CISM Practice Test 43 — 15 Questions

Question 1

An information security manager is designing a metrics program to report to the board. Which of the following metrics would be MOST meaningful to the board?

Accepted Answer

Percentage of systems with critical vulnerabilities. The board is primarily concerned with strategic risk posture and business impact. Percentage of systems with critical vulnerabilities directly quantifies the organization's exposure to high-severity threats, enabling informed risk acceptance or remediation decisions. This metric aligns with the board's fiduciary duty to oversee risk management, unlike operational details such as incident counts or training completions.

Answer

Number of security incidents reported

Answer

Average patch deployment time

Answer

Number of security awareness training completions

Question 2

BankOne has a mature security governance program but recently failed a regulatory audit because the board had not formally approved the risk appetite statement. The CISO argues that risk appetite is reviewed annually and was verbally approved. To prevent recurrence, what governance change is most effective?

Accepted Answer

Require board resolution for risk appetite annually. The core issue is the lack of formal, documented board approval of the risk appetite statement, which is a governance requirement. A formal board resolution, passed and recorded annually, creates an auditable record that satisfies regulatory scrutiny and ensures the board's explicit ownership of risk tolerance. This directly addresses the audit failure by moving from informal verbal approval to a legally binding, documented governance process.

Answer

Automate risk appetite monitoring

Answer

Reduce the number of risk indicators

Answer

Document all board approvals in minutes

Question 3

A retail company's security governance includes a policy that all software must be approved by a security committee. This delays critical business applications. The CIO complains. How should the CISO adjust governance?

Accepted Answer

Implement a risk-based approval process with expedited paths. A risk-based approval process with expedited paths allows the security committee to focus on high-risk software while fast-tracking low-risk or critical business applications. This balances security governance with business agility, addressing the CIO's complaint without compromising security. It aligns with CISM's emphasis on aligning security with business objectives through risk management.

Answer

Increase committee meeting frequency

Answer

Remove the approval requirement

Answer

Automate software approval

Question 4

An organization's incident response plan includes a call tree. During an incident, the primary contact is unreachable. What should happen?

Accepted Answer

Move to the next person in the call tree. A call tree is designed to ensure rapid, sequential notification during an incident. If the primary contact is unreachable, the plan should automatically move to the next person in the call tree to maintain the speed and reliability of the notification process. This avoids delays that could compromise incident response SLAs.

Answer

Escalate to senior management

Answer

Use a different communication method like email

Answer

Wait for the primary to become available

Question 5

An organization is developing a new information security program and wants to ensure it aligns with business objectives. Which of the following is the MOST critical first step?

Accepted Answer

Identify business strategy and risk appetite.. Identifying business strategy and risk appetite is the most critical first step because the information security program must be designed to support the organization's objectives and operate within the risk tolerance defined by leadership. Without this alignment, subsequent security controls and investments may conflict with business goals or fail to address the risks the organization is willing to accept. This ensures that security is a business enabler rather than a technical silo.

Answer

Develop a security awareness training program.

Answer

Design the security architecture based on industry frameworks.

Answer

Conduct a comprehensive risk assessment.

Question 6

An organization is developing an information security strategy aligned with business objectives. Which of the following is the BEST approach to prioritize security investments?

Accepted Answer

Use a risk-based approach aligned to business impact. A risk-based approach aligned to business impact ensures security investments target the threats and assets that matter most to organizational objectives. This ties spending directly to likelihood and consequence of risk, which is the CISM-endorsed way to prioritize finite security budgets. It balances cost, threat, and business value rather than treating all domains equally.

Answer

Follow industry benchmarks without adjustment

Answer

Prioritize based on the cost of security controls

Answer

Allocate budget equally across all security domains

Question 7

A small accounting firm with 50 employees recently suffered a ransomware attack that encrypted all client data on its file server. The firm had no backup strategy, and the attackers demanded a ransom for decryption. The firm paid the ransom, but many clients left due to loss of trust. The firm’s owner has now hired you as a part-time risk manager. Your first task is to develop a risk management program. What is the most appropriate initial step?

Accepted Answer

Conduct a risk assessment to identify assets, threats, and vulnerabilities. The first step in developing a risk management program, per the CISM framework, is to conduct a risk assessment. This identifies the specific assets (e.g., client data on the file server), threats (e.g., ransomware), and vulnerabilities (e.g., lack of backups, weak access controls) that led to the incident. Without this foundational analysis, any subsequent controls—such as backups or insurance—would be misaligned with the firm's actual risk profile, potentially wasting resources on ineffective measures.

Answer

Purchase a comprehensive cyber insurance policy

Answer

Fire the IT staff responsible for the security failures

Answer

Immediately implement a backup and disaster recovery solution

Question 8

Which of the following is an example of an external stakeholder that should be included in the incident response plan's vendor contacts list?

Accepted Answer

External legal counsel. External legal counsel is an external stakeholder because they are not employees of the organization but are engaged to provide specialized legal advice during incidents. In an incident response plan, vendor contacts must include external parties such as legal counsel, forensic firms, and PR agencies who can be called upon when needed. The CISO, incident response manager, and board of directors are all internal roles and would not be listed as vendor contacts.

Answer

Chief Information Security Officer

Answer

Incident response manager

Answer

Board of directors

Question 9

Which THREE of the following are common challenges when implementing a risk management program in an organization? (Choose three.)

