CISM Practice Test 39 — 15 Questions

Question 1

Which of the following is the PRIMARY reason to include legal counsel in the incident response team?

Accepted Answer

To advise on legal obligations and protect privilege. Legal counsel ensures that actions taken during an incident preserve attorney-client privilege and comply with legal obligations, such as breach notification and litigation holds.

Answer

To communicate with the media

Answer

To authorize technical containment actions

Answer

To manage technical aspects of the investigation

Question 2

A company is developing a business case for a new security tool. Which metric best demonstrates the value of the investment?

Accepted Answer

Security investment vs. loss avoidance. Comparing security investment to potential loss avoidance quantifies ROI in business terms.

Answer

Number of security incidents

Answer

Percentage of budget spent on security

Answer

Time to implement the tool

Question 3

A company's security steering committee includes representatives from Human Resources, Legal, and Risk Management, but not from Business Operations. What is the most likely consequence of this membership gap?

Accepted Answer

Security policies may not align with operational processes. Without Business Operations representation, the security steering committee lacks direct insight into how security policies will interact with day-to-day operational workflows. This gap often results in policies that are technically sound but impractical to implement, causing misalignment with existing processes and potential operational friction.

Answer

Data breaches will occur more frequently

Answer

Security spending will increase unexpectedly

Answer

The company will face regulatory fines

Question 4

Which THREE of the following are key activities during the post-incident phase of incident management? (Select THREE.)

Accepted Answer

Updating incident response plans and playbooks based on lessons learned. Option A is correct because the post-incident phase includes reviewing what happened and feeding lessons learned back into the incident response plan and playbooks so future responses improve. Option C is correct because root cause analysis, often using techniques such as 5 Whys or fishbone diagrams, is a core post-incident activity that identifies the underlying cause rather than just the symptom. Option D is correct because sharing indicators of compromise with relevant Information Sharing and Analysis Centers (ISACs) is a post-incident coordination activity that helps the broader community detect and defend against the same threat. Option B is not correct because activating the disaster recovery site is a response or recovery action, not a post-incident review activity. Option E is not correct because implementing immediate containment measures occurs during the containment phase of incident response, before the post-incident phase begins.

Answer

Activating the disaster recovery site

Answer

Implementing immediate containment measures

Question 5

Refer to the exhibit. What is most suspicious about this event?

Accepted Answer

The process name svchost.exe running from Temp folder. Svchost.exe is a critical Windows system process that should never run from the Temp folder. Running svchost.exe from %TEMP% is a classic indicator of malware masquerading as a legitimate process, often used to evade detection by security tools that trust the svchost.exe name. This event strongly suggests a malicious binary attempting to blend in with normal system activity.

Answer

The user jdoe is not an administrator

Answer

Event ID 4688 is unusual

Answer

The process ID is too low

Question 6

Which TWO of the following are key considerations when managing an external forensics firm during an incident? (Select TWO)

Accepted Answer

Maintaining chain of custody for all evidence. Option C is correct because maintaining chain of custody is essential when an external forensics firm handles evidence; documented, unbroken custody records ensure the evidence remains admissible in legal or disciplinary proceedings and prevents tampering or spoliation. Option D is correct because a clear scope of work plus agreed evidence-handling procedures define what the firm will investigate, how it will collect and preserve data, and what deliverables and timelines apply, preventing misunderstandings and unauthorized actions. The unmarked options do not belong: A is wrong because containment decisions should remain with the incident response team or management under the organization's authority, not be delegated independently to the forensics firm; B is wrong because media communications must go through the organization's designated spokesperson or PR/legal team, not the external firm; and E is wrong because requiring only proprietary tools is unnecessary and can hinder analysis, whereas validated, forensically sound tools and documented methods are what matter.

Answer

Allowing the firm to make independent decisions on containment

Answer

Having the firm report directly to the media

Answer

Ensuring the firm uses only proprietary tools

Question 7

An organization has a mature incident management process. After a major incident, they conduct a post-incident review. Which activity is MOST important during this review?

Accepted Answer

Determine root causes and document lessons learned. A post-incident review's primary purpose is to determine root cause and capture lessons learned so the organization improves its response capability and prevents recurrence. This is a core CISM concept: the review is a learning and improvement activity, not a blame exercise or a tooling update. Documenting lessons learned feeds back into policies, procedures, and training, closing the loop on the incident management lifecycle.

Answer

Identify individuals responsible for the incident

Answer

Update security tools to block similar attacks

Answer

Calculate the total cost of the incident

Question 8

An organization's board of directors wants to improve security culture. Which initiative would have the GREATEST impact?

