CISM Practice Test 4 — 10 Questions

Question 1

An organization has a risk appetite that allows for a maximum residual risk level of 'medium' for all operational risks. A new project introduces a risk with inherent risk level 'high' and control effectiveness rated as 'partially effective'. The risk owner proposes to accept the risk. As the CISM, what is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insist on additional controls to reduce residual risk to at least 'medium'.. The organization's risk appetite mandates that residual risk must be at 'medium' or lower. With an inherent risk of 'high' and controls rated 'partially effective', the residual risk remains above the acceptable threshold. Therefore, the best course is to insist on additional controls to bring residual risk down to at least 'medium', ensuring compliance with the risk appetite.

Answer

Accept the risk since the risk owner has agreed.

Answer

Transfer the risk to an insurance company.

Answer

Recommend revising the risk appetite to accommodate this risk.

Question 2

Which TWO of the following are appropriate criteria for escalating an incident to the crisis management team (CMT)? (Select TWO.)

Accepted Answer

The incident could cause severe reputational damage. Option A is correct because an incident with the potential to cause severe reputational damage meets the threshold for CMT escalation, since crisis management is invoked when business reputation and stakeholder trust are at stake, not merely for technical containment. Option D is correct because potential for major financial loss or regulatory penalties is a classic CMT escalation trigger, as such consequences require executive-level decision-making, legal counsel, and communications coordination beyond the incident response team's scope. Options B, C, and E are not appropriate standalone criteria: novel malware, third-party origin, and multi-vendor coordination are operational or technical factors that the incident response team can typically handle through normal procedures, and they do not by themselves imply the enterprise-wide business impact that defines a crisis warranting CMT involvement.

Answer

The incident involves a new type of malware not seen before

Answer

The incident originated from a third-party supplier

Answer

The incident requires coordination with multiple external vendors

Question 3

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Accepted Answer

A steering committee that includes senior management and business unit leaders.. A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Answer

An incident response plan that defines roles and procedures.

Answer

A vulnerability scanning schedule and remediation SLAs.

Answer

A firewall policy that specifies allowed and denied traffic.

Question 4

Which of the following is the PRIMARY role of the board of directors in information security governance?

Accepted Answer

Providing strategic direction and oversight of the security program.. The board of directors holds the ultimate fiduciary responsibility for the organization, including its information security posture. Their primary role is to provide strategic direction and oversight, ensuring that the security program aligns with business objectives, risk appetite, and regulatory requirements. This includes approving the overall security strategy, reviewing key risk indicators, and holding management accountable for security performance, not executing tactical tasks.

Answer

Managing the day-to-day security operations.

Answer

Implementing security controls and technologies.

Answer

Developing detailed security policies and procedures.

Question 5

Which THREE of the following are components of a security operations center (SOC)?

Accepted Answer

Response. A SOC is built around the core functions of detection, response, and continuous security monitoring, so options B, C, and E are correct. Detection (E) covers identifying malicious activity through tools such as SIEM correlation rules, IDS/IPS alerts, and endpoint telemetry, which is a primary SOC responsibility. Response (B) covers incident handling activities like triage, containment, eradication, and recovery, which SOC analysts perform once an incident is detected. Security monitoring (C) is the ongoing 24x7 collection and analysis of logs and alerts from firewalls, endpoints, and network devices that feeds detection and response. Vulnerability scanning (A) is typically a vulnerability management function, and security awareness training (D) is a human-risk/GRC program, so neither is a core SOC component.

Answer

Vulnerability scanning

Answer

Security awareness training

Question 6

During a suspected insider data theft, a security manager discovers that an employee copied sensitive pricing files to a personal cloud drive two weeks ago. Legal counsel has not yet decided whether to pursue legal action. The security manager must decide how to treat the forensic copies of the employee's laptop image and cloud access logs. Which action BEST aligns with evidence handling requirements?

Accepted Answer

Maintain a documented chain of custody, hash the images, and store them in a restricted evidence repository. When litigation is undecided, the safest course is to preserve evidence so it remains usable in any proceeding. Hashing the forensic images at acquisition, documenting every transfer in a chain of custody, and storing copies in a restricted repository together establish integrity and control. These steps prevent alteration, support authentication, and keep access limited. Continued monitoring without preservation, selective deletion, or broad sharing all risk destroying or contaminating evidence before legal counsel determines the organization's position.

Answer

Copy the evidence to a shared network folder so legal, HR, and IT can all review it as needed

Answer

Allow the employee to continue working normally while quietly monitoring activity to gather more evidence

Answer

Delete the laptop image after extracting only the relevant pricing files to reduce storage and privacy risk

Question 7

Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident, such as ransomware or data breach?

Accepted Answer

Incident response playbook. Playbooks (or runbooks) provide detailed procedures for specific incident types, while the IR plan is a broader document.

Answer

Incident response plan

Answer

Incident response policy

Answer

Communication template

Question 8

Based on the exhibit, what is the MOST likely scenario?

Accepted Answer

An attacker brute-forced the password and then used the credentials to access a file server.. The exhibit shows multiple failed authentication attempts (Event ID 4625) from a single user account within a short time window, followed by a successful logon (Event ID 4624) and then an access event to a file share (Event ID 5140). This pattern of rapid, repeated failures culminating in a single success is characteristic of a brute-force attack, where the attacker guesses the password and then uses the compromised credentials to access a file server.

Answer

A user is performing a scheduled task that requires authentication.

Answer

A user forgot their password and successfully logged in after retrying.

Answer

A system administrator is testing password policies.

Question 9

An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?

Accepted Answer

Credential compromise playbook. Credential compromise incidents, such as account takeover via phishing, are handled by the credential compromise playbook.

Answer

Data breach playbook

Answer

Ransomware playbook

Answer

Insider threat playbook

Question 10

A security manager is designing a metrics dashboard for executive management. Which of the following metrics is MOST useful for demonstrating the value of the security program?

Accepted Answer

Mean time to detect incidents. Mean time to detect (MTTD) incidents directly measures how quickly the security program identifies threats, which is a core outcome executives care about — reduced exposure window and improved resilience. It demonstrates program effectiveness in a business-relevant way rather than just activity or spend.

Answer

Percentage of budget spent on security

Answer

Number of security patches applied

Answer

Number of security policies created