CISM Practice Test 39 — 15 Questions

Question 1

Match each business continuity term to its definition.

Accepted Answer

Business Continuity Plan: A documented set of procedures and information that helps an organization respond to a disruption and resume normal operations.. Correct matches: A-BCP, B-DRP, C-BIA. Common confusions: MTD is about downtime, RPO is about data loss.

Answer

Maximum Tolerable Downtime: The maximum amount of data loss, measured in time, that an organization can accept.

Answer

Recovery Point Objective: The maximum period of time that a system can be unavailable before causing significant harm to the business.

Question 2

Which THREE of the following are key components of an incident response plan? (Select THREE)

Accepted Answer

Communication and escalation matrix. The communication and escalation matrix is a key component of an incident response plan because it defines the chain of command, contact paths, and escalation triggers for notifying stakeholders during an incident. This ensures that the right people are informed at the right time, preventing delays in decision-making and response actions. Without this matrix, critical incidents may be mishandled due to miscommunication or failure to escalate to senior management or legal teams.

Answer

List of all employees' contact information

Answer

Annual budget for incident response tools

Question 3

A CISO is developing an information security governance framework for a financial institution. Which of the following is the PRIMARY purpose of such a framework?

Accepted Answer

Align security with business objectives. The primary purpose of an information security governance framework is to align security initiatives with business objectives, ensuring that security investments and activities directly support the organization's strategic goals. For a financial institution, this alignment ensures that security governance drives value, manages risk in context of business priorities, and enables informed decision-making by leadership.

Answer

Minimize risks to an acceptable level

Answer

Ensure compliance with regulatory requirements

Answer

Deploy the latest security technologies

Question 4

An organization's information security program is based on a risk management framework. Which of the following BEST describes the role of the information security manager in this context?

Accepted Answer

Designing and managing the security program. The information security manager is responsible for designing and managing the security program based on the risk management framework. This includes translating risk assessment results into security controls, policies, and procedures, and ensuring the program aligns with the organization's risk posture. The manager does not set risk appetite (that is a board-level decision) nor own all risks (risk owners are business process owners).

Answer

Setting the organization's risk appetite

Answer

Owning all information security risks

Answer

Conducting internal audits of controls

Question 5

As part of post-incident activities, an organization schedules a lessons learned meeting. When should this meeting ideally take place?

Accepted Answer

Within 2 weeks of incident resolution. Lessons learned meetings should occur within two weeks of incident resolution while details are fresh, to capture accurate feedback and improve the IR plan.

Answer

At the next quarterly board meeting

Answer

Immediately after the incident is detected

Answer

Only after all legal proceedings are concluded

Question 6

Which THREE elements should be included in an incident response plan to ensure effective communication during a security incident?

Accepted Answer

Escalation procedures for notifying management and legal. Escalation procedures define the specific thresholds and contact paths for notifying management and legal teams when an incident exceeds predefined severity levels. This ensures that decision-makers are informed promptly to authorize critical actions like legal holds or regulatory notifications, preventing delays that could worsen the incident's impact.

Answer

List of affected systems and data

Answer

Public relations strategy for external communication

Question 7

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

Accepted Answer

Accept the risk because the control is not cost-justified.. The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.

Answer

Accept the risk because ALE after control is only $2,500.

Answer

Implement the control because it reduces ALE to $2,500.

Answer

Implement the control because ALE is $10,000, and control cost is only $12,000.

Question 8

Which TWO of the following are key indicators of a potential insider threat incident? (Select exactly 2)

Accepted Answer

A user accessing large volumes of data not related to their job function. A user accessing large volumes of data unrelated to their job function is a classic behavioral anomaly indicating potential data exfiltration. This pattern often precedes an insider threat incident, as the user may be collecting sensitive information for unauthorized purposes, such as selling it or using it for personal gain. Security information and event management (SIEM) systems typically flag such access based on deviations from baseline user behavior, triggering further investigation.

Answer

Multiple failed login attempts from an external IP address

Answer

An increase in network traffic to a known malicious domain

Answer

A user updating their password as required by policy

Question 9

Which of the following is the most important factor for ensuring the long-term success of an information security program?

Accepted Answer

Strong support from top management.. Strong support from top management is the most important factor because it ensures the information security program receives adequate budget, organizational authority, and strategic alignment with business objectives. Without executive sponsorship, even the best technical controls can be undermined by resource constraints, policy non-compliance, or lack of cross-departmental cooperation. The CISM framework emphasizes that governance and leadership commitment are foundational to sustaining a security program over time.

Answer

Deployment of advanced security technologies.

Answer

Comprehensive security awareness training.

Answer

Regular penetration testing.

Question 10

An organization's security program includes a risk assessment process. Which step should be performed FIRST?

Accepted Answer

Establish the risk assessment context. Establishing the risk assessment context (C) is the first step because it defines the scope, objectives, and criteria for the assessment, ensuring alignment with organizational goals and risk appetite. Without this foundational step, subsequent activities like asset identification or risk calculation lack direction and may produce irrelevant or misleading results. In the CISM framework, context setting precedes all technical analysis to ensure the assessment is meaningful and actionable.

Answer

Identify assets and their value

Answer

Calculate the level of risk

Answer

Determine the likelihood of threats

Question 11

Match each security role to its primary responsibility.

Accepted Answer

CISO: Responsible for overall security strategy and program management.. Correct matches: CISO → overall strategy, Security Manager → daily operations, Security Architect → design, Security Auditor → evaluation. Common confusions involve swapping these responsibilities.

Answer

CISO: Evaluates security controls and ensures compliance.

Answer

Security Manager: Designs security architecture.

Question 12

Which THREE characteristics indicate a higher maturity level in a security program maturity model?

Accepted Answer

Continuous improvement. Continuous improvement (B) is a hallmark of higher maturity because it indicates the security program systematically evaluates and enhances its processes based on lessons learned, shifting from static compliance to adaptive risk management. In CISM terms, this aligns with the 'Optimizing' level (Level 5) in the Capability Maturity Model (CMM), where feedback loops drive iterative refinement of controls and policies.

Answer

Reactive approach to incidents

Answer

Ad hoc processes

Question 13

Match each risk management term to its definition.

Accepted Answer

Risk: Effect of uncertainty on objectives. Key risk management terms from CISM: Risk is the effect of uncertainty on objectives; controls are measures that modify risk; vulnerabilities are weaknesses that can be exploited; threats are potential causes of incidents. The distractor pairs swap risk with threat and control with vulnerability.

Answer

Risk: A potential cause of an unwanted incident

Answer

Control: Weakness in an asset or control

Question 14

Match each security metric to its description.

Accepted Answer

MTTD: Average time taken to identify a security incident after it occurs.. Security metrics are used to measure different aspects of incident response and risk management. MTTD measures detection speed, MTTR measures response speed, MTBF measures system reliability, and ALE measures financial risk. Common confusions include swapping MTTD and MTTR definitions.

Answer

MTTD: Average time taken to contain and remediate a security incident after detection.

Answer

MTTR: Average time between system failures.

Question 15

Which TWO regulations are MOST likely to impact an organization that processes credit card payments and handles personal data of EU residents?

Accepted Answer

GDPR. PCI DSS applies to payment card processing, and GDPR applies to personal data of EU residents. These are the two most relevant regulations.

Answer

HIPAA

Answer

SOX

Answer

CCPA