CISM Practice Test 46 — 15 Questions

Question 1

Based on the risk register entry, what is the primary gap in the current controls?

Accepted Answer

The policy exists but is not enforced technically. The risk register entry indicates that a mobile device management (MDM) policy exists but is not enforced through technical controls, such as device compliance checks or automated policy application. This creates a gap because the policy remains a paper-based directive without active enforcement mechanisms like certificate-based authentication or conditional access rules, leaving devices vulnerable to non-compliance and potential data breaches.

Answer

MDM is not a suitable control

Answer

The risk score is too low to require action

Answer

The likelihood of occurrence is low

Question 2

According to the exhibit, which role is responsible for conducting forensic analysis?

Accepted Answer

Technical Lead. The Technical Lead is responsible for conducting forensic analysis because they possess the deep technical expertise required to preserve, acquire, and examine digital evidence without altering its integrity. In incident response, the Technical Lead oversees the technical team, ensuring that chain-of-custody procedures are followed and that forensic tools (e.g., FTK Imager, EnCase, or dd for disk imaging) are correctly applied to capture volatile and non-volatile data.

Answer

Incident Manager

Answer

Legal Counsel

Answer

Communication Lead

Question 3

Which role is primarily responsible for ensuring that information security risks are identified, assessed, and managed within a business unit?

Accepted Answer

Risk owner. The risk owner is the individual within a business unit who is accountable for ensuring that information security risks are identified, assessed, and managed. This role owns the risk treatment plan and is responsible for implementing controls to reduce risk to an acceptable level, as defined by the organization's risk appetite.

Answer

Data owner

Answer

Chief Information Security Officer (CISO)

Answer

Board of directors

Question 4

Refer to the exhibit. A security analyst reviews the firewall configuration and identifies a potential risk. What is the most likely risk?

Accepted Answer

Risk of data exfiltration via DNS tunneling.. The exhibit shows a firewall rule that permits DNS traffic (UDP/TCP port 53) from the internal network to any external destination. This configuration allows internal hosts to perform DNS queries to external servers, which can be exploited for DNS tunneling—a technique where data is encapsulated within DNS queries and responses to bypass security controls and exfiltrate sensitive information. Since DNS traffic is typically allowed through firewalls, this creates a covert channel for data exfiltration, making option D the most likely risk.

Answer

Risk of unauthorized external access to internal services.

Answer

Risk of denial-of-service attacks from internal hosts.

Answer

Risk of IP spoofing attacks from the inside network.

Question 5

During an incident, the incident response team discovers that the attacker used stolen credentials to access the network. What should the team do during the eradication phase?

Accepted Answer

Reset all user passwords.. Resetting all user passwords (option D) is the correct action during the eradication phase because the attacker used stolen credentials, meaning the compromised accounts remain a backdoor even after the initial threat is contained. Eradication requires removing all traces of the attacker's access, and password reset ensures that stolen hashes or plaintext credentials are no longer valid, preventing re-entry via the same authentication vector. This aligns with NIST SP 800-61 guidance on eliminating attacker footholds by invalidating compromised authentication tokens.

Answer

Conduct a security awareness training.

Answer

Block the attacker's IP addresses.

Answer

Install additional antivirus software.

Question 6

An organization's information security governance committee has not met for the past six months. Which of the following is the most significant risk associated with this situation?

Accepted Answer

Lack of oversight leading to misalignment with business strategy. The governance committee's failure to meet for six months directly undermines the strategic alignment of security initiatives with business objectives. Without regular oversight, security investments and priorities may drift from the organization's risk appetite and strategic goals, leading to misallocation of resources and increased exposure to unmanaged risks. This misalignment is the most significant risk because it affects the entire security program's effectiveness and long-term viability.

Answer

Increased operational costs due to uncoordinated security investments

Answer

Regulatory fines from noncompliance

Answer

Delayed response to security incidents

Question 7

During an incident, the team identifies that a contractor's credentials were used to access sensitive data. Which of the following should be the IMMEDIATE action?

Accepted Answer

Disable the compromised credentials and initiate forensic investigation.. When compromised credentials are identified during an incident, the immediate priority is to contain the threat by disabling the compromised credentials to prevent further unauthorized access, and then to initiate a forensic investigation to determine the scope, method, and impact of the breach. Option D correctly follows the incident response containment and investigation phases, ensuring that evidence is preserved and the attack vector is understood before any notification or contractual actions are taken.

Answer

Notify the client whose data was accessed.

Answer

Revoke the contractor's access and terminate the contract.

Answer

Contact the contractor to ask about the activity.

Question 8

Given the exhibit, what is the most likely classification of this incident?

Accepted Answer

Brute-force attack. The exhibit shows a high volume of failed authentication attempts (e.g., repeated 'Login failed' events) from a single external IP address targeting multiple user accounts within a short time window. This pattern is characteristic of a brute-force attack, where an attacker systematically tries password combinations to gain unauthorized access. The incident classification is based on the specific behavior of repeated login failures, not on malware signatures or traffic flooding.

Answer

Malware infection

Answer

Denial of service

Answer

Insider threat

Question 9

Refer to the exhibit. The audit finding reveals a deficiency in which critical aspect of information security governance?

