CISM Practice Test 45 — 15 Questions

Question 1

An information security manager is evaluating the maturity of the organization's security program. Which of the following indicators suggest a high level of maturity? (Select TWO.)

Accepted Answer

Security metrics are included in regular executive reports. Including security metrics in regular executive reports demonstrates that security performance is being measured, tracked, and communicated to leadership as part of ongoing governance. This aligns with a mature security program where security is integrated into business decision-making, not treated as a siloed technical function.

Answer

All security incidents are resolved within 24 hours

Answer

The program uses the latest encryption standards

Answer

The security team conducts annual penetration tests

Question 2

An organization's information security program includes a formal exception process. When reviewing an exception request to bypass a critical control, what is the MOST important factor for the information security manager to consider?

Accepted Answer

The residual risk after compensating controls. The most important factor when reviewing an exception request to bypass a critical control is the residual risk after compensating controls. This ensures that the organization's risk appetite is not exceeded and that the compensating controls adequately mitigate the risk to an acceptable level, as required by frameworks like ISO 27001 and NIST SP 800-53.

Answer

The cost of implementing the control

Answer

The number of users affected by the exception

Answer

The duration of the exception

Question 3

A security program includes multiple metrics. Which metric best indicates the program's effectiveness in reducing overall risk?

Accepted Answer

Composite risk score based on threat, vulnerability, and control assessments.. A composite risk score aggregates threat, vulnerability, and control assessment data into a single metric that directly reflects the organization's residual risk posture. This metric is the most holistic indicator of program effectiveness because it quantifies how well security controls reduce the likelihood and impact of threats exploiting vulnerabilities, aligning with the CISM focus on risk management.

Answer

Number of security incidents per quarter.

Answer

Mean time to detect (MTTD) incidents.

Answer

Percentage of employees who completed security training.

Question 4

Which THREE of the following are key components of an incident response plan?

Accepted Answer

List of external contacts (law enforcement, legal, etc.).. An incident response plan must include a list of external contacts such as law enforcement, legal counsel, and regulatory bodies. This ensures that when a security incident occurs, the organization can quickly notify the appropriate authorities and comply with legal and regulatory requirements, such as breach notification laws under GDPR or HIPAA.

Answer

Annual budget for cybersecurity tools.

Answer

Detailed step-by-step procedures for each incident type.

Question 5

Which TWO of the following are key performance indicators (KPIs) that demonstrate the effectiveness of a security awareness program?

Accepted Answer

Percentage of employees who correctly identify a phishing email in simulations. The percentage of employees who correctly identify a phishing email in simulations directly measures the behavioral outcome of the awareness program. A high detection rate indicates that employees are applying the training to recognize social engineering tactics, such as spoofed sender addresses or malicious links, which is a key performance indicator (KPI) for program effectiveness.

Answer

Number of employees who report suspicious emails

Answer

Frequency of phishing simulation tests

Answer

Number of training sessions completed per quarter

Question 6

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select exactly three.)

Accepted Answer

Risk transfer (sharing). ISO 31000 defines risk transfer (sharing) as a valid risk treatment option, where the risk is shifted to another party, such as through insurance or outsourcing. This is a standard approach in information security risk management to reduce the financial impact of a risk event.

Answer

Risk elimination

Answer

Risk deferral

Question 7

An organization is developing an information security program for a new subsidiary. Which approach BEST ensures that the subsidiary's program complements the parent's?

Accepted Answer

Adopt a recognized international standard such as ISO 27001. Adopting a recognized international standard such as ISO 27001 ensures that the subsidiary's information security program is built on a globally accepted framework, which inherently aligns with the parent's program through common controls, terminology, and audit criteria. This approach provides a structured, risk-based methodology that complements the parent's program without requiring exact replication, which may not fit the subsidiary's unique operational context. ISO 27001's Annex A controls and Plan-Do-Check-Act (PDCA) cycle facilitate interoperability and consistent governance across entities.

Answer

Replicate the parent's policies exactly

Answer

Perform a separate risk assessment for the subsidiary

Answer

Outsource security management to a third party

Question 8

Which TWO of the following are key components of an information security governance framework? (Choose two.)

Accepted Answer

Security policy and standards.. Security policy and standards are foundational components of an information security governance framework because they establish the high-level direction, principles, and mandatory requirements that guide the organization's security posture. The risk management process is equally critical as it provides a structured methodology for identifying, assessing, and treating risks, ensuring that security decisions are aligned with business objectives and risk appetite. Together, they form the strategic and operational backbone of governance, enabling accountability and continuous improvement.

Answer

Intrusion detection system (IDS) configuration.

Answer

Firewall rule set.

Answer

Payment Card Industry Data Security Standard (PCI DSS) compliance report.

Question 9

Refer to the exhibit. A company implements this data classification scheme. Which risk is most likely introduced by this scheme?