Accepted Answer

Lack of senior management support. Option A (Lack of senior management support) is correct because a risk management program requires executive sponsorship, budget, and authority to enforce policies; without it, risk initiatives stall and risk ownership cannot be driven across the organization. Option B (Inability to quantify risks in financial terms) is correct because translating technical or operational risk into monetary values (e.g., ALE = SLE × ARO) is difficult and often subjective, which hampers cost-benefit justification of controls and prioritization. Option D (Resistance to change from business units) is correct because risk management typically introduces new processes, ownership, and controls that business units may perceive as bureaucratic overhead, slowing adoption. Option C is not a standard challenge in itself; implementing too many controls too quickly is a symptom of poor phasing rather than a recognized common implementation challenge. Option E is not a common challenge; a well-defined risk appetite is generally desirable, and the issue is more often an undefined or misaligned appetite, not one that is overly detailed.

Answer

Too many controls implemented too quickly

Answer

Overly detailed risk appetite

Question 10

During a major incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the communications lead on the CMT?

Accepted Answer

Coordinating all external and internal communications. The communications lead on a Crisis Management Team (CMT) is specifically designated to own the communications function during an incident — both internal (employees, executives, board) and external (customers, media, regulators, law enforcement). This role ensures a single, consistent, approved message is delivered to all stakeholders, preventing conflicting or premature disclosures that could escalate reputational and legal exposure.

Answer

Authorizing financial expenditures for incident response

Answer

Directing technical containment efforts

Answer

Preserving digital evidence for litigation

Question 11

A security manager is conducting a risk assessment for a new cloud-based system. The system will store sensitive customer data. Which of the following should be the FIRST step in the risk assessment process?

Accepted Answer

Identify and classify information assets. In the risk assessment process, the first step is to identify and classify information assets because you cannot assess risks to assets you haven't identified. For a cloud-based system storing sensitive customer data, this means cataloging data types (e.g., PII, financial records), their locations (e.g., specific cloud storage buckets), and their classification levels (e.g., confidential, restricted) before any threat or vulnerability analysis can be meaningfully performed.

Answer

Select appropriate security controls

Answer

Conduct vulnerability scanning

Answer

Identify potential threat sources

Question 12

An organization uses the ISO 31000 risk management framework. During the risk evaluation phase, it determines that a certain risk has a low likelihood but very high impact. The organization's risk appetite is moderate. Which of the following is the MOST appropriate risk treatment decision?

Accepted Answer

Mitigate the risk by implementing controls to reduce impact. ISO 31000's risk evaluation phase requires aligning treatment decisions with the organization's risk appetite. With a moderate risk appetite, a low-likelihood but very-high-impact risk cannot simply be accepted (as it exceeds appetite), nor is avoidance necessary since the likelihood is low. Mitigation through controls that reduce the impact is the most balanced approach, bringing the residual risk within the moderate appetite threshold.

Answer

Accept the risk due to low likelihood

Answer

Avoid the risk by discontinuing the activity that generates it

Answer

Transfer the risk through insurance

Question 13

After implementing controls, an organization reassesses a risk and finds that the residual risk level exceeds the established risk tolerance. What is the most appropriate next step?

Accepted Answer

Seek management approval for acceptance or implement additional controls. When residual risk exceeds the established risk tolerance, the organization must either implement additional controls to reduce the risk further or formally accept the residual risk through management approval. This aligns with the risk treatment decision-making process in ISO 31000 and the CISM framework, where risk acceptance is a management responsibility. Option C correctly identifies these two valid paths.

Answer

Re-assess the risk using a different methodology

Answer

Lower the risk tolerance to match the residual risk

Answer

Ignore the residual risk since controls are already in place

Question 14

A financial institution is implementing a risk-based approach to prioritize its information security initiatives. The risk manager has completed a risk assessment and identified several risks with varying impact and likelihood. Which TWO of the following are the most important benefits of using the risk assessment results to determine the order of security projects?

Accepted Answer

Aligns security spending with business objectives. Option A is correct because risk assessment results tie each security project to the likelihood and impact of risks to business processes, so funding flows to initiatives that protect the organization's most important objectives and assets, aligning security spending with business priorities. Option B is correct because documented risk assessment outputs (identified threats, vulnerabilities, likelihood, and impact ratings) provide an auditable, defensible rationale for why specific security investments are chosen and prioritized, which is essential for justifying budgets to executives, auditors, and regulators. Option C is incorrect because risk-based prioritization still relies on qualitative analysis (for example, ordinal likelihood/impact scales) and often combines it with quantitative methods; it does not eliminate qualitative analysis. Option D is incorrect because risk assessment prioritization does not by itself guarantee compliance with all applicable regulations; compliance is a separate obligation that may require controls regardless of assessed risk level. Option E is incorrect because prioritizing projects by risk does not reduce the total number of security controls needed; it only orders which controls are implemented first, and a risk-based approach may even increase controls for high-risk areas.

Answer

Eliminates the need for qualitative analysis

Answer

Ensures compliance with all applicable regulations

Answer

Reduces the total number of security controls needed

Question 15

A company is designing its information security program and wants to ensure that it meets regulatory requirements across multiple jurisdictions. Which of the following approaches is most appropriate?

Accepted Answer

Implement a regulatory compliance framework that maps controls to applicable laws and standards.. A regulatory compliance framework that maps controls to applicable laws and standards provides a structured, auditable method to address multiple, sometimes conflicting, jurisdictional requirements. This approach ensures that each control is explicitly linked to a specific legal or regulatory obligation, facilitating compliance verification and reducing the risk of oversight. It is the most comprehensive and adaptable method for a multi-jurisdictional environment, as it allows the organization to manage overlapping and unique requirements without relying on a single standard or external review alone.

Answer

Adopt ISO 27001 as the sole framework for the program.

Answer

Comply with the strictest regulation and ignore others.

Answer

Engage external legal counsel to review policies quarterly.