Accepted Answer

Strategic alignment between security objectives and business goals is missing.. The audit finding highlights that security initiatives are not aligned with business objectives, which is a core deficiency in strategic alignment—a critical aspect of information security governance. Without this alignment, security investments may fail to support organizational goals, leading to wasted resources and increased risk exposure. The finding directly indicates a gap between the security strategy and the business strategy, not a lack of board approval, resource allocation methodology, or risk integration.

Answer

The board has not approved the security strategy.

Answer

Resource allocation for security initiatives is not based on business impact.

Answer

Risk management processes are not integrated with business planning.

Question 10

You are the information security program manager at a global financial services firm. The firm has a mature security program, but the CISO is concerned that the program is not keeping pace with emerging threats such as supply chain attacks and advanced persistent threats (APTs). Additionally, the program currently focuses heavily on compliance with regulations (e.g., PCI DSS, GDPR) rather than proactive risk management. The board wants to see a more strategic approach to information security. However, the compliance team is large and influential, and they resist changes that might reduce their role. You have been asked to propose a new program model that addresses these concerns while maintaining regulatory compliance. What should you do?

Accepted Answer

Evolve the program to a risk-based approach that integrates threat intelligence and adapts controls dynamically, while keeping compliance as a baseline.. Evolving the program to a risk-based approach (Option D) integrates threat intelligence and dynamically adapts controls, directly addressing the need for proactive management of emerging threats while maintaining compliance as a baseline. This balances strategic evolution with the compliance team's continued role. Option A (restructuring the compliance team) risks political friction and does not inherently shift to risk management. Option B (expanding compliance coverage) increases focus on compliance, not proactive risk. Option C (increasing awareness training) is too narrow and does not address the program's strategic direction.

Answer

Restructure the compliance team into a risk management function.

Answer

Expand the compliance team to cover more regulations and increase auditing frequency.

Answer

Increase security awareness training across the organization.

Question 11

During a forensic investigation, an incident responder needs to collect memory from a compromised server. What is the BEST method to preserve evidence integrity?

Accepted Answer

Perform a hardware memory acquisition using a write-blocker.. Hardware memory acquisition using a write-blocker ensures that the forensic tool accesses the physical memory (RAM) directly without any modification to the system's storage or memory contents. This method preserves the integrity of the evidence by preventing any writes to the original media, which is critical for maintaining a verifiable chain of custody and admissibility in legal proceedings.

Answer

Remotely acquire memory using a network connection.

Answer

Use a live forensic toolkit to capture memory to a network share.

Answer

Reboot the system into safe mode and then capture memory.

Question 12

Which of the following is the primary purpose of a Key Risk Indicator (KRI)?

Accepted Answer

To provide early warning signals of increasing risk. A Key Risk Indicator (KRI) is a metric used to provide an early warning signal that a risk exposure is approaching or exceeding acceptable thresholds. Unlike lagging indicators that report on past events, KRIs are forward-looking, enabling proactive risk mitigation before a risk materializes into a loss.

Answer

To report on past incidents and losses

Answer

To measure the effectiveness of security controls

Answer

To demonstrate compliance with regulations

Question 13

A multinational organization is establishing an information security program. The Chief Information Security Officer (CISO) wants to ensure the program aligns with business objectives and is accountable to senior management. Which of the following governance structures would best support this goal?

Accepted Answer

An executive steering committee with representatives from business units, legal, and IT meets quarterly to review program status.. An executive steering committee with cross-functional representation (business units, legal, IT) ensures the information security program is aligned with business objectives and provides direct accountability to senior management through regular quarterly reviews. This structure enables strategic oversight, resource allocation, and risk acceptance decisions that tie security initiatives to organizational goals, as recommended by the CISM framework for governance.

Answer

A board-level risk committee oversees the information security program without management involvement.

Answer

The CISO reports to the chief legal officer (CLO).

Answer

The information security function reports directly to the IT operations manager.

Question 14

During a cyber incident, the organization's legal counsel advises that certain information about the breach should not be shared with external partners due to ongoing law enforcement investigation. The incident response team must balance transparency with confidentiality. Which of the following is the BEST approach?

Accepted Answer

Provide only non-sensitive overview to partners. It allows the incident response team to maintain necessary transparency with external partners while respecting legal counsel's directive to withhold sensitive details due to an ongoing law enforcement investigation. Providing a non-sensitive overview—such as the general nature of the incident, affected systems (without PII), and remediation timeline—fulfills partnership obligations without jeopardizing the investigation or violating chain-of-custody requirements for digital forensics.

Answer

Seek partner input on what to share

Answer

Share all information with partners under NDA

Answer

Withhold all information until investigation ends

Question 15

A CISO is presenting a security metrics dashboard to the board. Which TWO metrics are most appropriate for board-level reporting? (Select TWO.)

Accepted Answer

Security investment vs. loss avoidance. Board-level metrics should focus on strategic outcomes such as incident response and financial impact.

Answer

Number of security staff per business unit

Answer

Number of firewall rules changed

Answer

Average patch deployment time