CISM Practice Test 44 — 15 Questions

Question 1

Which TWO of the following are key components of an information security risk assessment? (Choose two.)

Accepted Answer

Threat identification. Asset identification (E) is a foundational component of a risk assessment because you cannot evaluate risk without first knowing which information assets, systems, and data require protection and what value they hold to the organization. Threat identification (A) is equally essential, since risk is derived from identifying the threats (e.g., malware, insider abuse, natural disasters) that could exploit vulnerabilities and cause harm to those assets. Together, asset and threat identification feed into the core risk formula (risk = likelihood × impact), enabling analysts to prioritize risks and recommend treatment. The other options do not belong: security policy development (B) is a governance/risk-treatment output, incident response planning (C) is a reactive capability built after risks are understood, and control implementation (D) is a risk-mitigation activity that follows the assessment rather than forming part of it.

Answer

Security policy development

Answer

Incident response planning

Answer

Control implementation

Question 2

An organization selects a control to mitigate a risk, but after implementation, the risk level remains unchanged. What should the risk manager do first?

Accepted Answer

Re-assess the risk and control effectiveness. When a control is implemented but the risk level remains unchanged, the risk manager must first re-assess the risk and control effectiveness to determine why the control failed to reduce the risk. This aligns with the CISM risk management process, which mandates that controls be evaluated for proper design and operation before any escalation or acceptance decisions are made. Without this re-assessment, the organization cannot know whether the control is misconfigured, insufficient, or simply not addressing the correct threat vector.

Answer

Increase the control strength

Answer

Report to senior management

Answer

Accept the risk as residual

Question 3

A company is assessing the risk of a critical system outage. The system has a maximum tolerable downtime (MTD) of 2 hours, but the current recovery time objective (RTO) is 4 hours. What is the most appropriate risk treatment?

Accepted Answer

Mitigate by reducing the RTO to 1 hour through process automation. The current RTO of 4 hours exceeds the MTD of 2 hours, meaning the system cannot be restored within the maximum tolerable downtime, resulting in unacceptable business impact. Reducing the RTO to 1 hour through process automation brings recovery time well within the MTD, effectively mitigating the risk to an acceptable level. This aligns with the risk management principle of applying controls to close the gap between RTO and MTD.

Answer

Transfer the risk by purchasing business interruption insurance

Answer

Accept the risk because the RTO is shorter than the MTD

Answer

Avoid the risk by replacing the system with a more reliable one

Question 4

Based on the exhibit, what is the PRIMARY risk of the automated response policy as configured?

Accepted Answer

Automatic approval may cause unnecessary disruption on false positives. An automated response policy that approves blocking actions without human validation can trigger unnecessary disruption when false positives occur. Even if the severity threshold is appropriate, the lack of a verification step means legitimate traffic may be blocked, impacting business operations. The primary risk is not the effectiveness of the block but the operational impact of automated decisions on benign events.

Answer

Blocking the IP may be ineffective against dynamic IPs

Answer

The SOC manager may not receive notifications in time

Answer

The trigger severity is too low

Question 5

A multinational corporation is migrating its on-premises data center to a hybrid cloud environment. The organization processes highly sensitive financial data subject to strict regulatory requirements (e.g., GDPR, SOX). During the risk assessment, the information security manager discovers that the cloud service provider (CSP) stores data in multiple geographic regions, some of which do not meet the organization's data residency requirements. Additionally, the CSP's encryption key management is not fully under the organization's control, and the incident response plan does not include specific procedures for cloud-based breaches. The organization's risk appetite is low, and the board has mandated that all risks must be mitigated to an acceptable level. Which of the following is the BEST course of action?

Accepted Answer

Require the CSP to provide dedicated hardware security modules and restrict data storage to approved regions through contractual terms. It directly addresses the root causes: data residency non-compliance and lack of control over encryption keys. Requiring dedicated hardware security modules (HSMs) and restricting data storage to approved regions through contractual terms ensures that the organization retains control over key management and meets regulatory requirements. This aligns with the low risk appetite and the board's mandate to mitigate risks to an acceptable level.

Option B (accept the risk) is incorrect because it contradicts the board's mandate to mitigate all risks, and certifications alone do not guarantee compliance.
Option C (cancel migration) is too drastic and costly; the organization can achieve compliance with the CSP rather than abandoning the cloud migration.
Option D (transfer risk via insurance) does not achieve regulatory compliance; fines may still be imposed regardless of insurance coverage.

Answer

Accept the risk because the CSP has strong security certifications and the likelihood of a breach is low

Answer

Cancel the cloud migration and build a new private data center in a compliant location

Answer

Transfer the risk by purchasing cyber insurance that covers regulatory fines

Question 6

During the eradication phase of an incident response, which action is MOST critical to ensure the threat is fully removed?

Accepted Answer

Reimage all affected systems from known-good backups.. Reimaging all affected systems from known-good backups is the most critical action during the eradication phase because it ensures complete removal of the threat, including any rootkits, persistence mechanisms, or hidden malware that may survive simple file deletion or signature-based scans. This approach eliminates the risk of residual compromise, as the system is restored to a trusted state from a verified backup, which is essential for environments where the integrity of the operating system and applications cannot be guaranteed after an incident.

Answer

Delete the malware files from the system.

Answer

Reset passwords for all user accounts.

Answer

Update antivirus signatures.

Question 7

An information security manager is developing a security scorecard for the board. Which of the following should be included to BEST demonstrate governance performance?

