CISM Practice Test 42 — 15 Questions

Question 1

A risk manager is aggregating risks across the enterprise and finds that multiple individual risks, each with low impact and low probability, could combine to create a significant risk. What is the best approach to address this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a risk aggregation model to assess cumulative impact and consider enterprise-level controls. Risk aggregation models are specifically designed to quantify the cumulative impact of multiple low-level risks that, when combined, exceed the enterprise's risk appetite. This approach aligns with the CISM domain of Information Security Risk Management, where enterprise-level controls (e.g., centralized monitoring, compensating controls) are necessary to address systemic risk that individual risk treatments cannot mitigate. The key insight is that the combined probability of correlated or cascading events may be higher than the product of individual probabilities, especially when risks share common root causes.

Answer

Ignore the individual risks as they are low priority

Answer

Accept the risk because the probability of all occurring simultaneously is negligible

Answer

Treat each individual risk separately with minimal controls

Question 2

Which THREE of the following are essential components of an information security risk management framework?

Accepted Answer

Risk identification. Risk identification is a core component of an information security risk management framework because it systematically catalogs assets, threats, and vulnerabilities that could affect the organization. Without identifying risks, subsequent steps like assessment and treatment cannot be performed. This aligns with the ISACA framework's emphasis on risk identification as the foundational step in the risk management lifecycle.

Answer

Incident response planning

Answer

Compliance auditing

Question 3

An organization plans to implement ISO/IEC 27001 to formalize its information security management system. Which step is most critical to ensure successful implementation?

Accepted Answer

Obtain commitment from top management. ISO/IEC 27001 requires top management to demonstrate leadership and commitment (Clause 5.1) as the foundation for the entire ISMS. Without executive buy-in, resources, authority, and cross-functional support are lacking, making risk assessments, policies, and training ineffective. The standard mandates management approval for the information security policy and ensures alignment with business objectives, which is the most critical success factor.

Answer

Conduct a comprehensive risk assessment

Answer

Develop detailed information security policies

Answer

Train all employees on security awareness

Question 4

Which of the following is the PRIMARY reason for an information security manager to integrate risk management into the organization's enterprise risk management (ERM) framework?

Accepted Answer

To support informed decision-making by aligning security risks with business objectives. Integrating information security risk into ERM ensures that security risks are considered alongside business risks, enabling better prioritization and resource allocation. This alignment helps the organization make informed decisions that balance risk appetite and business objectives. The primary driver is to support strategic decision-making, not just compliance or reporting.

Answer

To ensure compliance with regulatory requirements

Answer

To provide a consistent risk reporting structure across the enterprise

Answer

To reduce the cost of risk management through shared resources

Question 5

An organization with a mature security program is reviewing its budget allocation. The board has asked the CISO to justify a proposed increase. Which of the following provides the STRONGEST justification for the security budget?

Accepted Answer

Breach avoidance value, estimating the cost of incidents that were prevented.. Breach avoidance value quantifies the financial impact of prevented incidents, providing a direct link between security investment and risk reduction, which is compelling to the board.

Answer

Benchmarking against industry peers showing that the proposed budget is below average.

Answer

Operational efficiency gains from automation of security processes.

Answer

Compliance with all regulatory requirements to avoid fines.

Question 6

After containing an incident, the incident response team is ready to proceed. According to NIST SP 800-61, what is the next phase?

Accepted Answer

Eradication. According to NIST SP 800-61 (Computer Security Incident Handling Guide), after containment, the next phase is eradication. Eradication involves removing the root cause of the incident, such as deleting malware, disabling compromised accounts, or patching vulnerabilities, to ensure the threat is fully eliminated before recovery begins.

Answer

Communication

Answer

Recovery

Answer

Lessons Learned

Question 7

An information security manager is developing a program metric to report to senior management. Which metric best demonstrates the effectiveness of the information security program?

Accepted Answer

Mean time to detect (MTTD) security incidents. Mean time to detect (MTTD) is a key performance indicator that directly measures how quickly the security program identifies incidents, reflecting the effectiveness of detection controls, monitoring tools, and incident response readiness. Unlike compliance-focused metrics, MTTD provides actionable insight into the program's ability to minimize dwell time and reduce potential impact, making it the most relevant metric for senior management to assess program effectiveness.

Answer

Number of security incidents reported

Answer

Percentage of systems with up-to-date patches

Answer

Number of security awareness training sessions held

Question 8

Given the exhibit, what is the MOST significant governance gap in the described architecture?

