CISM Practice Test 46 — 15 Questions

Question 1

Which TWO of the following are primary goals of the containment phase in incident response? (Select TWO)

Accepted Answer

Prevent the incident from spreading to other systems. Option D is correct because the containment phase is specifically designed to stop an active incident from propagating to additional hosts, accounts, or network segments, for example by isolating compromised endpoints, segmenting VLANs, or blocking malicious C2 traffic at the firewall. Option E is correct because containment also aims to limit the scope and impact of the incident, minimizing damage to data, services, and other assets while the incident is still being actively managed. Options A, B, and C do not belong here: restoring normal business operations is the goal of the recovery phase, eradicating the root cause is the goal of the eradication phase, and while evidence preservation is important throughout incident response, it is not one of the two primary goals of containment itself.

Answer

Restore normal business operations

Answer

Eradicate the root cause of the incident

Answer

Preserve evidence for legal proceedings

Question 2

A mature security program allocates 12% of IT budget to security. Which combination of budget components is most balanced for a program seeking to improve detection and response capabilities?

Accepted Answer

Personnel 40%, Technology 30%, Services 20%, Training 10%. A balanced security budget for improving detection and response typically allocates the largest portion to personnel (40%), since skilled analysts are critical for threat hunting, incident response, and security operations. Technology (30%) supports tools like SIEM, EDR, and SOAR, while services (20%) provide specialized expertise, and training (10%) ensures staff remain proficient. This distribution avoids over-reliance on technology or personnel alone, aligning with CISM's emphasis on balanced program management.

Answer

Personnel 20%, Technology 50%, Services 20%, Training 10%

Answer

Personnel 50%, Technology 20%, Services 20%, Training 10%

Answer

Personnel 30%, Technology 30%, Services 30%, Training 10%

Question 3

A CISO is presenting a security investment proposal to the board. Which two metrics are most effective for articulating the business value of the investment?

Accepted Answer

Breach cost avoidance. Breach cost avoidance (A) is correct because it translates security spending into avoided financial losses from incidents such as data breaches, ransomware, and business interruption, which is the language a board uses to evaluate investment returns. Compliance cost avoidance (E) is also correct because it quantifies savings from avoiding regulatory fines, penalties, legal fees, and remediation costs tied to frameworks like PCI DSS, HIPAA, or GDPR, directly linking security to the bottom line. Mean time to patch (B) is an operational vulnerability-management metric that measures remediation speed but does not by itself express monetary business value. Number of security staff (C) and number of security tools deployed (D) are activity or inventory counts that indicate effort and resource use, not the financial benefit or risk reduction delivered to the business.

Answer

Mean time to patch

Answer

Number of security staff

Answer

Number of security tools deployed

Question 4

A CISO is reporting to the board on the effectiveness of the security programme. Which TWO metrics are MOST appropriate for board-level reporting? (Select TWO)

Accepted Answer

Mean time to detect (MTTD) and mean time to respond (MTTR). Option B (MTTD and MTTR) is correct because these metrics quantify how quickly the security operations function detects and contains incidents, directly expressing the programme's operational effectiveness in business-relevant terms the board can track over time. Option D (security investment vs. loss avoidance) is correct because it frames security spending against avoided financial impact, giving the board a cost-benefit view of risk reduction that supports governance and funding decisions. The unmarked options are too tactical or activity-based for board-level reporting: firewall rule changes (A) and patch compliance percentage (E) are operational/technical metrics, and training completion counts (C) measure activity rather than outcome or risk reduction.

Answer

Number of firewall rules changed

Answer

Number of employees who completed security training

Answer

Patch compliance percentage

Question 5

Which TWO of the following are characteristics of a security champions program that contribute to its effectiveness?

Accepted Answer

Champions act as liaisons between security and their teams. Option C is correct because the core value of a security champions program is that champions serve as the liaison or bridge between the central security team and their own development/product teams, translating security requirements into the team's language and feeding practical concerns back to security. Option E is correct because effective champions are typically volunteers drawn from development (or engineering) teams who receive additional security training, which gives them credibility with peers and the embedded knowledge to influence secure practices organically. Option A is incorrect because champions normally remain within their existing team and reporting line, not reporting directly to the CISO, which would undermine their embedded liaison role. Option B is incorrect because rotating champions every six months destroys the continuity, relationship-building, and accumulated security expertise that make the program effective. Option D is incorrect because champions are influencers and advocates, not enforcers; they generally lack the authority to enforce security policies, which remains with security leadership and management.

