CISM Practice Test 38 — 15 Questions

Question 1

An organization is implementing a new cloud-based ERP system. As part of the emerging risk assessment, the information security manager needs to identify potential risks associated with the cloud migration. Which THREE of the following should be considered as part of the emerging risk assessment for cloud adoption?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data residency and regulatory compliance requirements across different jurisdictions.. Data residency and regulatory compliance requirements are critical in cloud adoption because data may be stored or processed in jurisdictions with different privacy laws (e.g., GDPR, CCPA, LGPD). An emerging risk assessment must evaluate whether the cloud provider's data centers are located in regions that could expose the organization to legal penalties or breach of contractual obligations. This is not a generic concern but a specific legal and technical risk tied to the physical location of cloud infrastructure.

Answer

The organization's ability to patch operating systems in the cloud environment.

Answer

Physical security controls at the cloud provider's data centers.

Question 2

A security dashboard is being designed for the C-suite. Which metric is most appropriate for a one-page executive summary?

Accepted Answer

Security scorecard with overall risk level. The security scorecard with overall risk level is the most appropriate metric for a one-page executive summary because it provides a high-level, aggregated view of the organization's security posture. Executives need a concise, actionable summary that distills complex security data into a single risk indicator, enabling quick decision-making without technical details.

Answer

Number of phishing simulation campaigns

Answer

List of all security incidents in the quarter

Answer

Detailed patch compliance by system

Question 3

Which TWO of the following are key components of an information risk management program, as defined by ISACA? (Select exactly two.)

Accepted Answer

Risk appetite and tolerance. Options B and D are correct. Risk appetite and tolerance (B) define the organization's willingness to accept risk, and a risk assessment methodology (D) provides the structured approach to identify, analyze, and evaluate risks. Business continuity planning (A) is a separate domain focused on incident recovery, not a core component of risk management. Data classification (C) is part of information security governance, not risk management program components. Vulnerability scanning (E) is a technical control activity, not a program-level component.

Answer

Business continuity plan

Answer

Data classification scheme

Answer

Vulnerability scanning process

Question 4

A multinational corporation is implementing a risk-based approach to information security governance. The chief information security officer (CISO) has been asked to prioritize security initiatives based on business impact. Which of the following actions should the CISO take FIRST to align security governance with business objectives?

Accepted Answer

Conduct a business impact analysis (BIA) to identify critical processes and their security requirements.. Conducting a business impact analysis (BIA) is the foundational step in a risk-based governance approach because it identifies critical business processes, their recovery time objectives (RTOs), and the specific security requirements needed to protect them. Without this analysis, the CISO cannot align security initiatives with business impact, as the BIA directly links security controls to the organization's most valuable assets and operational priorities.

Answer

Enforce multifactor authentication (MFA) for all remote access.

Answer

Implement a compliance management tool to track regulatory requirements.

Answer

Deploy a security information and event management (SIEM) system to centralize log analysis.

Question 5

Which THREE steps are essential in the post-incident review process?

Accepted Answer

Identify lessons learned and process improvements. The post-incident review process is fundamentally a learning exercise, not a punitive one. Identifying lessons learned and process improvements ensures that the organization captures what worked, what did not, and how to enhance future detection, response, and recovery capabilities. This step directly feeds into the continuous improvement cycle of the incident management program, reducing the likelihood and impact of similar incidents.

Answer

Assign blame for the incident

Answer

Renew vendor contracts

Question 6

Which TWO of the following are key performance indicators (KPIs) for measuring the effectiveness of an information security program?

Accepted Answer

Mean time to detect (MTTD) security incidents.. Correct answers are B and D. Option B (Mean time to detect security incidents) directly measures detection effectiveness, a key performance indicator (KPI) for security program effectiveness. Option D (Percentage of critical systems patched within 30 days) measures the effectiveness of vulnerability management and protection. Option A (Number of security policies approved) is a count of administrative actions, not a performance indicator. Option C (Employee satisfaction score) is a general HR metric unrelated to security performance. Option E (Percentage of security budget spent on tools) is a financial metric, not a measure of security program effectiveness.

Answer

Number of security policies approved.

Answer

Employee satisfaction score from annual survey.

Answer

Percentage of security budget spent on tools.

Question 7

The following incident response configuration is set:
```
playbook: standard
actions:
  - notify: incident_response_team
  - auto_containment: true
priority_override: false
```
Based on the configuration snippet, what is the expected behavior when an incident is triggered?

Accepted Answer

Standard playbook executed, notification sent, auto containment applied.. The configuration indicates that the standard playbook will be executed, the incident response team will be notified, and containment actions will be automatically applied. Priority override is set to false, so no override occurs. Therefore, option A correctly describes the expected behavior.

Answer

The incident is logged but no action is taken.

Answer

Priority override applied, but no notification sent.

Answer

Auto containment applied without executing any playbook.

Question 8

Which TWO of the following are key indicators that an organization's information security governance is inadequate?

