CISM Practice Test 44 — 15 Questions

Question 1

Arrange the steps in order for conducting a business impact analysis (BIA) in business continuity management.

Accepted Answer

Identify critical business functions, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions, then document findings. A BIA first identifies critical functions, then determines acceptable downtime, assesses impact, prioritizes recovery, and finally documents findings.

Answer

Identify critical business functions, then assess impact of disruptions, then determine acceptable downtime, then prioritize recovery of critical functions, then document findings

Answer

Identify critical business functions, then document findings, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions

Answer

Document findings, then prioritize recovery of critical functions, then assess impact of disruptions, then determine acceptable downtime, then identify critical business functions

Question 2

A company has a small security team and limited budget. Which initial investment provides the MOST value for building an effective security program?

Accepted Answer

Conduct security awareness training for all employees. Security awareness training is the most cost-effective initial investment because human error remains the leading cause of security incidents, especially in resource-constrained environments. By educating employees on phishing, social engineering, and safe data handling, the organization reduces the attack surface without requiring expensive tools or specialized staff. This foundational control directly addresses the most common threat vector—user behavior—which automated systems alone cannot fully mitigate.

Answer

Implement an automated policy enforcement system

Answer

Deploy an asset inventory management tool

Answer

Perform a comprehensive penetration test

Question 3

An information security manager is designing a program for a healthcare organization. Which of the following should be the FIRST step in establishing the program?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment is the foundational first step because it identifies and prioritizes the specific threats and vulnerabilities facing the healthcare organization's sensitive data (e.g., PHI under HIPAA). Without this baseline understanding, any subsequent policies, controls, or metrics would be misaligned with actual risk exposure, leading to ineffective or wasteful security investments.

Answer

Develop information security policies and procedures

Answer

Select and implement security controls

Answer

Define security metrics and reporting

Question 4

A multinational corporation is designing an information security program to align with diverse business units and regulatory requirements across different regions. The CISO is prioritizing key components that ensure the program is both comprehensive and adaptable. Which TWO components are most critical for achieving this alignment?

Accepted Answer

Establishing a governance structure with defined roles, responsibilities, and oversight. A governance structure with defined roles, responsibilities, and oversight (Option B) is critical because it provides the authority, accountability, and decision-making framework needed to align security activities with diverse business units and regulatory requirements. Without clear governance, the program lacks the mechanisms to enforce policies, manage exceptions, and adapt to regional legal variations, such as GDPR in Europe or CCPA in California.

Answer

Focusing exclusively on the most stringent regulatory requirement to satisfy all others

Answer

Adopting a single security framework such as ISO 27001 for all regions

Answer

Implementing separate security programs for each business unit to address unique needs

Question 5

A global financial services firm uses a Monte Carlo simulation model to quantify the potential financial impact of cyber events. The model inputs include historical loss data, threat intelligence, and control effectiveness. Over the past year, the model has consistently underestimated actual losses by an average of 40%. The risk manager suspects model risk but the quantitative team argues the model is peer-reviewed. The board is concerned about the accuracy of risk reporting. What is the best course of action for the risk manager?

Accepted Answer

Perform a comprehensive model validation and sensitivity analysis. Performing model validation and sensitivity analysis will help identify assumptions, data quality, or structural issues causing the underestimation. Option B is incorrect because increasing risk appetite does not address the model error; it could mask the problem. Option C is incorrect because abandoning a quantitative model for qualitative may lose objectivity, though it could be considered if model risk cannot be reduced. Option D is incorrect because simply adjusting parameters to match past incidents overfits and may not predict future losses accurately.

Answer

Increase the risk appetite to accommodate the underestimation

Answer

Replace the quantitative model with a qualitative risk assessment

Answer

Adjust the model parameters to align with observed losses

Question 6

Which TWO of the following are indicators of a potential security incident?

Accepted Answer

Multiple unexpected system reboots.. Multiple unexpected system reboots (B) are a strong indicator of a potential security incident because they may result from malware, kernel-level exploits, or denial-of-service attacks that crash the operating system. Unusual outbound network traffic from a server (E) often indicates data exfiltration, command-and-control (C2) communication, or a compromised service sending sensitive data to an external host. Both behaviors deviate from baseline operations and warrant immediate investigation under the Incident Management domain.

Answer

Low disk space on a file server.

Answer

A new version of a critical software released.

Answer

A successful login by an authorized user.

Question 7

A security manager wants to measure the effectiveness of the security awareness program. Which metric is most relevant?

Accepted Answer

Phishing simulation click rate. Phishing simulation click rate directly measures user behavior change, a key indicator of awareness effectiveness.

