CISM Practice Test 40 — 15 Questions

Question 1

During an incident investigation, the forensic analyst discovers that a malware sample communicates with an external IP address. The organization's incident response plan requires a decision on whether to block the IP at the firewall. What should the incident response team do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check threat intelligence feeds to confirm maliciousness.. The incident response team must first validate the maliciousness of the IP address using threat intelligence feeds before taking any irreversible action. Blocking an IP without confirmation could disrupt legitimate business operations or tip off an attacker, and the CISM framework emphasizes evidence-based decision-making during incident response.

Answer

Monitor the connection further without taking action.

Answer

Block the IP address immediately to prevent data exfiltration.

Answer

Notify law enforcement about the IP address.

Question 2

During a data breach investigation, an organization engages an external forensics firm. To preserve attorney-client privilege, which of the following is the BEST practice?

Accepted Answer

Engage the forensics firm under the direction of legal counsel.. Engaging the forensics firm under the direction of legal counsel is the best practice because it extends attorney-client privilege to the investigation. When counsel directs the work, communications and findings are protected as work product, preventing disclosure in litigation. This is a foundational principle in incident response legal strategy.

Answer

Have the forensics firm work independently to maintain objectivity.

Answer

Ensure the forensics firm signs a non-disclosure agreement only.

Answer

Have the forensics firm report directly to the CISO.

Question 3

An information security manager has identified a risk with a high likelihood and high impact. The cost of mitigating the risk exceeds the potential loss. What is the MOST appropriate risk treatment strategy?

Accepted Answer

Risk acceptance. When mitigation cost exceeds potential loss, risk acceptance is appropriate if the risk is within the organization's risk appetite. Alternatively, risk transfer (e.g., insurance) could be considered, but acceptance is often the primary choice when the cost-benefit is negative.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 4

Which TWO are essential elements of an information security program?

Accepted Answer

Security awareness training. Security awareness training is an essential element of an information security program because it directly addresses the human factor, which is often the weakest link in security. A formal, ongoing training program ensures that employees understand policies, recognize threats like phishing, and follow secure behaviors, thereby reducing risk. Without it, technical controls alone cannot prevent social engineering or user errors, making it a foundational component of any security program.

Answer

Vulnerability scanning tools

Answer

Risk management process

Answer

Network firewall

Question 5

During an audit of the information security program, the auditor identifies that several critical systems are not included in the incident response plan. Which of the following are the MOST appropriate actions for the security manager to take? (Select TWO.)

Accepted Answer

Update the incident response plan to include all critical systems. The incident response plan must be a living document that covers all critical systems to ensure a coordinated and effective response during a security incident. Excluding critical systems from the plan creates a blind spot that could lead to delayed containment, increased damage, or non-compliance with regulatory requirements. Updating the plan to include these systems is a direct corrective action that aligns with the CISM principle of maintaining an up-to-date incident response capability.

Answer

Implement compensating controls on the excluded systems

Answer

Document the finding and accept the risk

Answer

Immediately remove the excluded systems from production

Question 6

An organization is updating its information security program to align with business objectives. Which of the following is the PRIMARY benefit of integrating security risk management into the strategic planning process?

Accepted Answer

Aligns security investments with business priorities. Integrating security risk management into strategic planning ensures that security investments are directly tied to the organization's business priorities and risk appetite. This alignment allows for optimal allocation of resources to protect the most critical assets and processes, rather than spending on generic or low-priority controls. The primary benefit is that security becomes a business enabler, not a cost center, by focusing on what matters most to the organization's objectives.

Answer

Reduces the number of security incidents

Answer

Increases employee awareness of security policies

Answer

Ensures compliance with regulatory requirements

Question 7

A security manager is presenting risk analysis results to the board. Which of the following should the manager include to effectively communicate risk? (Select THREE)

Accepted Answer

Monetary value of potential losses. Monetary value of potential losses (A) is correct because it translates technical risk into financial terms that board members understand, enabling informed decisions on resource allocation for risk mitigation. This aligns with the CISM focus on business-aligned risk communication, where quantitative metrics like Annualized Loss Expectancy (ALE) directly support cost-benefit analysis.

Answer

Detailed technical vulnerabilities

Answer

Anecdotal stories of past incidents

Question 8

An organization's security governance committee has approved a new security policy. What is the NEXT critical step to ensure the policy's effectiveness?

Accepted Answer

Communicate the policy to all relevant stakeholders and provide training.. After a security policy is approved, the next critical step is to communicate the policy to all relevant stakeholders and provide training. This ensures that employees understand the policy, their responsibilities, and how to comply. Without effective communication and training, the policy is unlikely to be adopted correctly, rendering it ineffective. Option A is incorrect because implementing technical controls before stakeholders are aware of the policy can lead to confusion and non-compliance. Option B is incorrect because auditing for compliance should occur after the policy has been communicated and implemented, not immediately after approval. Option D is incorrect because disciplinary actions should only be enforced after stakeholders have been given the opportunity to understand the policy through communication and training.

