CISM Practice Test 43 — 15 Questions

Question 1

A financial services firm has a mature information security program but is struggling to demonstrate the value of security investments to the board. Which metric would BEST communicate the effectiveness of the security program in business terms?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reduction in average cost per security incident over the past year.. The reduction in average cost per security incident directly translates security program outcomes into financial terms that resonate with the board. This metric demonstrates the program's effectiveness by quantifying the monetary value of improved prevention, detection, and response capabilities, aligning with the CISM focus on governance and business alignment.

Answer

Number of security alerts triaged per day.

Answer

Time to patch critical vulnerabilities.

Answer

Percentage of systems with endpoint protection installed.

Question 2

An organization uses ISO 27001 Annex A controls. During a risk assessment, they identify a need for a compensating control because the primary control is not feasible. What should the security manager do FIRST?

Accepted Answer

Document the risk and obtain management approval for the compensating control. Compensating controls require formal acceptance of the residual risk and approval by management to ensure accountability.

Answer

Accept the risk without any control

Answer

Remove the asset from scope

Answer

Implement the compensating control immediately

Question 3

Which THREE are key components of an effective post-incident review?

Accepted Answer

Document lessons learned. Documenting lessons learned captures actionable insights from the incident, enabling the organization to improve future detection, response, and prevention. This aligns with the CISM Incident Management domain, where post-incident reviews focus on process improvement rather than punitive measures.

Answer

Increase security budget

Answer

Assign blame

Question 4

An information security manager is developing a security scorecard for the board. Which of the following should be included to BEST demonstrate governance performance?

Accepted Answer

Number of risk acceptances approved vs. rejected. The number of risk acceptances approved vs. rejected directly reflects the board's governance of risk appetite and decision-making. It shows how management formally accepts residual risk, which is a key governance function, unlike operational metrics that measure tactical execution.

Answer

Total number of security incidents this quarter

Answer

Percentage of systems patched within 30 days

Answer

Employee security training completion rate

Question 5

Which THREE of the following are key phases of the incident management lifecycle according to NIST or ISO? (Choose three.)

Accepted Answer

Detection & Analysis. Detection & Analysis is the phase where potential security incidents are identified through monitoring tools, alerts, and user reports, and then analyzed to confirm the incident, assess its scope, and prioritize response actions. This phase is explicitly defined in both NIST SP 800-61 (Computer Security Incident Handling Guide) and ISO/IEC 27035 as the second step after preparation, ensuring that incidents are accurately recognized before containment begins.

Answer

Encryption

Answer

Board reporting

Question 6

Which THREE of the following are common challenges in implementing an information security program across a large enterprise?

Accepted Answer

Cultural resistance to security controls from business units.. Cultural resistance to security controls from business units is a common challenge because security teams must balance risk mitigation with operational efficiency. Business units often perceive controls like mandatory encryption or access restrictions as hindrances to productivity, leading to shadow IT or workarounds that undermine the program's effectiveness.

Answer

Overreliance on automated security tools.

Answer

Lack of security awareness training for end users.

Question 7

An organization's security steering committee meets quarterly but lacks decision-making authority. Projects are delayed due to lack of prioritization. What is the most effective improvement?

Accepted Answer

Empower the committee with budget and resource allocation authority. The core issue is that the security steering committee lacks decision-making authority, which prevents it from prioritizing projects and allocating resources. Empowering the committee with budget and resource allocation authority directly addresses this root cause by enabling it to make binding decisions, thereby eliminating delays caused by lack of prioritization. This aligns with the CISM governance principle that steering committees must have defined authority to effectively oversee the information security program.

Answer

Increase meeting frequency to weekly

Answer

Outsource project prioritization to external consultants

Answer

Replace committee members with senior executives

Question 8

An organization's incident response plan has not been updated in two years. Which of the following is the MOST likely consequence?

Accepted Answer

The plan may not address current threats and technologies.. An incident response plan that has not been updated in two years is unlikely to account for recent changes in the threat landscape, such as new attack vectors (e.g., ransomware-as-a-service, zero-day exploits) or shifts in technology stack (e.g., cloud-native architectures, IoT devices). Without periodic review, the plan may lack updated playbooks for current malware families, fail to reference new detection tools, or omit revised containment procedures for modern network segmentation. This gap directly increases the risk of ineffective response during an actual incident.

Answer

The plan will comply with new regulations automatically.

Answer

The plan will be more effective due to maturity.

Answer

The plan will be followed exactly as written.

Question 9

An organization's security program includes a set of metrics reported quarterly to the board. Which metric best demonstrates the effectiveness of the security awareness program?

Accepted Answer

Reduction in phishing click-through rate. The phishing click-through rate directly measures behavioral change—the primary goal of security awareness training. A sustained reduction indicates that employees are applying training to recognize and avoid phishing attempts, which is a more valid effectiveness metric than completion rates or lagging indicators like incidents or violations.

