Comprehensive risk management process. A comprehensive risk management process is a foundational component of a mature information security program because it ensures that security controls are aligned with business objectives through systematic identification, assessment, and treatment of risks. This process, often guided by frameworks like ISO 31000 or NIST SP 800-39, enables prioritization of resources based on risk appetite and tolerance, rather than relying on ad-hoc or reactive measures. Without this, the program lacks the structured governance needed to adapt to evolving threats and regulatory requirements.

Answer

Adoption of cloud security tools

Answer

Single point of failure for security decisions

Question 5

You are the CISO of a large healthcare organization that has recently experienced a data breach due to an insider who exfiltrated patient data over several months. The breach was discovered by an external partner. The organization's information security program includes data loss prevention (DLP) tools, but they were not configured to monitor outbound data from the compromised system. Additionally, user activity monitoring (UAM) was only applied to privileged users, not to regular staff. The board demands a comprehensive improvement plan that will prevent similar incidents. However, there are concerns about employee privacy and budget constraints. The organization has a strong culture of trust and minimal monitoring. Which of the following should be the first priority in the revised program?

Accepted Answer

Expand user activity monitoring to all employees with a clear policy on privacy and acceptable use.. Expanding user activity monitoring (UAM) to all users directly addresses the monitoring gap that allowed the exfiltration to go undetected for months. Implementing a clear policy on privacy and acceptable use balances security needs with employee privacy concerns. Option B (stricter access controls) is insufficient alone as it does not detect ongoing data exfiltration. Option C (new DLP solution) could be helpful but may not catch slow, low-volume exfiltration and does not address the monitoring gap. Option D (security awareness training) is important but is a long-term preventive measure and does not immediately close the detection gap.

Answer

Implement stricter access controls and review user permissions quarterly.

Answer

Deploy a new DLP solution with advanced analytics and block all external data transfers.

Answer

Conduct additional security awareness training focused on insider threats.

Question 6

A multinational financial institution uses a third-party Managed Security Service Provider (MSSP) for 24/7 monitoring of its security infrastructure. During a targeted attack, the MSSP’s analysts detected anomalous activity on a critical server at 2:00 AM. However, due to the service level agreement (SLA) which allows up to 12 hours for notification of lower-priority incidents, the MSSP classified the incident as medium severity and did not notify the internal incident response team until 2:00 PM. By then, the attacker had exfiltrated sensitive customer data. The internal team is conducting a post-incident review. What is the PRIMARY issue that led to the delay?

Accepted Answer

The SLA for notification of medium-severity incidents was too long. The primary issue was that the SLA stipulated a notification window of up to 12 hours for medium-severity incidents, which was too long given the potential for rapid data exfiltration. Even if the severity classification (medium) was technically correct based on the MSSP's guidelines, the SLA itself created an unacceptable delay. Option B (incorrect classification) may have contributed, but the root cause was the SLA's insufficient responsiveness for that severity level. Options A and C are not supported by the scenario: the MSSP analysts correctly detected the anomaly, and the internal team was presumably available when notified.

Answer

The MSSP analysts lacked technical skills to recognize the incident's true severity

Answer

The incident severity was incorrectly classified as medium

Answer

The internal incident response team was not available until 2:00 PM

Question 7

A large retail chain with hundreds of stores uses point-of-sale (POS) systems that run an outdated operating system. The annual risk assessment identified this as a high-risk issue because the OS is no longer patched and has known vulnerabilities. The business unit manager opposes replacing all POS systems immediately due to cost and potential disruption to operations. As the risk manager, you need to recommend a risk response that balances risk reduction with business continuity. Which strategy is most appropriate?

Accepted Answer

Risk mitigation: implement compensating controls and schedule a phased upgrade. Risk mitigation through compensating controls (e.g., network segmentation, strict access controls, intrusion detection) combined with a phased upgrade reduces risk while allowing continued operations. Option A is risk avoidance but is too disruptive and costly. Option D is risk transfer via insurance, but insurance does not prevent the incident or reduce the operational impact. Option C is risk acceptance without action, which is inappropriate for a high-risk issue.

Answer

Risk avoidance: immediately replace all POS systems with modern ones

Answer

Risk acceptance: accept the risk because the business cannot afford replacement

Answer

Risk transfer: purchase cyber insurance to cover potential losses from POS attacks

Question 8

You are the information security manager for a financial services company that processes credit card transactions. The company uses a mix of on-premises servers and cloud services. During a routine vulnerability scan, you discover that one of the web servers has been compromised with a web shell that allows remote command execution. The server is part of a cluster that handles customer-facing web traffic. The incident response team is activated. The team's immediate actions include isolating the server from the network and taking a forensic image. However, the server is critical for business operations, and management is pressuring you to restore service quickly. The server's logs show that the web shell was uploaded three days ago, and during that time, the server processed approximately 10,000 transactions. The team has not yet fully analyzed the forensic image. You need to decide on the next steps. What should you do FIRST?

Accepted Answer

Conduct a thorough analysis of the forensic image to determine the extent of data access and exfiltration.. Before any restoration, it is critical to conduct a thorough forensic analysis to determine the extent of the breach, including whether sensitive data (e.g., credit card numbers) was accessed or exfiltrated. This analysis informs legal, regulatory, and compliance obligations. Option A is premature without understanding the full impact of the compromise. Option B is risky as the root cause may not be fully addressed, and the backup may also be compromised. Option C may be necessary later but is not the first priority; internal investigation should precede external notification.

Answer

Wait for the next scheduled patch cycle to apply updates and then restore the server.

