CISM Practice Test 45 — 15 Questions

Question 1

A security dashboard is being designed for the C-suite. Which metric is most appropriate for a one-page executive summary?

Accepted Answer

Security scorecard with overall risk level. The security scorecard with overall risk level is the most appropriate metric for a one-page executive summary because it provides a high-level, aggregated view of the organization's security posture. Executives need a concise, actionable summary that distills complex security data into a single risk indicator, enabling quick decision-making without technical details.

Answer

Number of phishing simulation campaigns

Answer

List of all security incidents in the quarter

Answer

Detailed patch compliance by system

Question 2

An organization has experienced a ransomware attack that encrypted critical servers. The incident has been classified as P1. Which of the following is the FIRST action the incident response team should take according to the IR plan?

Accepted Answer

Contain the incident by isolating affected systems from the network.. According to standard incident response (IR) frameworks such as NIST SP 800-61 and CISM best practices, the first priority after detecting a P1 incident like ransomware is containment. Isolating affected systems from the network prevents the malware from spreading to other critical servers and limits the blast radius. Only after containment should the team proceed with eradication, recovery, and forensic analysis.

Answer

Perform root cause analysis to determine how the ransomware entered.

Answer

Begin forensic imaging of all affected servers for evidence preservation.

Answer

Notify the CEO and activate the crisis management team.

Question 3

An organization's security program has been in place for two years, but recently several security incidents occurred due to lack of user awareness. What is the most likely root cause?

Accepted Answer

The awareness program is not regularly updated or evaluated for effectiveness.. The scenario states the security program has been in place for two years, yet incidents persist due to lack of user awareness. This indicates the awareness program exists but is not being regularly updated or evaluated for effectiveness, which is a common root cause in mature programs where content becomes stale and fails to address evolving threats like phishing or social engineering.

Answer

Lack of a security awareness program.

Answer

Insufficient budget for security tools.

Answer

Insufficient firewall rules.

Question 4

During a security program review, the auditor finds that incident response procedures have not been tested in over two years. What is the MOST significant risk arising from this finding?

Accepted Answer

Ineffective response leading to greater damage during an incident. The most significant risk of not testing incident response procedures for over two years is that the response will be ineffective when a real incident occurs, leading to greater damage, longer downtime, and potentially uncontrolled escalation. Untested procedures may contain outdated contacts, incorrect escalation paths, or missing steps, so the organization cannot rely on them. While compliance and cost are concerns, the primary security risk is the inability to contain and recover effectively, which directly increases business impact.

Answer

Non-compliance with regulatory requirements

Answer

Higher financial costs due to inefficiencies

Answer

Increased recovery time after an incident

Question 5

After a P2 (high) incident is resolved, the incident response team conducts a lessons learned meeting. Which timeframe is most appropriate for holding this meeting?

Accepted Answer

Within 2 weeks of incident resolution. Holding the lessons learned meeting within about two weeks of resolution balances memory freshness with enough time to gather facts and complete preliminary analysis. It is soon enough that details are still accurate but late enough that the team is no longer in firefighting mode. This aligns with common IR frameworks like NIST SP 800-61.

Answer

Immediately after containment

Answer

Only after the root cause analysis is completed

Answer

Within 30 days of incident resolution

Question 6

An organization is subject to GDPR, PCI DSS, and SOX. What is the BEST approach to manage compliance with multiple regulations?

Accepted Answer

Develop a control framework that maps to all regulations. A unified control framework that maps controls to multiple regulations eliminates duplicate effort and ensures each regulatory requirement is satisfied by a single, well-understood control set. Because GDPR, PCI DSS, and SOX share many overlapping controls (access management, logging, encryption, change management), mapping them once to a common framework lets the organization demonstrate compliance with all three without redundant audits or conflicting processes. This is the standard CISM-aligned approach: harmonize, don't silo.

Answer

Assign each regulation to a separate compliance team

Answer

Implement the most stringent requirements for all

Answer

Focus only on the regulation with the highest fines

Question 7

A company experiences ransomware that encrypts critical servers. Backups are available but were taken 2 weeks ago. What is the best course?

Accepted Answer

Restore from backups after verifying no residual malware and performing security scans. Restore from backups after verifying no residual malware and performing security scans to ensure clean restoration.

Answer

Restore from backups immediately

Answer

Rebuild servers from scratch

Answer

Pay the ransom

Question 8

An organization's security program includes metrics to measure performance. Which metric BEST indicates the effectiveness of the vulnerability management process?

Accepted Answer

Mean time to remediate (MTTR) vulnerabilities. Mean time to remediate (MTTR) directly measures how quickly the organization closes the window of exposure after a vulnerability is identified. A lower MTTR indicates a more effective vulnerability management process because it reduces the risk window, whereas raw counts of vulnerabilities or patches do not reflect the timeliness or completeness of remediation.

Answer

Number of vulnerabilities identified

Answer

Number of patches deployed per month

Answer

Percentage of systems scanned weekly

Question 9

TechStart, a cloud-based startup, has rapidly grown from 50 to 500 employees. It lacks a formal security governance structure. The CEO asks the CISO to develop one. The CISO finds that the company's culture values speed over compliance. The board expects a governance framework within three months. What is the most practical approach?