Answer

Implement technical controls to enforce the policy.

Answer

Conduct an audit to measure compliance.

Answer

Enforce disciplinary actions for non-compliance.

Question 9

An organization's incident response team is notified of a potential denial-of-service (DoS) attack targeting their web application. The team suspects a distributed denial-of-service (DDoS) attack. What is the FIRST step the team should take?

Accepted Answer

Analyze network traffic to confirm the attack.. Before taking any action, the incident response team must first confirm that a DDoS attack is actually occurring. Analyzing network traffic (e.g., using NetFlow, sFlow, or packet capture) allows the team to distinguish a genuine DDoS from a flash crowd, a misconfiguration, or a legitimate spike in traffic. This step ensures that subsequent mitigation efforts are based on accurate evidence, preventing unnecessary disruption to services.

Answer

Contact the ISP to block the attacking IPs.

Answer

Shut down the web application to protect resources.

Answer

Implement rate limiting on the web server.

Question 10

After a major security incident, the board of directors requests a review of the information security program. Which of the following metrics would be MOST useful to demonstrate the effectiveness of the program over the past year?

Accepted Answer

Number of security incidents detected and contained within defined SLAs. The number of incidents detected and contained within defined SLAs directly measures the program's ability to detect and respond to threats, which is a key indicator of operational effectiveness. Other metrics may be useful but do not directly measure the program's performance in protecting the organization.

Answer

Percentage of employees who completed security awareness training

Answer

Total cost of security investments compared to industry benchmarks

Answer

Number of vulnerabilities identified in the latest penetration test

Question 11

An organization suspects a data breach. Which two actions should the incident response team take before notifying affected customers? (Choose two.)

Accepted Answer

Confirm that the breach actually occurred.. The incident response team must first confirm that a breach actually occurred before taking any further action, including notification. Premature notification without confirmation can lead to false alarms, legal liability, and reputational damage. Confirmation involves verifying indicators of compromise (IoCs) through log analysis, forensic evidence, and chain-of-custody procedures.

Answer

Determine the root cause of the breach.

Answer

Implement full remediation.

Answer

Consult with legal counsel regarding notification obligations.

Question 12

A company's information security manager is tasked with ensuring that security initiatives align with business goals. Which of the following best demonstrates this alignment?

Accepted Answer

Establishing security metrics that are linked to key business performance indicators.. Aligning security metrics with key business performance indicators (KPIs) ensures that security initiatives directly support and demonstrate value to business objectives, such as revenue protection, customer trust, or operational efficiency. This is a core principle of information security governance, where security is treated as a business enabler rather than a technical silo. For example, tracking 'mean time to detect (MTTD)' and 'mean time to respond (MTTR)' as security metrics linked to business continuity KPIs shows how security investments reduce business risk.

Answer

Prioritizing security projects based solely on technical risk assessment.

Answer

Implementing all security controls required by regulatory standards.

Answer

Creating a security budget that allocates funds equally across departments.

Question 13

Which incident severity level requires executive notification and a 24/7 response?

Accepted Answer

P1 – Critical. P1 (critical) incidents have major business impact and require executive notification and around-the-clock response.

Answer

P3 – Medium

Answer

P4 – Low

Answer

P2 – High

Question 14

A company's security program includes a policy that all employees must use strong passwords and change them every 90 days. However, the recent internal audit shows that 60% of employees have passwords that do not meet the strength requirements. What is the most effective corrective action?

Accepted Answer

Implement technical controls to enforce password strength. Implementing technical controls, such as password complexity requirements and automated enforcement, ensures compliance without relying solely on user behavior. Option A is wrong because manual audits detect non-compliance but do not prevent it. Option B is wrong because training alone is insufficient to enforce policy. Option D is wrong because extending the password change interval does not address the root cause of weak passwords.

Answer

Conduct quarterly password audits with manual checks

Answer

Increase the frequency of security awareness training

Answer

Extend the password change interval to 180 days

Question 15

Arrange the steps for performing a vulnerability scan on a network segment.

Accepted Answer

Obtain authorization, configure scan parameters, execute scan, analyze results, prioritize findings. Vulnerability scanning requires authorization, configuration, execution, analysis, and prioritization.

Answer

Configure scan parameters, obtain authorization, execute scan, analyze results, prioritize findings

Answer

Obtain authorization, execute scan, configure scan parameters, analyze results, prioritize findings

Answer

Obtain authorization, configure scan parameters, analyze results, execute scan, prioritize findings