Answer

Restore the server from the most recent clean backup and bring it back online immediately to minimize revenue loss.

Answer

Notify the payment card industry (PCI) compliance auditor and request guidance on next steps.

Question 9

Which TWO of the following are PRIMARY goals of incident management according to industry best practices?

Accepted Answer

Restore normal operations as quickly as possible. The primary goal of incident management is to restore normal service operations as quickly as possible, minimizing the impact on business operations. This aligns with ITIL and NIST best practices, which prioritize rapid containment and recovery over other activities like documentation or investigation.

Answer

Document all steps for compliance

Answer

Assign blame to the responsible party

Answer

Increase the security budget

Question 10

A security analyst notices unusual outbound traffic from a server that is not scheduled for any data transfers. Which step should the analyst take FIRST?

Accepted Answer

Document the observation and escalate to the incident response team. The first step in incident response is to preserve evidence and follow the established escalation path. The analyst should document the observation (including source/destination IPs, ports, protocols, and timestamps) and escalate to the incident response team (IRT) to ensure a coordinated, forensically sound investigation. Premature action like blocking or isolating could destroy volatile data or alert an attacker, violating the principle of evidence preservation outlined in NIST SP 800-61.

Answer

Block the IP addresses in the outbound traffic

Answer

Immediately isolate the server from the network

Answer

Ignore as it may be a false positive

Question 11

A company is designing its information security program and wants to ensure that it meets regulatory requirements across multiple jurisdictions. Which of the following approaches is most appropriate?

Accepted Answer

Implement a regulatory compliance framework that maps controls to applicable laws and standards.. A regulatory compliance framework that maps controls to applicable laws and standards provides a structured, auditable method to address multiple, sometimes conflicting, jurisdictional requirements. This approach ensures that each control is explicitly linked to a specific legal or regulatory obligation, facilitating compliance verification and reducing the risk of oversight. It is the most comprehensive and adaptable method for a multi-jurisdictional environment, as it allows the organization to manage overlapping and unique requirements without relying on a single standard or external review alone.

Answer

Adopt ISO 27001 as the sole framework for the program.

Answer

Comply with the strictest regulation and ignore others.

Answer

Engage external legal counsel to review policies quarterly.

Question 12

A multinational financial services company is implementing a new regulatory requirement that mandates enhanced encryption for all customer data in transit. The organization currently uses TLS 1.2, but the regulation requires TLS 1.3. The risk owner for the data transmission system is the head of network operations, who believes the current controls are sufficient and argues that upgrading will cause significant downtime and cost. The information security manager has assessed the risk as high due to potential regulatory fines and reputational damage. The risk owner refuses to accept the risk and insists on deferring the upgrade. The organization has a risk appetite statement that accepts moderate residual risk only after explicit approval from the CRO. The escalation process involves the risk management committee. What is the BEST course of action for the information security manager?

Accepted Answer

Escalate the issue to the risk management committee for a decision on whether to accept, mitigate, or defer the risk.. Given the risk owner's refusal and the high residual risk exceeding appetite, the security manager should formally escalate to the risk management committee for a final decision, as per the established governance process. This ensures proper oversight and documentation.

Answer

Conduct a detailed cost-benefit analysis to convince the risk owner to upgrade, but do not escalate until the analysis is complete.

Answer

Accept the risk owner's decision and update the risk register to reflect the deferred treatment with a note of the risk owner's acceptance.

Answer

Implement a compensating control, such as strong application-layer encryption, to reduce the residual risk to an acceptable level without upgrading TLS.

Question 13

A company is assessing the risk of a critical system outage. The system has a maximum tolerable downtime (MTD) of 2 hours, but the current recovery time objective (RTO) is 4 hours. What is the most appropriate risk treatment?

Accepted Answer

Mitigate by reducing the RTO to 1 hour through process automation. The current RTO of 4 hours exceeds the MTD of 2 hours, meaning the system cannot be restored within the maximum tolerable downtime, resulting in unacceptable business impact. Reducing the RTO to 1 hour through process automation brings recovery time well within the MTD, effectively mitigating the risk to an acceptable level. This aligns with the risk management principle of applying controls to close the gap between RTO and MTD.

Answer

Transfer the risk by purchasing business interruption insurance

Answer

Accept the risk because the RTO is shorter than the MTD

Answer

Avoid the risk by replacing the system with a more reliable one

Question 14

Which control framework is structured around Implementation Groups (IG1, IG2, IG3) to help organizations prioritize security controls based on risk?

Accepted Answer

CIS Controls v8. The CIS Controls v8 framework is uniquely structured around Implementation Groups (IG1, IG2, IG3) to provide a prioritized, risk-based approach to security control implementation. IG1 represents basic cyber hygiene for organizations with limited resources, IG2 adds more advanced controls for those with moderate risk, and IG3 includes comprehensive controls for high-risk environments. This tiered structure directly aligns with the CISM focus on aligning security controls with business risk and resource constraints.

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Answer

NIST SP 800-53

Question 15

A CISO is deciding on the organizational structure for the information security team. Which reporting structure is most likely to ensure the security function has sufficient independence and authority?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board of directors ensures the information security function operates independently from operational and IT management, preventing conflicts of interest where security decisions could be overridden by cost or performance pressures. This structure aligns with the CISM principle that the CISO must have sufficient authority to enforce security policies across the entire organization without reporting to a function that may prioritize other objectives over security.

Answer

Reporting to the Chief Information Officer (CIO)

Answer

Reporting to the Chief Operating Officer (COO)

Answer

Reporting to the Chief Financial Officer (CFO)