CISM Practice Test 38 — 15 Questions

Question 1

A security awareness program includes phishing simulations. Which metric best measures the long-term effectiveness of the program?

Accepted Answer

Click rate trend over multiple simulation cycles. The click rate trend over multiple simulation cycles best measures long-term effectiveness because it shows whether employee behavior is improving over time. A declining trend indicates that the awareness program is successfully reducing susceptibility to phishing. Other metrics like number of campaigns or test pass rates do not directly reflect real-world behavior change.

Answer

Number of phishing simulation campaigns per year

Answer

Pass rate on phishing simulation knowledge test

Answer

Number of employees who report phishing emails

Question 2

During a security architecture review, the security architect identifies that a new application stores sensitive customer data in plaintext in the database. The application owner argues that performance requirements prevent encryption. What is the most appropriate compensating control to reduce risk?

Accepted Answer

Database activity monitoring (DAM). Database activity monitoring (DAM) is the most appropriate compensating control because it provides real-time visibility into database transactions, detects anomalous access, and can alert on or block unauthorized queries — all without requiring encryption that might impact performance. DAM addresses the risk of plaintext data exposure by monitoring who accesses it and how, enabling detection and response even if encryption is not feasible.

Answer

Implement strong password policies for database access

Answer

Network segmentation to isolate the database server

Answer

Conduct more frequent vulnerability scans

Question 3

Which THREE of the following are essential components of an information security governance framework?

Accepted Answer

Strategic alignment of security with business objectives.. Strategic alignment of security with business objectives (Option C) is essential because an information security governance framework must ensure that security initiatives directly support and enable the organization's mission and goals. Without this alignment, security becomes a siloed cost center rather than a strategic enabler, leading to misallocated resources and reduced executive sponsorship. This principle is foundational to the CISM governance domain, where security is viewed as a business function, not just a technical discipline.

Answer

A process for conducting security incident response.

Answer

Implementation of technical security controls such as firewalls.

Question 4

A CISO is developing a multi-year security roadmap aligned with business strategy. The organization is in a highly regulated industry with frequent regulatory changes. Which of the following should be the PRIMARY driver for prioritizing security initiatives?

Accepted Answer

Alignment with current and upcoming regulatory requirements. In a highly regulated industry with frequent regulatory changes, the primary driver for prioritizing security initiatives must be alignment with current and upcoming regulatory requirements, because non-compliance creates legal, financial, and reputational risk that can halt business operations. The CISO's roadmap must map security investments to regulatory obligations first, then layer in maturity and efficiency improvements. This ensures the security program directly supports the business's ability to operate legally and competitively.

Answer

Reduction of the mean time to detect (MTTD) security incidents

Answer

Cost savings from consolidating security tools

Answer

Achieving a target capability maturity model (CMM) level

Question 5

A company is designing its security awareness program. Which approach BEST addresses the need for role-based training?

Accepted Answer

Provide secure coding training to developers and social engineering awareness to executives. Role-based training tailors security education to the specific risks and responsibilities of different job functions. Developers need secure coding practices to prevent vulnerabilities like SQL injection or XSS, while executives are prime targets for social engineering and need awareness of executive-specific threats like whaling and business email compromise. This approach ensures that training is relevant, engaging, and effective in mitigating the most pertinent risks for each group.

Answer

Focus only on phishing simulations for all staff

Answer

Deliver the same annual training to all employees

Answer

Create a single module covering all topics for everyone

Question 6

Which THREE are valid sources for threat intelligence that can be used during incident response? (Choose three.)

Accepted Answer

Industry information sharing groups. Option B (Industry information sharing groups) is correct because organizations such as ISACs (Information Sharing and Analysis Centers) and CERTs distribute vetted threat indicators, TTPs, and advisories that directly inform incident response decisions. Option C (Vendor vulnerability databases) is correct because sources like the NVD, CVE, and vendor security advisories provide authoritative vulnerability details, CVSS scores, and patch guidance used to assess and remediate incidents. Option D (Open-source intelligence, OSINT) is correct because publicly available data such as threat feeds, malware analyses, and attacker infrastructure from security blogs, forums, and repositories enriches incident context and attribution. Option A is not a valid threat intelligence source because employee social media posts are unvetted, potentially unreliable, and not structured intelligence. Option E is not a threat intelligence source but internal telemetry; network traffic logs are evidence collected during incident response, not external intelligence about threats.

Answer

Social media posts from employees

Answer

Internal network traffic logs

Question 7

Which of the following is a leading indicator of security program effectiveness?

Accepted Answer

Phishing click rate. A leading indicator predicts future security outcomes rather than measuring past events. Phishing click rate measures how susceptible users are to social engineering and is a forward-looking predictor of potential compromise, making it a leading indicator. By contrast, incident counts, breach counts, and MTTD are lagging indicators because they describe events that have already occurred or been detected.

Answer

Number of security incidents

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 8

An organization is implementing a security awareness program. Which metric is MOST indicative of a positive security culture?

