CISM Practice Test 41 — 15 Questions

Question 1

An organization's information security program has been operational for two years. The security manager is asked to propose changes to improve effectiveness. Which approach should the manager take first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a maturity assessment of the current program.. Before making any changes, the security manager must first understand the current state of the program. A maturity assessment (e.g., using the CMMI or COBIT framework) evaluates the effectiveness, gaps, and capability levels of existing processes and controls. This baseline ensures that subsequent improvements are targeted and justified, rather than arbitrary or misaligned with the organization's actual needs.

Answer

Implement new security controls based on industry best practices.

Answer

Increase the security awareness training budget.

Answer

Revise the information security policy.

Question 2

An organization wants to establish a security champions program. What is the primary benefit of embedding security advocates in development teams?

Accepted Answer

Improving secure coding adoption and collaboration. A security champions program embeds security-minded individuals within development teams to promote secure coding practices, provide peer guidance, and improve collaboration between security and engineering. The primary benefit is cultural and practical: security becomes part of the development workflow rather than a gate at the end. This improves secure coding adoption and cross-team collaboration, which is the core outcome of the program.

Answer

Eliminating the need for vulnerability assessments

Answer

Replacing the role of security architects

Answer

Reducing the need for a SOC

Question 3

A company's incident response team is handling a confirmed ransomware infection that has encrypted files on several servers. The IT director requests that the team immediately restore data from backups to minimize downtime. However, the team suspects that the backup repository may also be compromised because the attacker had administrative credentials. What is the BEST course of action?

Accepted Answer

Rebuild the servers from scratch and restore from an offline backup taken before the compromise.. Restoring from an offline backup taken before the compromise ensures that the restored data is free of the ransomware and that the backup itself was not encrypted or tampered with. Since the attacker had administrative credentials, any online backup repository could have been accessed and compromised, making offline backups the only trustworthy source. This approach also eliminates the risk of re-infection by rebuilding the servers from scratch, ensuring no residual malware remains.

Answer

Proceed with restoration from the most recent backup to restore operations quickly.

Answer

First, clean the backup repository and verify integrity before restoring to prevent re-infection.

Answer

Engage law enforcement before any restoration activities.

Question 4

During a risk assessment, a security manager discovers that the residual risk after implementing planned controls is still above the risk appetite threshold. What should the manager do NEXT?

Accepted Answer

Escalate the residual risk to senior management. When residual risk exceeds the risk appetite threshold after planned controls, the security manager cannot simply accept or ignore it; the risk must be escalated to senior management because they hold the authority to decide whether to accept the risk, allocate additional budget for further controls, or adjust the risk appetite. This aligns with the CISM domain of Information Security Risk Management, where risk acceptance is a management decision, not an operational one.

Answer

Implement additional controls immediately

Answer

Document the risk as accepted

Answer

Reassess the risk using a different methodology

Question 5

Which THREE of the following are challenges in implementing information security governance in a decentralized organization?

Accepted Answer

Redundant security controls and tools. In a decentralized organization, business units often procure and operate their own security tooling, which leads to redundant security controls and tools (B) that increase cost and complexity while creating gaps and overlaps in coverage. Diverse regulatory compliance requirements (D) are a challenge because different units may operate in different jurisdictions or industries, each subject to distinct laws and standards (e.g., GDPR, HIPAA, PCI DSS), making a single governance framework difficult to apply uniformly. Inconsistent policy enforcement across business units (E) is also a core challenge, since decentralized authority means each unit may interpret, adopt, or ignore enterprise security policies differently, undermining consistent risk management. By contrast, unified risk reporting (A) and centralized incident response (C) are goals or benefits that governance seeks to achieve, not inherent challenges of decentralization; in fact, decentralization makes achieving them difficult, but they are not themselves the challenges listed as correct answers.

Answer

Unified risk reporting

Answer

Centralized incident response

Question 6

A CISO is building a security operations center (SOC). Which TWO of the following are primary functions of a SOC?

Accepted Answer

Continuous monitoring of security events and alerts.. A SOC's core mission is around-the-clock visibility and reaction, so option A (continuous monitoring of security events and alerts) is correct because SOC analysts use SIEM platforms and correlated log/alert feeds to watch for anomalous activity across the environment in real time. Option D (incident detection and response) is also correct because once monitoring surfaces a potential threat, the SOC triages, investigates, contains, eradicates, and recovers from incidents, often following frameworks like NIST SP 800-61. The other options are not primary SOC functions: penetration testing (B) is typically performed by a dedicated offensive security or red team, vulnerability scanning and patch management (C) usually belong to vulnerability management and IT operations, and secure coding standards (E) are the responsibility of application security and development teams.

Answer

Conducting penetration tests of critical applications.

Answer

Performing vulnerability scans and patch management.

Answer

Developing secure coding standards for developers.

Question 7

Which governance model is characterized by a single, centralized security team that serves the entire organization?

