CISM Practice Test 41 — 15 Questions

Question 1

An organization has a mature incident management process. After a major incident, they conduct a post-incident review. Which activity is MOST important during this review?

Accepted Answer

Determine root causes and document lessons learned. Identifying root causes and improvements prevents recurrence. Option A (assigning blame) is counterproductive. Option B (updating tools) is part of improvement but not the most important. Option D (metrics) supports analysis but is not the primary goal.

Answer

Identify individuals responsible for the incident

Answer

Update security tools to block similar attacks

Answer

Calculate the total cost of the incident

Question 2

After a data breach, the CISO reviews the security program. The breach exploited a known vulnerability in a legacy system that was deemed 'acceptable risk' two years ago. What should the CISO do to improve the program?

Accepted Answer

Implement a process for periodic reassessment of accepted risks.. Risk acceptance is not a one-time decision; it must be periodically reassessed to account for changes in the threat landscape, business context, or compensating controls. The breach exploited a known vulnerability that was accepted two years ago, indicating the risk environment has shifted (e.g., new exploit code, increased attacker interest). Implementing a periodic reassessment process ensures that accepted risks are re-evaluated against current threats and vulnerabilities, allowing the organization to either renew acceptance, apply mitigations, or retire the system.

Answer

Establish a policy that legacy systems must be upgraded annually.

Answer

Disconnect the legacy system from the network immediately.

Answer

Require immediate remediation of all legacy systems.

Question 3

Which of the following is a key reason to have a forensic retainer in place before an incident occurs?

Accepted Answer

To reduce the time needed to engage the firm when an incident occurs. Having a pre-negotiated contract reduces the time to engage forensic experts, which is critical during an incident.

Answer

To avoid the need for a chain of custody

Answer

To ensure the firm understands the organization's IT environment

Answer

To guarantee lower costs

Question 4

After implementing controls, an organization reassesses a risk and finds that the residual risk level exceeds the established risk tolerance. What is the most appropriate next step?

Accepted Answer

Seek management approval for acceptance or implement additional controls. When residual risk exceeds the established risk tolerance, the organization must either implement additional controls to reduce the risk further or formally accept the residual risk through management approval. This aligns with the risk treatment decision-making process in ISO 31000 and the CISM framework, where risk acceptance is a management responsibility. Option C correctly identifies these two valid paths.

Answer

Re-assess the risk using a different methodology

Answer

Lower the risk tolerance to match the residual risk

Answer

Ignore the residual risk since controls are already in place

Question 5

During a merger, the acquiring company's CISO must integrate the security governance of the target company. The target company has no formal security governance. What is the FIRST step the CISO should take?

Accepted Answer

Perform a comprehensive risk assessment of the target company's security posture.. Without a formal security governance structure, the CISO must first understand the target company's current security posture through a comprehensive risk assessment. This step identifies vulnerabilities, threats, and gaps in controls, providing the baseline data needed to prioritize integration efforts and align with the acquirer's governance framework. Skipping this assessment risks implementing policies that are irrelevant or ineffective against the target's actual risks.

Answer

Conduct a security awareness training for the target company's employees.

Answer

Align the target company's security policies with the acquirer's policies.

Answer

Implement the acquirer's security governance framework immediately.

Question 6

A multinational corporation is implementing a new information security program. The program manager needs to ensure that security requirements are integrated into the procurement process for third-party services. Which of the following is the most effective approach?

Accepted Answer

Embed security clauses in request for proposals (RFPs). Embedding security clauses in RFPs ensures that security requirements are formally communicated to potential vendors before any contractual agreement, making them a mandatory part of the procurement process. This proactive approach aligns with the CISM principle of integrating security into business processes from the outset, rather than retrofitting controls after contracts are signed. By specifying requirements such as encryption standards (e.g., AES-256), incident response SLAs, and compliance with frameworks like ISO 27001 in the RFP, the organization can evaluate vendor capabilities upfront and avoid costly renegotiations.

Answer

Include security requirements after contract signing

Answer

Require third parties to self-attest compliance

Answer

Conduct periodic security audits of third parties

Question 7

During a security policy development lifecycle, which step should occur immediately after 'drafting' the policy?

Accepted Answer

Legal review. After drafting, legal review ensures compliance with laws and regulations.

Answer

Gap analysis

Answer

Training

Answer

Stakeholder consultation

Question 8

A healthcare organization is merging with another entity and must integrate their IT systems. During due diligence, it is discovered that the acquired company has a high number of unpatched critical vulnerabilities in its electronic health record (EHR) system. The merger timeline is aggressive and the integration team wants to proceed as planned. As the risk manager, what is the best course of action?

Accepted Answer

Recommend delaying the integration until vulnerabilities are patched.. Delaying integration until the critical vulnerabilities are patched is the most prudent action to prevent exploitation during and after integration. Proceeding with compensating controls may not be sufficient given the criticality, and accepting the risk could lead to a major breach. Insurance does not prevent the breach.