Answer

Percentage of employees who completed training

Answer

Number of security incidents

Answer

Number of policy violations

Question 10

A security analyst detects an unusual spike in outbound traffic from a database server. Which of the following is the FIRST step in the incident response process?

Accepted Answer

Confirm the incident as a true positive. In the NIST SP 800-61 incident response lifecycle, the first phase is preparation, followed by detection and analysis. The spike in outbound traffic is an indicator of compromise (IoC), but before any containment or eradication steps, the analyst must confirm that the alert is a true positive—not a false positive caused by a legitimate application update, backup replication, or monitoring tool. This validation typically involves correlating the traffic with known baselines, checking source/destination IPs against threat intelligence feeds, and reviewing logs to rule out benign causes.

Answer

Isolate the server from the network

Answer

Identify the root cause of the traffic spike

Answer

Notify senior management

Question 11

A security analyst reviews the following alert from the SIEM: 'Multiple failed login attempts from IP 10.0.0.5 to the domain controller within 5 minutes.' Which TWO actions should the analyst take as part of initial incident response?

Accepted Answer

Review authentication logs from other servers for similar patterns.. Reviewing authentication logs from other servers for similar patterns helps determine if the failed login attempts are part of a broader brute-force or password-spraying attack targeting multiple systems, not just the domain controller. This lateral analysis is a key initial step in incident response to assess the scope and identify compromised accounts or additional indicators of compromise (IoCs). Option E is correct because verifying whether the source IP belongs to an internal asset is critical to distinguish between an external attacker and a misconfigured internal service or user, which directly impacts the response strategy (e.g., internal remediation vs. external threat containment).

Answer

Block the IP address in the firewall immediately.

Answer

Escalate the alert to the incident response team.

Answer

Reset the password of the targeted account.

Question 12

Given the exhibit, what is the MOST appropriate action for the information security manager?

Accepted Answer

Implement the action plan to reduce KRI value. The exhibit shows a Key Risk Indicator (KRI) trending above the defined threshold but within the risk appetite, meaning the risk is not yet critical. The information security manager should implement the existing action plan to reduce the KRI value back to an acceptable level, as this is a proactive risk treatment measure aligned with the organization's risk management framework. This avoids unnecessary escalation or crisis declaration while addressing the risk in a controlled manner.

Answer

Request board approval to accept the risk level

Answer

Declare a security crisis and mobilize incident response

Answer

Escalate to the board for immediate decision

Question 13

An information security manager is developing a security strategy for a financial institution. Which of the following should be the PRIMARY driver for selecting security controls?

Accepted Answer

Business requirements derived from risk assessment and compliance obligations.. Business requirements derived from risk assessment and compliance obligations are the primary driver because they directly align security controls with the institution's specific risk appetite, regulatory mandates (e.g., PCI DSS, SOX, GDPR), and operational needs. This ensures controls are cost-effective and prioritized based on actual exposure rather than reactive or budget-driven decisions.

Answer

The latest cybersecurity threats reported in the industry.

Answer

Past security incidents that caused significant financial loss.

Answer

The security budget allocated for the fiscal year.

Question 14

Based on the exhibit, which risk should be addressed first if the organization has limited resources?

Accepted Answer

R001. R001 should be addressed first because it has the highest risk level, as indicated by its placement in the top-right quadrant of the risk heat map (high likelihood and high impact). With limited resources, the organization must prioritize risks that pose the greatest potential damage and are most likely to occur, which aligns with the foundational risk management principle of treating high-priority risks first.

Answer

R002

Answer

R003

Answer

R004

Question 15

A global financial services firm operates in 30 countries and is subject to multiple data protection regulations, including GDPR, CCPA, and various financial services directives. The firm has a centralized information security program but struggles with inconsistent enforcement across regions. The CISO is under pressure to demonstrate compliance to the board while reducing costs. The compliance team suggests creating a separate security program for each regulation, while the IT audit team recommends adopting the most stringent regulation as the baseline. The CISO must decide on a strategy that balances compliance, efficiency, and cost. What is the best approach for the CISO to take?

Accepted Answer

Develop a unified set of controls that satisfy the common requirements of all regulations and map them to each regulation's specific needs.. Developing a unified set of controls that satisfy the common requirements of all regulations and mapping them to each regulation's specific needs (Option A) is the best approach. This balances compliance by ensuring all regulations are addressed, efficiency by leveraging common controls, and cost reduction by avoiding duplicate efforts. Option B (adopting ISO 27001 alone) may not cover all regulatory specificities and requires additional mapping. Option C (separate programs) is inefficient and costly due to duplication. Option D (focusing on the most stringent regulation) can lead to gaps in less stringent but unique requirements.

Answer

Adopt ISO 27001 as the single framework and map it loosely to all regulations.

Answer

Create three separate security programs, one for each major regulation (GDPR, CCPA, financial directives).

Answer

Use the most stringent regulation (e.g., GDPR) as the baseline and accept potential gaps with other regulations.