Answer

Champions report directly to the CISO

Answer

Champions are rotated every six months

Answer

Champions have authority to enforce security policies

Question 6

Which THREE of the following are key activities in a third-party risk management (TPRM) program?

Accepted Answer

Ongoing monitoring of vendor security posture. Option A (Ongoing monitoring of vendor security posture) is correct because TPRM requires continuous oversight of a vendor's security controls, compliance status, and threat exposure after onboarding, using methods such as periodic reassessments, security ratings services, and audit reviews. Option C (Negotiating contract security requirements) is correct because TPRM includes embedding security, privacy, data-handling, breach-notification, and right-to-audit clauses into vendor contracts to establish enforceable obligations and risk allocation. Option D (Onboarding risk assessment for new vendors) is correct because TPRM begins with due diligence before engagement, evaluating the vendor's security posture, data access, criticality, and compliance against organizational risk tolerance. Option B (Providing vendor with access to internal network) is not a TPRM activity; it is an operational access decision that should be minimized and controlled, not a core program function. Option E (Performing background checks on vendor employees) is not a TPRM program activity; personnel screening is typically the vendor's responsibility under contract, and TPRM focuses on organizational vendor risk rather than individual employee vetting.

Answer

Providing vendor with access to internal network

Answer

Performing background checks on vendor employees

Question 7

A security policy is being developed. Which THREE steps are part of the policy development lifecycle? (Select THREE)

Accepted Answer

Drafting the policy based on input. Option A (Drafting the policy based on input) is correct because drafting is the core authoring phase of the policy development lifecycle, where gathered requirements and feedback are turned into the actual written policy document. Option C (Stakeholder consultation to gather input) is correct because the lifecycle begins with identifying affected parties and collecting their requirements, which ensures the policy is accurate, practical, and enforceable. Option E (Gap analysis against existing policies and standards) is correct because comparing the proposed policy against current policies, regulations, and frameworks such as ISO/IEC 27001 or NIST SP 800-53 identifies overlaps, conflicts, and missing controls before finalization. Option B (Conducting penetration testing) does not belong because penetration testing is a technical security assessment activity performed after policy implementation, not a policy authoring step. Option D (Implementing the policy in firewalls) does not belong because configuring firewall rules is a technical enforcement action that follows policy approval, not part of the development lifecycle itself.

Answer

Conducting penetration testing

Answer

Implementing the policy in firewalls

Question 8

A security architect is designing a defense-in-depth strategy for a financial institution. Which TWO of the following are essential components of a defense-in-depth approach?

Accepted Answer

Network segmentation to isolate critical systems.. Option C is correct because network segmentation isolates critical systems (e.g., cardholder data environments) into separate VLANs or subnets with strict ACLs and firewall rules, so a breach in one zone cannot easily pivot to high-value assets, which is a core defense-in-depth layer. Option E is correct because EDR provides continuous endpoint telemetry, behavioral detection, and automated response (e.g., process isolation, host quarantine) on workstations and servers, adding a host-level detection and response layer that complements perimeter and network controls. Option A is not correct because a single perimeter firewall represents a single point of failure and a flat-trust model, contradicting defense-in-depth's requirement for multiple overlapping controls. Option B is not correct because SSO centralizes authentication and, if compromised, can grant broad access; it is an identity convenience/control, not a layered defensive component by itself. Option D is not correct because annual penetration testing is a point-in-time assessment, not a primary preventive or detective control, and cannot substitute for continuous layered defenses.

Answer

A single, strong firewall at the network perimeter.

Answer

A single sign-on (SSO) solution for all applications.

Answer

Annual penetration testing as the primary security control.

Question 9

Which TWO of the following are essential components of a security program governance structure?

Accepted Answer

Security charter. A security charter is a foundational governance document that formally authorizes the security program, defines its scope, objectives, and assigns authority and accountability, making it an essential component of the governance structure. A security steering committee provides ongoing oversight, strategic direction, and cross-functional decision-making, which is central to governing a security program. By contrast, a vulnerability scanning schedule is an operational activity, an incident response plan is a tactical/operational document, and a help desk ticketing system is an operational tool—none of these establish the authority, oversight, or accountability mechanisms that define governance.

Answer

Vulnerability scanning schedule

Answer

Incident response plan

Answer

Help desk ticketing system

Question 10

A company is designing a third-party risk management (TPRM) program. Which THREE of the following are essential components of the ongoing monitoring phase for a critical vendor?