Accepted Answer

Frequent changes to security policies without approval. Frequent changes to security policies without approval (Option B) indicate a breakdown in governance because it shows that the policy lifecycle—creation, review, approval, and communication—is not being followed. Without a formal change control process, policies become inconsistent, unenforceable, and may conflict with regulatory requirements, directly undermining the governance framework's authority and accountability.

Answer

Low budget for security awareness

Answer

High number of security incidents

Answer

Use of multiple antivirus solutions

Question 9

A multinational corporation is designing an information security strategy to support its global operations. Which approach best ensures that the strategy is actionable and measurable?

Accepted Answer

Define KPIs and KRIs aligned with business goals. KPIs (Key Performance Indicators) and KRIs (Key Risk Indicators) provide quantifiable metrics that directly tie security activities to business objectives, ensuring the strategy is both actionable (through measurable targets) and measurable (through defined thresholds). This alignment allows the multinational corporation to track progress, demonstrate value to stakeholders, and adjust controls based on risk appetite, which is essential for global operations with diverse regulatory and operational contexts.

Answer

Conduct a cost-benefit analysis of security controls

Answer

Base the strategy on industry best practices

Answer

Adopt a leading-edge technology roadmap

Question 10

Based on the log entries, what is the most likely scenario?

Accepted Answer

A brute-force attack against the root account. The rapid succession of failed SSH login attempts for the root account from the same IP address indicates a brute-force attack, making Option A the most likely scenario. Option B is not supported because the logs show only failed authentication attempts, not signs of code execution. Option C is less likely given the speed and repetitive nature of the attempts. Option D is incorrect as the entries are distinct failed logins, not duplicates.

Answer

A remote code execution attempt

Answer

A legitimate user repeatedly mistyping their password

Answer

A misconfiguration causing duplicate log entries

Question 11

An organization wants to ensure that its security program aligns with business objectives. Which activity is most important?

Accepted Answer

Regularly meeting with business unit leaders to understand needs and risks.. Regularly meeting with business unit leaders to understand needs and risks is the most important activity because it ensures the security program is directly aligned with business objectives, risk appetite, and operational priorities. This engagement allows the CISO to perform a business impact analysis (BIA) and integrate security controls that support strategic goals rather than operating in isolation. Without this alignment, even technically sound security measures may be rejected or underfunded by leadership.

Answer

Conducting vulnerability scans twice a year.

Answer

Developing a security awareness campaign.

Answer

Purchasing an advanced threat detection system.

Question 12

Which THREE of the following are valid methods to identify information security risks? (Choose three.)

Accepted Answer

Business impact analysis (BIA). A Business Impact Analysis (BIA) is a systematic process to identify and evaluate the potential effects of disruptions to critical business functions, thereby identifying information security risks by quantifying the impact of loss of confidentiality, integrity, or availability. It directly links business processes to the underlying IT assets and their security requirements, making it a valid risk identification method as per CISM domain guidance.

Answer

Financial audit

Answer

Penetration testing

Question 13

A company has a risk appetite that is 'low' for operational risks. A risk assessment recently identified that a high-speed trading platform has a residual risk rating of 'high' after controls are applied. The cost to further reduce the risk is $1 million, which exceeds the expected benefit. What is the most appropriate action for the risk owner?

Accepted Answer

Accept the residual risk with formal sign-off from senior management. The risk owner has determined that the cost to further reduce the residual risk ($1 million) exceeds the expected benefit, making additional controls economically unjustifiable. Since the company's risk appetite is 'low' for operational risks but the residual risk is 'high', the most appropriate action is to formally accept the residual risk with senior management sign-off, as this documents the decision and acknowledges the deviation from the stated risk appetite. This aligns with the CISM principle that risk acceptance is a valid treatment option when the cost of mitigation outweighs the benefit, provided it is approved at the appropriate level.

Answer

Adjust the risk appetite to 'moderate' to align with the residual risk

Answer

Transfer the risk by taking out an insurance policy

Answer

Approve additional controls to lower residual risk regardless of cost

Question 14

An organization has a distributed incident response team across multiple time zones. During a critical incident, communication delays occur due to different work hours. Which strategy BEST improves coordination and response time?

Accepted Answer

Implement a follow-the-sun incident response model. The follow-the-sun model aligns incident response handoffs with time zone shifts, ensuring continuous coverage without requiring all team members to work overlapping shifts. This reduces communication delays by transferring active incident ownership to the next available region, maintaining momentum and minimizing response time during critical incidents.

Answer

Require all team members to work overlapping shifts

Answer

Designate a single incident commander for the entire response

Answer

Outsource incident response to a managed security service provider

Question 15

A company experiences a DDoS attack that overwhelms its internet-facing services. The incident response team implements mitigation measures. During which phase of incident response is it most appropriate to collect and preserve evidence for potential legal action?

Accepted Answer

During containment, eradication, and recovery. Evidence collection should occur during containment, eradication, and recovery, but ideally before remediation to preserve forensic data. In a DDoS, logs and traffic captures should be preserved early.

Answer

During preparation

Answer

During detection and analysis

Answer

During post-incident activity