Accepted Answer

Centralized. A centralized governance model is defined by a single security team that owns and delivers security services, policy, and oversight for the entire organization. Decision-making authority, budget, and standards flow from one point, which produces consistency and clear accountability. Federated, decentralized, and hybrid models distribute authority or embed security into business units, so they do not match the single-team description.

Answer

Federated

Answer

Decentralized

Answer

Hybrid

Question 8

Which of the following is the PRIMARY benefit of having a formal policy exception management process?

Accepted Answer

Ensuring consistent treatment of exceptions with proper risk acceptance. A formal exception management process ensures that every deviation from policy is documented, risk-assessed, approved by the appropriate authority, and time-bound, producing consistent and auditable risk acceptance. This gives the organization visibility into its true risk posture and prevents ad hoc, undocumented exceptions that could be exploited or cited in an audit. The primary benefit is governance consistency, not risk elimination.

Answer

Eliminating all security risks

Answer

Reducing the number of security policies

Answer

Automating policy enforcement

Question 9

A security program includes multiple metrics. Which metric best indicates the program's effectiveness in reducing overall risk?

Accepted Answer

Composite risk score based on threat, vulnerability, and control assessments.. A composite risk score aggregates threat, vulnerability, and control assessment data into a single metric that directly reflects the organization's residual risk posture. This metric is the most holistic indicator of program effectiveness because it quantifies how well security controls reduce the likelihood and impact of threats exploiting vulnerabilities, aligning with the CISM focus on risk management.

Answer

Number of security incidents per quarter.

Answer

Mean time to detect (MTTD) incidents.

Answer

Percentage of employees who completed security training.

Question 10

Which of the following is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a systematic method for responding to incidents. The primary purpose of an incident response plan is to establish a structured, systematic methodology for detecting, containing, eradicating, and recovering from security incidents. This ensures that the organization can minimize damage, reduce recovery time and costs, and preserve evidence for forensic analysis. Without a predefined plan, responses become ad hoc, increasing the likelihood of errors and extended downtime.

Answer

To assign blame for security failures

Answer

To prevent all security incidents from occurring

Answer

To meet regulatory compliance requirements

Question 11

An incident response plan (IRP) is being tested. Which metric is MOST indicative of the team's effectiveness during an exercise?

Accepted Answer

Mean time to detect (MTTD). Mean time to detect (MTTD) is the most indicative metric of team effectiveness during an IRP exercise because it directly measures how quickly the team identifies a security incident. A lower MTTD reflects faster detection, which is critical for minimizing dwell time and limiting attacker impact. In contrast, cost, tool count, or log volume do not measure detection speed or response quality.

Answer

Total cost of the exercise

Answer

Number of tools used

Answer

Volume of logs generated

Question 12

An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?

Accepted Answer

Remediate the risk by implementing parameterized queries and input validation. Parameterized queries (prepared statements) and input validation directly address the root cause of SQL injection by separating SQL logic from user-supplied data. This is a remediation (mitigation) strategy that reduces the likelihood of exploitation to an acceptable level, which aligns with the high-risk scenario described.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Avoid the risk by discontinuing the web application

Answer

Accept the risk because the likelihood is low after compensating controls

Question 13

Which of the following is the PRIMARY purpose of an information security risk assessment?

Accepted Answer

To identify and evaluate risks in terms of likelihood and impact. The primary purpose of an information security risk assessment is to identify and evaluate risks in terms of their likelihood and impact. This process enables an organization to prioritize risks and determine appropriate risk treatment options, such as mitigation, transfer, acceptance, or avoidance, based on a clear understanding of the risk landscape. Without this evaluation, any subsequent risk management decisions would lack a defensible basis.

Answer

To eliminate all identified risks

Answer

To comply with regulatory requirements

Answer

To assign blame for security incidents

Question 14

Refer to the exhibit. An analyst observes the network traffic between three internal hosts and a web server. Which of the following is the MOST likely interpretation of this traffic?

Accepted Answer

Multiple users are accessing the web server normally.. The exhibit shows multiple internal hosts (10.0.0.1, 10.0.0.2, 10.0.0.3) each establishing a normal TCP three-way handshake with the web server (192.168.1.100) on port 80, with varying source ports and no abnormal flags or packet rates. This pattern indicates legitimate concurrent user access, as each host completes the handshake and exchanges data without flooding or scanning behavior.

Answer

A SYN flood attack is in progress.

Answer

A single host is using multiple IP addresses to scan the server.

Answer

A distributed denial-of-service (DDoS) attack is occurring.

Question 15

Which control family in NIST SP 800-53 addresses the identification and authentication of users?

Accepted Answer

Identification and Authentication (IA). The Identification and Authentication (IA) family in NIST SP 800-53 covers user identification, authentication, and credential management.

Answer

Personnel Security (PS)

Answer

System and Communications Protection (SC)

Answer

Access Control (AC)