Accepted Answer

Annual reassessment of the vendor's security controls. Option A is correct because an annual reassessment of the vendor's security controls is a core recurring activity in the ongoing monitoring phase, ensuring that the vendor's safeguards remain effective as its environment, personnel, and threats change over time. Option C is correct because periodically reviewing the vendor's security certifications, such as a SOC 2 Type II report, provides independent attestation that controls were tested over a defined period and helps detect any scope changes, exceptions, or qualified opinions. Option E is correct because continuous monitoring of the vendor's external attack surface—for example, tracking exposed services, expired TLS certificates, or newly disclosed CVEs affecting the vendor—gives early warning of emerging risk between formal assessments. Option B does not belong because a contractual requirement for data encryption is a risk-treatment/contractual control established during due diligence and contracting, not a recurring monitoring activity. Option D does not belong because a one-time onboarding risk assessment is part of the initial due diligence phase, whereas ongoing monitoring requires repeated, continuous, or periodic evaluation rather than a single point-in-time review.

Answer

Contractual requirement for data encryption

Answer

One-time onboarding risk assessment

Question 11

An organization is defining objectives and key results (OKRs) for the security program. Which TWO of the following are examples of leading indicators that could be used as key results?

Accepted Answer

Phishing click rate. B (Phishing click rate) is a leading indicator because it measures a precursor behavior — how often users fall for simulated phishing — that predicts the likelihood of future successful credential-theft or malware incidents, and it can be driven down through training before any breach occurs. E (Patch compliance percentage) is also leading because it quantifies the proportion of systems with current patches, directly reducing exploitable vulnerabilities and thus the probability of future compromise. By contrast, A (Number of security incidents), C (MTTR), and D (Number of data breaches) are lagging indicators: they record events or outcomes that have already happened (incidents, breaches) or measure post-event response speed (MTTR), so they reflect past performance rather than predicting future risk.

Answer

Number of security incidents

Answer

Mean time to respond (MTTR)

Answer

Number of data breaches

Question 12

Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Enforcing least privilege access controls. Option A (Enforcing least privilege access controls) is a risk mitigation control because it reduces the likelihood and impact of unauthorized access by limiting users to only the permissions required for their role, directly lowering exposure to threats. Option B (Implementing intrusion detection systems) is also a mitigation control because it detects malicious activity and enables timely response, thereby reducing the potential damage from attacks. In contrast, Option C (Discontinuing a high-risk business process) is risk avoidance, as the activity is eliminated rather than controlled. Option D (Purchasing cyber insurance) is risk transference, shifting financial consequences to an insurer. Option E (Accepting the risk in a formal statement) is risk acceptance, where no control is implemented and the risk is knowingly retained.

Answer

Discontinuing a high-risk business process

Answer

Purchasing cyber insurance

Answer

Accepting the risk in a formal statement

Question 13

An organization uses ISO 27001 Annex A controls. During a risk assessment, they identify a need for a compensating control because the primary control is not feasible. What should the security manager do FIRST?

Accepted Answer

Document the risk and obtain management approval for the compensating control. Compensating controls require formal acceptance of the residual risk and approval by management to ensure accountability.

Answer

Accept the risk without any control

Answer

Remove the asset from scope

Answer

Implement the compensating control immediately

Question 14

An information security manager is implementing a risk management program. Which TWO of the following activities should be performed as part of the risk assessment process?

Accepted Answer

Analyzing threats and vulnerabilities. Analyzing threats and vulnerabilities is a core step in the risk assessment process, as defined by the NIST SP 800-30 and ISO 31000 frameworks. This activity identifies potential threat sources and existing vulnerabilities that could be exploited, enabling the calculation of likelihood and impact for risk scenarios.

Answer

Determining acceptable risk levels

Answer

Monitoring incident response plans

Answer

Selecting controls to mitigate risks

Question 15

A multinational corporation is designing a global information security program. Which governance structure best ensures consistent security while allowing regional flexibility?

Accepted Answer

Federated governance: global standards with local implementation and oversight.. Federated governance (Option C) is the correct choice because it establishes a global security framework with mandatory standards (e.g., ISO 27001 controls, encryption baselines like AES-256) while delegating implementation and oversight to regional units. This structure balances consistency with local legal requirements (e.g., GDPR in Europe, PIPL in China) and operational needs, avoiding the rigidity of full centralization or the fragmentation of full decentralization.

Answer

Outsource security governance to a managed security service provider (MSSP).

Answer

Fully centralized security governance with global standards enforced uniformly.

Answer

Fully decentralized security governance, each region independent.