Accepted Answer

High near-miss reporting rate. A high near-miss reporting rate is the most indicative metric of a positive security culture because it demonstrates that employees are proactively identifying and reporting potential security issues before they escalate into incidents. This behavior reflects trust in the reporting process, psychological safety, and a collective commitment to security—key attributes of a mature security culture. Unlike lagging indicators such as incident counts or phishing click rates, near-miss reporting is a leading indicator that shows engagement and vigilance. It signals that security is integrated into daily operations rather than merely compliance-driven.

Answer

Low number of incidents caused by human error

Answer

Low phishing simulation click rate

Answer

High training completion percentage

Question 9

A large healthcare organization recently experienced a ransomware attack that encrypted patient records (ePHI). The attack originated from a phishing email that bypassed the email security gateway. The security program includes annual security awareness training, but post-incident analysis reveals that employees often ignore suspicious emails. The CISO wants to revise the program to reduce the likelihood of similar incidents. Which course of action is most effective?

Accepted Answer

Increase the frequency of phishing simulations and enforce mandatory remedial training for employees who fall for them. The root cause is human behaviour — employees ignore suspicious emails despite annual training. Increasing the frequency of phishing simulations with mandatory remedial training directly targets that behaviour through continuous reinforcement and consequence, which is the most effective way to reduce click rates. It addresses the actual gap (behaviour) rather than adding more technology layers.

Answer

Restrict users' ability to receive emails from external domains except from approved senders

Answer

Implement a next-generation email security gateway with AI-based threat detection

Answer

Deploy endpoint detection and response (EDR) on all workstations

Question 10

In which reporting model does the CISO have a direct reporting line to the CEO while also reporting to the CIO on operational matters?

Accepted Answer

Solid line to CEO, dotted line to CIO. A solid reporting line indicates primary authority, accountability, and usually administrative control (e.g., performance reviews, budget, hiring/firing). A dotted line indicates a secondary, functional, or operational reporting relationship. In this model, the CISO's primary accountability is to the CEO, ensuring independence from IT operations, while the dotted line to the CIO allows for coordination on operational matters like security tool deployment or incident response. This dual reporting structure is common in organizations seeking to balance security independence with operational efficiency.

Answer

Solid line to CIO, dotted line to CEO

Answer

Dotted line to both CEO and CIO

Answer

Solid line to both CEO and CIO

Question 11

An organization experiences a DDoS attack that overwhelms their internet connection. Which containment strategy would be MOST effective?

Accepted Answer

Contact the ISP for traffic scrubbing or blackhole routing.. When a DDoS attack saturates the organization's internet connection, on-premises controls like firewalls cannot help because the pipe itself is full. The most effective containment is to engage the ISP (or a cloud scrubbing provider) to perform traffic scrubbing — filtering malicious traffic and forwarding clean traffic — or blackhole routing to drop the attack traffic upstream. This moves the mitigation to where there is sufficient capacity and routing control, preserving the organization's limited bandwidth.

Answer

Shut down all external connectivity.

Answer

Change firewall rules to block all traffic.

Answer

Add more bandwidth to absorb the attack.

Question 12

During a P1 (critical) security incident involving a ransomware attack that has encrypted critical servers, which role is primarily responsible for coordinating the overall response and ensuring timely communication to executive leadership?

Accepted Answer

Incident response manager. In a P1 ransomware incident, the incident response manager (IRM) is responsible for orchestrating the overall response, prioritizing containment over eradication, and ensuring that executive leadership receives timely, accurate status updates. Unlike technical roles, the IRM owns the incident command structure, coordinates cross-functional teams, and manages communication escalations to stakeholders, which is critical when encrypted servers demand immediate business continuity decisions.

Answer

Security analyst

Answer

Forensic investigator

Answer

Communications lead

Question 13

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

To provide early warning signals of increasing risk. A Key Risk Indicator (KRI) is a metric used to provide an early warning signal that a risk exposure is approaching or exceeding acceptable thresholds. Unlike lagging indicators that report on past events, KRIs are forward-looking, enabling proactive risk mitigation before a risk materializes into a loss.

Answer

To report on past incidents and losses

Answer

To measure the effectiveness of security controls

Answer

To demonstrate compliance with regulations

Question 14

An organization is implementing a security champions program. What is the primary purpose of this initiative?

Accepted Answer

To embed security advocates within development teams to improve secure coding practices. Security champions embed security advocates within development teams to promote secure practices.

Answer

To conduct security awareness training for all employees

Answer

To provide a career path for security professionals

Answer

To replace the need for a dedicated security team

Question 15

After implementing controls, the residual risk is calculated to be at a level that slightly exceeds the risk appetite. The business owner argues that the cost of further mitigation outweighs the benefit. What is the most appropriate action for the risk manager?

Accepted Answer

Document the risk and escalate to senior management for acceptance. When residual risk exceeds the risk appetite, the risk manager's role is to document the finding and escalate it to senior management, who own the decision to accept, mitigate, or transfer risk beyond appetite. The risk manager advises and facilitates; the business owner cannot unilaterally accept risk that breaches the organization's stated appetite. Escalation preserves governance and creates an auditable record.

Answer

Transfer the risk through insurance

Answer

Accept the residual risk as a business decision

Answer

Implement additional controls regardless of cost