Accepted Answer

Under-classification of internal data, leading to exposure. The classification scheme shown in the exhibit (likely a simple three-tier model: Public, Internal, Confidential) fails to include a distinct 'Restricted' or 'Highly Confidential' tier for the most sensitive data. This forces all non-public data into the 'Internal' bucket, which is then handled with the same baseline controls as moderately sensitive information. The primary risk is under-classification of truly sensitive internal data, leading to inadequate access controls and potential exposure.

Answer

Over-classification of data, increasing administrative burden

Answer

Inability to audit data access

Answer

Inconsistent handling of confidential data

Question 10

During incident investigation, which evidence preservation method is most important?

Accepted Answer

Create a forensic image of affected drives. Creating a forensic image of affected drives (option C) is the most important evidence preservation method because it captures a bit-for-bit copy of the storage media, including deleted files, slack space, and unallocated clusters, without altering the original evidence. This ensures data integrity and admissibility in legal proceedings, as the image can be hashed (e.g., using SHA-256) and verified against the original. In incident response, the order of volatility dictates that persistent storage is preserved after volatile memory, but for long-term analysis, the forensic image is the gold standard.

Answer

Take screenshots of the attack

Answer

Interview witnesses immediately

Answer

Reboot the system to capture memory

Question 11

Order the steps for implementing a data classification policy in an organization.

Accepted Answer

Define data classification categories, then define classification procedures and guidelines, then train employees on classification, then label data according to classifications, then monitor compliance and update policy.. Data classification starts with defining categories, then procedures, training, labeling, and monitoring.

Answer

Define data classification categories, then label data according to classifications, then define classification procedures and guidelines, then train employees on classification, then monitor compliance and update policy.

Answer

Train employees on classification, then define data classification categories, then define classification procedures and guidelines, then label data according to classifications, then monitor compliance and update policy.

Answer

Define data classification categories, then define classification procedures and guidelines, then label data according to classifications, then train employees on classification, then monitor compliance and update policy.

Question 12

A multinational corporation is experiencing significant security incidents due to inconsistent security policies across subsidiaries. The CISO proposes implementing a centralized governance model. However, business unit leaders argue that local regulations require autonomy. Which approach best balances governance with local compliance?

Accepted Answer

Develop a framework of minimum security requirements, allowing local augmentation. A framework of minimum security requirements establishes a baseline that satisfies corporate governance needs while explicitly allowing local business units to add controls to meet regional regulations (e.g., GDPR, PIPL). This approach preserves the principle of subsidiarity in governance, ensuring that local compliance obligations are met without fragmenting the overall security posture.

Answer

Implement a single global security policy with mandatory compliance

Answer

Delegate all security decisions to local business units

Answer

Outsource security governance to a third-party managed service

Question 13

A multinational organization is evaluating its risk appetite for a new cloud-based customer relationship management (CRM) system. The system will store personal data across multiple jurisdictions with varying data protection laws. The risk committee has set a risk appetite statement that allows only low residual risk. Which of the following controls is MOST critical to ensure compliance with the risk appetite?

Accepted Answer

Implement data classification and strict role-based access controls. The risk appetite allows only low residual risk, meaning controls must directly reduce the likelihood or impact of a data breach to an acceptable level. Data classification and strict role-based access controls (RBAC) are the most critical because they enforce least-privilege access to personal data, directly mitigating the primary risk of unauthorized exposure across jurisdictions with varying data protection laws. Without proper classification and RBAC, even encryption or monitoring cannot prevent an authorized user from improperly accessing or exfiltrating data, leaving residual risk above the low threshold.

Answer

Conduct continuous monitoring and logging of all system activities

Answer

Encrypt all data at rest and in transit using strong algorithms

Answer

Negotiate service-level agreements (SLAs) with cloud provider for uptime

Question 14

An organization has recently experienced a data breach due to an insider threat. The board has requested an update on governance improvements. Which of the following should the information security manager recommend first?

Accepted Answer

Developing a formalized insider threat program with clear roles and responsibilities.. A formalized insider threat program with clear roles and responsibilities is the first governance improvement because it establishes a structured framework for detecting, preventing, and responding to insider threats. Unlike tactical controls, this program defines ownership, escalation paths, and policy integration, directly addressing the board's request for governance improvements rather than just technical fixes.

Answer

Conducting annual security awareness training for all employees.

Answer

Implementing two-factor authentication for all critical systems.

Answer

Deploying endpoint detection and response (EDR) software on all systems.

Question 15

After a P2 (high) incident is resolved, the incident response team conducts a lessons learned meeting. Which timeframe is most appropriate for holding this meeting?

Accepted Answer

Within 2 weeks of incident resolution. Industry best practices and many frameworks recommend holding a lessons learned meeting within two weeks of incident resolution while details are still fresh.

Answer

Immediately after containment

Answer

Only after the root cause analysis is completed

Answer

Within 30 days of incident resolution