Answer

Security budget variance

Answer

Mean time to detect incidents

Answer

Number of security policies updated

Question 8

Which of the following is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a systematic method for responding to incidents. The primary purpose of an incident response plan is to establish a structured, systematic methodology for detecting, containing, eradicating, and recovering from security incidents. This ensures that the organization can minimize damage, reduce recovery time and costs, and preserve evidence for forensic analysis. Without a predefined plan, responses become ad hoc, increasing the likelihood of errors and extended downtime.

Answer

To assign blame for security failures

Answer

To prevent all security incidents from occurring

Answer

To meet regulatory compliance requirements

Question 9

An organization's security monitoring system detects multiple failed login attempts from an internal IP address to a critical database server. The attempts are occurring every few seconds. What is the FIRST step the incident response team should take?

Accepted Answer

Verify whether the activity is legitimate.. The first step is to verify if the activity is legitimate or malicious to avoid false positives and understand the context.

Answer

Block the IP address at the firewall immediately.

Answer

Disable the database server to prevent data breach.

Answer

Reset the password of the database service account.

Question 10

A CISO reports to the CIO and provides regular security updates to the board audit committee. The CEO has delegated security accountability to the CFO. Which governance structure does this reflect?

Accepted Answer

Hybrid with executive accountability. This structure shows the CISO reporting to CIO (dotted line to board), with executive accountability assigned to CFO, typical of a tiered governance model.

Answer

Decentralized with business unit CISO

Answer

Outsourced security management

Answer

Centralized with CISO reporting to CEO

Question 11

An organization is developing its information security strategy. Which of the following should be the PRIMARY driver for defining security objectives?

Accepted Answer

Business objectives. Business objectives are the primary driver for defining security objectives because information security exists to enable the organization to achieve its mission and strategic goals. Security objectives must align with and support business objectives to ensure that resources are allocated effectively and that security controls are prioritized based on risk to the business, not just compliance or generic practices.

Answer

Industry best practices

Answer

Historical security incidents

Answer

Regulatory compliance requirements

Question 12

An organization is implementing a quantitative risk analysis for a critical application. The asset value is $2,000,000. The exposure factor (EF) is 0.25, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$250,000. The annualized loss expectancy (ALE) is calculated as ALE = AV × EF × ARO, where AV is the asset value ($2,000,000), EF is the exposure factor (0.25), and ARO is the annualized rate of occurrence (0.5). Multiplying these gives $2,000,000 × 0.25 × 0.5 = $250,000, which represents the expected annual financial loss from this risk.

Answer

$1,000,000

Answer

$125,000

Answer

$500,000

Question 13

A security analyst detects unusual outbound network traffic from a database server to an unknown IP address. The traffic uses encrypted connections on port 443. Which type of attack is MOST likely occurring?

Accepted Answer

Data exfiltration. The encrypted outbound traffic on port 443 (HTTPS) from a database server to an unknown IP is a classic indicator of data exfiltration. Attackers often use encrypted channels to bypass network security controls, as the contents of the traffic cannot be inspected by DLP or IDS/IPS systems. The database server is a high-value target for sensitive data, making this the most likely attack scenario.

Answer

SQL injection

Answer

Ransomware

Answer

Denial of service

Question 14

A large enterprise experiences a data breach involving personal identifiable information (PII) of customers. The incident response team has contained the breach and is now in the eradication phase. The CISO wants to ensure that the same vulnerability cannot be exploited again. Which action is MOST critical?

Accepted Answer

Patch the specific vulnerability identified.. Patching the specific vulnerability is the most critical action during the eradication phase because it permanently removes the root cause of the breach. Without this step, the same attack vector (e.g., an unpatched SQL injection flaw or a known CVE in a web server) remains exploitable, rendering containment efforts temporary. The CISO's goal to prevent recurrence directly requires eliminating the technical weakness, not just mitigating its symptoms.

Answer

Change all passwords of affected accounts.

Answer

Notify affected customers about the breach.

Answer

Deploy additional endpoint protection software.

Question 15

During a phishing campaign, several employees clicked a malicious link that downloaded a remote access trojan (RAT). The incident response team has isolated the infected endpoints and is analyzing network traffic. They suspect that data may have been exfiltrated but are unsure. The team needs to determine the extent of data exfiltration as quickly as possible. What action should the team take FIRST?

Accepted Answer

Review DNS logs for outbound connections to unknown destinations. Reviewing DNS logs can reveal connections to known malicious domains or unusual patterns, helping identify data exfiltration. Blocking the domain is a containment step but doesn't aid analysis. Running a network scan may be too broad. Resetting passwords is important but not for detecting exfiltration.

Answer

Block the malicious domain at the firewall

Answer

Reset all employees' passwords

Answer

Run a full network scan for open ports