Accepted Answer

Establishing executive sponsorship of security. Establishing executive sponsorship of security directly addresses the root of security culture: leadership commitment. When executives visibly champion security, it signals to the entire organization that security is a core value, not just a compliance checkbox. This top-down influence shapes employee attitudes and behaviors more effectively than any single tactical initiative. Executive sponsorship also ensures that security is integrated into business decisions and receives necessary resources, creating a sustainable culture change.

Answer

Increasing the security awareness training budget

Answer

Implementing a near-miss reporting system

Answer

Conducting monthly phishing simulations

Question 9

A CISO is developing a multi-year security roadmap. Which approach best ensures the roadmap aligns with business strategy?

Accepted Answer

Align security initiatives with the organization's strategic business objectives. A multi-year security roadmap must be driven by the organization's strategic business objectives to ensure security investments enable rather than obstruct business goals. Aligning initiatives with business strategy ensures the roadmap is prioritized by business value, secures executive sponsorship, and remains relevant as the business evolves. This is the foundational principle of business-aligned security governance.

Answer

Prioritize initiatives based on security team capacity

Answer

Base the roadmap on the latest industry threat intelligence

Answer

Create the roadmap based on compliance requirements only

Question 10

The board of directors has requested a security metrics dashboard. Which metric would BEST demonstrate the effectiveness of the incident response process?

Accepted Answer

Mean Time to Respond (MTTR). MTTR measures how quickly the incident response team detects, contains, and resolves incidents, directly reflecting the process's effectiveness. A lower MTTR indicates a mature, efficient IR capability, which is what the board wants to see.

Answer

Percentage of users trained

Answer

Number of security incidents

Answer

Patch compliance percentage

Question 11

Which capability maturity model (CMM) level indicates that security processes are measured and controlled?

Accepted Answer

Level 4: Managed. In the Capability Maturity Model (CMM), Level 4 is 'Managed,' where processes are quantitatively measured and controlled using statistical and other quantitative techniques. This level focuses on using metrics to manage and adjust processes to achieve specific performance goals.

Answer

Level 3: Defined

Answer

Level 5: Optimizing

Answer

Level 2: Repeatable

Question 12

Which of the following is the correct order in the security policy hierarchy, from highest to lowest level?

Accepted Answer

Enterprise Policy, Standards, Procedures, Guidelines. The security policy hierarchy flows from the highest-level, most enduring document to the most detailed and changeable: Enterprise Policy (management's intent and mandatory requirements), then Standards (specific mandatory controls and configurations), then Procedures (step-by-step instructions to implement standards), then Guidelines (non-mandatory recommendations and best practice). This ordering reflects decreasing authority and increasing operational detail.

Answer

Standards, Enterprise Policy, Procedures, Guidelines

Answer

Procedures, Standards, Enterprise Policy, Guidelines

Answer

Guidelines, Procedures, Standards, Enterprise Policy

Question 13

Which TWO factors are most important when prioritizing security investments? (Select TWO.)

Accepted Answer

The level of risk reduction achieved. Option B (the level of risk reduction achieved) is correct because security investment prioritization should be driven by how much a control actually lowers identified risk, typically assessed through risk analysis that weighs likelihood and impact against the residual risk remaining after the control is applied. Option C (alignment with business objectives and strategy) is correct because security spending must support the organization's mission, compliance obligations, and strategic goals, ensuring that limited budget is directed toward protecting the assets and processes that matter most to the business. Options A, D, and E are not among the two most important factors: ease of implementation and cost are practical considerations but can lead to underinvesting in high-risk areas, and industry popularity is a weak justification since threat profiles and business contexts differ across organizations.

Answer

The ease of implementation

Answer

The cost of the security solution

Answer

The popularity of the solution in the industry

Question 14

A CISO is building a business case for a new security tool. Which approach BEST articulates the return on investment (ROI) to the board?

Accepted Answer

Risk reduction value minus total cost of ownership. ROI for security investments is best expressed as the value of risk reduction minus the total cost of ownership. This formula captures both the benefit (reduced expected loss from incidents) and the full cost (licensing, implementation, operations), giving the board a net value figure. It aligns with CISM's emphasis on quantifying security in business terms.

Answer

Total cost of ownership (TCO) compared to competitors

Answer

Compliance with industry standards

Answer

Number of alerts the tool will generate

Question 15

An organization's board of directors wants to ensure that security activities align with business objectives. Which governance practice best supports this alignment?

Accepted Answer

Developing a multi-year security roadmap tied to business strategy. A multi-year security roadmap tied to business strategy is the governance practice that best ensures security activities align with business objectives. The roadmap translates business goals and risk appetite into sequenced security initiatives, budgets, and milestones, giving the board a mechanism to direct and monitor alignment over time.

Answer

Conducting annual security awareness training

Answer

Implementing a decentralized security model

Answer

Hiring a CISO with a technical background