Accepted Answer

Start with a lean governance model, focusing on critical assets and compliance requirements. The most practical approach because it balances the need for governance with the company's culture of speed. Starting with a lean governance model allows the organization to quickly establish controls for critical assets and meet compliance requirements without overwhelming the team. Option A is too heavy; a full COBIT implementation would be disruptive and counter to the culture. Option B is risky as it postpones governance, potentially leading to non-compliance. Option D focuses only on technical controls, ignoring the broader governance framework needed.

Answer

Implement a full COBIT framework immediately

Answer

Defer governance until after the next product launch

Answer

Focus solely on technical controls like firewalls and IAM

Question 10

An organization's incident response policy requires preserving evidence in its original state. During a live incident on a critical server, the incident response team needs to capture volatile data, such as running processes and network connections, which would be lost if the system were shut down. The team has a forensic workstation with various tools. What tool should the team use to capture the volatile data before taking the system offline?

Accepted Answer

Memory dump tool (e.g., winpmem). Volatile data from memory is best captured using a dedicated memory acquisition tool like winpmem or similar. FTK Imager and WinHex are primarily for disk imaging. The dd command is used for disk copying, not memory. Memory dumps capture volatile data.

Answer

WinHex

Answer

dd command

Answer

FTK Imager

Question 11

During incident response, a team discovers that a phishing email successfully compromised a user's credentials. Which containment strategy would BEST limit further damage?

Accepted Answer

Disable the user account. Disabling the user account immediately stops any ongoing misuse of the compromised credentials, preventing the attacker from accessing additional resources. Option A is correct.

Answer

Restore the user's system from a backup

Answer

Block the sender's IP address at the firewall

Answer

Change all user passwords

Question 12

An organization's intrusion detection system alerts on a potential C2 communication from an internal host. Which phase of the incident response lifecycle should be initiated first?

Accepted Answer

Detection and Analysis. When an IDS alerts on potential C2 communication, the organization must first verify the alert and determine the scope of the incident. The Detection and Analysis phase is the initial step in the incident response lifecycle, as defined by NIST SP 800-61, because it involves confirming the alert, analyzing indicators of compromise (IoCs), and assessing the severity before any containment actions are taken. Without proper detection and analysis, containment efforts could be misdirected or ineffective.

Answer

Post-Incident Activity

Answer

Preparation

Answer

Containment, Eradication, and Recovery

Question 13

During a third-party risk assessment, the security team discovers that a critical vendor's sub-supplier (nth party) has access to sensitive data. The vendor contract does not address nth-party risk. What is the BEST course of action?

Accepted Answer

Revise the contract to require the vendor to flow down security requirements to sub-suppliers. The core issue is that the vendor contract does not address nth-party (sub-supplier) risk, so the organization has no contractual leverage to require the vendor to manage its sub-suppliers. The best course of action is to revise the contract to include flow-down clauses that require the vendor to impose security requirements on its sub-suppliers, thereby extending the organization's security posture through the supply chain. This addresses the root cause—lack of contractual control—and is a preventive, governance-level action.

Answer

Accept the risk because the vendor is contractually responsible

Answer

Perform an on-site assessment of the sub-supplier

Answer

Request that the vendor terminate the sub-supplier relationship

Question 14

Which TWO of the following are components of a typical vulnerability management program?

Accepted Answer

Remediating identified vulnerabilities through patching. A vulnerability management program is built around a continuous cycle of discovering, prioritizing, and fixing weaknesses, so option E (conducting regular vulnerability scans) is correct because recurring authenticated and unauthenticated scans are the primary discovery mechanism that populates the vulnerability inventory. Option B (remediating identified vulnerabilities through patching) is correct because remediation—applying vendor patches, configuration changes, or compensating controls—closes the loop and is the ultimate goal of the program; scanning without remediation provides no risk reduction. Option A (security awareness training) belongs to a security education/awareness program, not vulnerability management, since it targets human behavior rather than technical weaknesses. Option C (monitoring network traffic for anomalies) is a detection/incident-monitoring activity typically handled by IDS/IPS, SIEM, or SOC operations, not vulnerability management. Option D (performing penetration tests) is an offensive security assessment that can validate and supplement a vulnerability management program, but it is a point-in-time testing exercise rather than a core component of the ongoing scan-and-remediate process.

Answer

Conducting security awareness training

Answer

Monitoring network traffic for anomalies

Answer

Performing penetration tests

Question 15

Which TWO of the following are required components of an incident response programme according to best practices? (Select two.)

Accepted Answer

Incident response policy. Option B (Incident response policy) is correct because best-practice frameworks such as NIST SP 800-61 and ISO/IEC 27035 require a formally approved policy that establishes the authority, scope, objectives, and management commitment for the incident response capability. Option C (Incident response plan) is correct because the plan is the documented, actionable set of procedures—roles, phases (preparation, detection and analysis, containment, eradication, recovery, post-incident activity), and escalation paths—that operationalizes the policy. The remaining items are supporting artifacts rather than required programme components: an IR team roster (A), communication templates (D), and a vendor contacts list (E) are useful appendices or resources referenced by the plan, but they are not themselves mandatory components of an incident response programme.

Answer

IR team roster

Answer

Communication templates

Answer

Vendor contacts list