Answer

Accept the risk because the vulnerabilities are in the legacy system which will be replaced.

Answer

Transfer the risk by purchasing cyber insurance for the combined entity.

Answer

Proceed with integration but implement compensating controls like network segmentation.

Question 9

A risk manager is establishing risk appetite for a new product line. Which of the following best describes the relationship between risk appetite and risk tolerance?

Accepted Answer

Risk appetite is the general approach to risk; tolerance defines acceptable variation in performance. Risk appetite is the broad, high-level amount of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance translates that appetite into specific, measurable boundaries for individual risks. Option D correctly captures this relationship: appetite is the general approach, and tolerance defines the acceptable variation in performance metrics (e.g., a 5% deviation in revenue targets). This distinction is critical for aligning risk management with business strategy in information security risk management.

Answer

Risk appetite and tolerance are interchangeable terms

Answer

Risk appetite is set by regulatory bodies; tolerance is set by the board

Answer

Risk appetite is the specific limit for each risk; tolerance is the overall willingness to accept risk

Question 10

During an internal audit, it is discovered that business units frequently purchase cloud services without involving the IT security department. Which governance deficiency does this scenario most clearly demonstrate?

Accepted Answer

Absence of a procurement security policy. The scenario describes business units procuring cloud services without IT security involvement, which directly indicates the absence of a procurement security policy. Such a policy would mandate security review and approval before any cloud service acquisition, ensuring that security requirements are integrated into the procurement lifecycle. Without it, security is bypassed, leading to ungoverned shadow IT and potential compliance violations.

Answer

Inadequate security awareness training

Answer

Lack of an incident response plan

Answer

Weak access control over cloud resources

Question 11

During an incident, the incident response team is communicating with affected stakeholders. According to best practices, which of the following should be communicated FIRST?

Accepted Answer

A summary of actions taken so far. During an incident, the first communication to stakeholders should provide a summary of actions taken so far to establish transparency and demonstrate that the incident response team is actively managing the situation. This aligns with NIST SP 800-61r2 guidance, which prioritizes timely, high-level updates over detailed technical data to avoid overwhelming stakeholders and to maintain trust. Detailed technical analysis, timelines, and root cause determination typically require more investigation and are communicated in subsequent updates.

Answer

Detailed technical analysis

Answer

A timeline of all events

Answer

The root cause of the incident

Question 12

An organization is under a DDoS attack that is saturating their internet link. The incident response team needs to mitigate the attack. Which action should be taken first?

Accepted Answer

Activate cloud-based DDoS mitigation services.. Activating cloud-based DDoS mitigation services is the correct first step because these services are designed to absorb and scrub volumetric attacks at the network edge, before traffic reaches the saturated internet link. This preserves legitimate traffic while filtering malicious packets, which is critical when the link itself is overwhelmed and on-premises devices cannot process the volume.

Answer

Shut down all public-facing services.

Answer

Implement rate limiting on the perimeter firewall.

Answer

Contact the ISP to null-route the attack IPs.

Question 13

An employee emails a spreadsheet containing employee salaries to all staff by mistake. According to the exhibit, what is the minimum handling requirement that was violated?

Accepted Answer

Confidential handling requirements. The email containing employee salaries was sent to all staff, which is a violation of the 'Confidential' handling requirement. Confidential data, such as salary information, must be restricted to authorized recipients only, and mass distribution to all staff exceeds that authorization. The exhibit likely classifies salary data as 'Confidential', not 'HighlyConfidential', making option B the correct minimum violated requirement.

Answer

HighlyConfidential handling requirements

Answer

Internal handling requirements

Answer

Public handling requirements

Question 14

Which of the following best describes the primary purpose of an Information Security Program?

Accepted Answer

To align security efforts with business objectives and manage risk.. The primary purpose of an Information Security Program is to align security efforts with business objectives and manage risk to an acceptable level. This ensures that security investments and activities directly support the organization's mission, rather than operating in isolation. A program focused solely on compliance or technical controls may fail to address the dynamic risk landscape and business needs.

Answer

To reduce the number of security incidents to zero.

Answer

To ensure compliance with all relevant laws and regulations.

Answer

To implement technical security controls across all systems.

Question 15

A security audit has identified several governance weaknesses. Which TWO of the following are most likely to indicate a lack of effective information security governance? (Choose two.)

Accepted Answer

Risk assessments are not performed on a regular basis.. A is correct because regular risk assessments are a foundational requirement of information security governance, as they ensure that security controls remain aligned with evolving threats and business objectives. Without periodic risk assessments, the organization cannot demonstrate due diligence or maintain an accurate risk profile, which is a direct indicator of governance failure.

Answer

The information security policy is not available on the intranet.

Answer

Employees have not completed annual security awareness training.

Answer

Antivirus software is not updated on all endpoints.