Accepted Answer

No defined security governance board or oversight mechanism. The exhibit describes a cloud-based architecture with multiple business units and third-party integrations, but no centralized security governance board or oversight mechanism is mentioned. Without a governance body to define, approve, and enforce security policies, the organization lacks strategic direction, accountability, and risk management alignment, making this the most significant gap in the Information Security Governance domain.

Answer

Weak authentication for remote access

Answer

Insufficient physical security in data centers

Answer

Lack of intrusion detection for internal traffic

Question 9

Which TWO of the following are key components of an information security risk assessment? (Choose two.)

Accepted Answer

Threat identification. Threat identification is a key component of an information security risk assessment because it involves systematically cataloging potential sources of harm (e.g., malware, insider threats, natural disasters) that could exploit vulnerabilities. Without identifying threats, the risk assessment cannot evaluate the likelihood or impact of adverse events, making the entire risk analysis incomplete. This step directly feeds into risk identification, which is the foundation of the risk management process as defined by frameworks like ISO 27005 and NIST SP 800-30.

Answer

Security policy development

Answer

Incident response planning

Answer

Control implementation

Question 10

During a merger, the acquiring company's board insists on integrating the target company's information security governance into its own within 90 days. However, the target has a significantly different risk culture and lacks documented policies. What is the most critical governance risk in this scenario?

Accepted Answer

The acquiring company may inadvertently accept unknown high-risk exposures.. The most critical governance risk is that the acquiring company may inadvertently inherit unknown high-risk exposures from the target company. Without documented policies and a compatible risk culture, the target's security posture is opaque, meaning the acquirer cannot assess or control inherited vulnerabilities, compliance gaps, or threat vectors. This violates the core governance principle of risk visibility and could lead to material breaches or regulatory penalties post-merger.

Answer

The acquiring company's security team may lack the capacity to train the target's staff.

Answer

The target's employees may resist the new security culture.

Answer

There will be insufficient time to develop new security policies for the combined entity.

Question 11

A security team detects lateral movement within the network using PowerShell scripts. Which TWO actions are MOST effective to contain the threat?

Accepted Answer

Disable PowerShell remoting on all systems.. Disabling PowerShell remoting (WinRM) on all systems is a highly effective containment action because it directly cuts off the primary channel used for lateral movement via PowerShell scripts. Attackers frequently abuse WinRM (port 5985/5986) and PowerShell's `Invoke-Command` or `Enter-PSSession` to move laterally, so disabling this service blocks that specific attack vector without requiring immediate system isolation.

Answer

Conduct memory forensics on affected endpoints.

Answer

Implement network segmentation to isolate affected VLANs.

Answer

Apply the latest security patches to all systems.

Question 12

Based on the exhibit, what is the MOST likely issue?

Accepted Answer

A system is infected with malware that is beaconing to a command and control server.. The IDS alert indicates a malware beacon, and the firewall log shows periodic outbound connections to an external IP, which is typical of command and control traffic.

Answer

A user is streaming video from a legitimate site.

Answer

A software update is being downloaded from an external site.

Answer

A network scan is being performed from the internal IP.

Question 13

When establishing an information security program, which TWO of the following are key components of governance?

Accepted Answer

Steering committee. A steering committee is a key governance component because it provides executive oversight, strategic direction, and resource allocation for the information security program. It ensures that security initiatives align with business objectives and that decisions are made at the appropriate authority level, which is essential for effective governance.

Answer

Security awareness training

Answer

Vulnerability management

Answer

Incident response plan

Question 14

An organization is conducting a risk assessment for a new cloud-based HR system. Which THREE of the following are key considerations when evaluating the inherent risk?

Accepted Answer

Likelihood of threat actors targeting the system. Inherent risk is the risk level before any security controls are applied. When evaluating inherent risk for a new cloud-based HR system, the likelihood of threat actors targeting the system (B) is a key factor because it directly influences the probability of a risk event occurring, independent of any existing or planned controls. This assessment considers the system's exposure, attractiveness to attackers, and the threat landscape specific to cloud HR platforms.

Answer

Organization's risk appetite

Answer

Effectiveness of existing security controls

Question 15

Which of the following is the primary purpose of communicating risk assessment results to senior management?

Accepted Answer

To enable informed decision-making about risk acceptance. The primary purpose of communicating risk assessment results to senior management is to provide the necessary information for informed decision-making regarding risk acceptance, transfer, or mitigation. Senior management holds the authority to accept residual risk based on a clear understanding of the potential impact and likelihood, which is a core tenet of the CISM framework for information security risk management.

Answer

To comply with regulatory requirements

Answer

To assign blame for security failures

Answer

To justify the security budget