Accepted Answer

Number of risk acceptances approved vs. rejected. The number of risk acceptances approved vs. rejected directly reflects the board's governance of risk appetite and decision-making. It shows how management formally accepts residual risk, which is a key governance function, unlike operational metrics that measure tactical execution.

Answer

Total number of security incidents this quarter

Answer

Percentage of systems patched within 30 days

Answer

Employee security training completion rate

Question 8

Which TWO of the following are PRIMARY goals of incident management according to industry best practices?

Accepted Answer

Restore normal operations as quickly as possible. Option A is correct because a primary goal of incident management, as defined in frameworks such as ITIL and NIST SP 800-61, is to restore normal service operation as quickly as possible while maintaining service quality. Option B is correct because minimizing the adverse impact on business operations and users is the other core objective, ensuring that disruptions to critical business functions are reduced. Documentation (C) is a supporting activity that aids auditing and post-incident review, but it is not a primary goal. Assigning blame (D) is counterproductive and contradicts the blameless post-mortem culture recommended by best practices. Increasing the security budget (E) is a possible organizational outcome but is not a goal of the incident management process itself.

Answer

Document all steps for compliance

Answer

Assign blame to the responsible party

Answer

Increase the security budget

Question 9

Which TWO of the following are recommended practices when conducting a post-incident review? (Select TWO)

Accepted Answer

Document lessons learned and improvement actions. Option A is correct because a post-incident review must produce documented lessons learned and concrete improvement actions so that the organization captures knowledge and feeds it back into its security program. Option D is correct because identifying the root cause of the incident is a core objective of the review, enabling the team to address the underlying weakness rather than only its symptoms. Option B is not recommended as an immediate step, since plan updates should follow from the documented lessons and be managed through change control rather than rushed during the review. Option C is wrong because post-incident reviews are blameless, focusing on process and systemic failures rather than punishing individuals. Option E is not a review practice; reimaging systems is a containment/recovery action that should be based on the findings, not a default review activity.

Answer

Update the incident response plan immediately

Answer

Assign blame to responsible individuals

Answer

Reimage all affected systems

Question 10

Given the exhibit, what is the most likely classification of this incident?

Accepted Answer

Brute-force attack. The exhibit shows a high volume of failed authentication attempts (e.g., repeated 'Login failed' events) from a single external IP address targeting multiple user accounts within a short time window. This pattern is characteristic of a brute-force attack, where an attacker systematically tries password combinations to gain unauthorized access. The incident classification is based on the specific behavior of repeated login failures, not on malware signatures or traffic flooding.

Answer

Malware infection

Answer

Denial of service

Answer

Insider threat

Question 11

During an internal audit, it is discovered that business units frequently purchase cloud services without involving the IT security department. Which governance deficiency does this scenario most clearly demonstrate?

Accepted Answer

Absence of a procurement security policy. The scenario describes business units procuring cloud services without IT security involvement, which directly indicates the absence of a procurement security policy. Such a policy would mandate security review and approval before any cloud service acquisition, ensuring that security requirements are integrated into the procurement lifecycle. Without it, security is bypassed, leading to ungoverned shadow IT and potential compliance violations.

Answer

Inadequate security awareness training

Answer

Lack of an incident response plan

Answer

Weak access control over cloud resources

Question 12

An organization plans to implement ISO/IEC 27001 to formalize its information security management system. Which step is most critical to ensure successful implementation?

Accepted Answer

Obtain commitment from top management. ISO/IEC 27001 requires top management to demonstrate leadership and commitment (Clause 5.1) as the foundation for the entire ISMS. Without executive buy-in, resources, authority, and cross-functional support are lacking, making risk assessments, policies, and training ineffective. The standard mandates management approval for the information security policy and ensures alignment with business objectives, which is the most critical success factor.

Answer

Conduct a comprehensive risk assessment

Answer

Develop detailed information security policies

Answer

Train all employees on security awareness

Question 13

A hospital chain has separate security teams for each facility. There is no central coordination, leading to duplicate efforts and inconsistent patient data protection. The system's CISO wants to improve governance with minimal disruption. What should he do?

Accepted Answer

Create a governance committee with representatives from each facility. A governance committee with representatives from each facility establishes a federated governance model that aligns security practices across the hospital chain without restructuring teams. This approach enables consistent policy development, shared oversight, and coordination of patient data protection efforts while minimizing operational disruption, as each facility retains its existing team structure. It directly addresses the lack of central coordination and duplicate efforts by creating a collaborative decision-making body, which is a core principle of information security governance.

Answer

Merge all teams into one central unit

Answer

Implement a top-down mandate for all policies

Answer

Outsource security to a third party

Question 14

An information security manager is asked to report on the effectiveness of the security program. Which metric would BEST indicate governance effectiveness?

Accepted Answer

Percentage of security initiatives directly linked to business strategy. Governance effectiveness is measured by how well the security program aligns with and supports business objectives. Option A directly reflects this alignment by showing the percentage of security initiatives tied to business strategy, which is a key indicator of strategic governance rather than operational or tactical performance.

Answer

Number of critical vulnerabilities identified

Answer

Number of audit findings per quarter

Answer

Mean time to detect and respond to incidents

Question 15

Which incident severity level is characterized by major business impact, requires executive notification, and demands 24/7 response?

Accepted Answer

P1 — Critical. P1 (critical) incidents have the highest severity and require immediate, around-the-clock response.

Answer

P3 — Medium

Answer

P2 — High

Answer

P4 — Low