CISM Practice Test 47 — 15 Questions

Question 1

A multinational corporation is designing its information security program and must decide how to balance security with business agility. The company operates in highly regulated industries with varying legal requirements. Which of the following approaches BEST aligns with industry best practices for such an environment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Develop a risk-based framework that allows for tailored controls based on local risk assessments.. A risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.

Answer

Implement the strictest regulatory requirements globally to ensure compliance everywhere.

Answer

Adopt a baseline of controls that meet the lowest common denominator of all regulations.

Answer

Allow each business unit to define its own security controls based on local requirements.

Question 2

An organization has just completed a risk assessment and identified several high-risk vulnerabilities. The security program manager needs to prioritize remediation efforts. Which of the following should be the primary factor in determining priority?

Accepted Answer

Risk level (likelihood × impact). Risk level, calculated as likelihood multiplied by impact, is the primary factor for prioritizing remediation because it quantifies the overall exposure to the organization. While regulatory requirements, likelihood alone, or ease of remediation are important considerations, they do not capture the combined effect of both probability and consequence, which is essential for effective risk management in an information security program.

Answer

Regulatory requirements only

Answer

Likelihood of exploitation

Answer

Ease of remediation

Question 3

A risk manager is presenting risk treatment options to senior management. Which of the following is the BEST approach to communicate risk in a way that supports informed decision-making?

Accepted Answer

Translate risk into potential financial impact. Translating risk into potential financial impact (Option C) is the best approach because it aligns risk with business objectives, enabling senior management to make cost-benefit decisions. Financial quantification, such as Annualized Loss Expectancy (ALE), provides a common language that executives understand, directly supporting informed decision-making on risk treatment options.

Answer

Focus only on high and extreme risks

Answer

Use technical language to accurately describe vulnerabilities

Answer

Present risk in qualitative terms only

Question 4

A company discovers a credential compromise affecting multiple user accounts. According to best practices, what is the first step the incident response team should take?

Accepted Answer

Disable compromised accounts and reset passwords. When a credential compromise is discovered, the immediate priority is containment to prevent further unauthorized access. Disabling compromised accounts and resetting passwords (Option B) stops the attacker from using the stolen credentials, aligning with the NIST SP 800-61 incident response lifecycle's containment phase. This action directly mitigates the active threat before any forensic analysis or notification occurs.

Answer

Conduct a root cause analysis

Answer

Contact law enforcement

Answer

Notify affected users immediately

Question 5

Which TWO are key indicators of a data breach? (Choose two.)

Accepted Answer

Unusual outbound network traffic. Unusual outbound network traffic is a key indicator of a data breach because it often signals data exfiltration, where an attacker is transferring stolen data to an external command-and-control (C2) server or a cloud storage endpoint. This traffic may involve unexpected protocols (e.g., DNS tunneling, HTTPS to unknown IPs) or large volumes of data leaving the network at odd hours, which can be detected by network traffic analysis tools like NetFlow or intrusion detection systems (IDS).

Answer

System performance degradation

Answer

Increased spam emails to the organization

Answer

Multiple failed login attempts from a single user

Question 6

Based on the exhibit, which of the following is true about traffic from the internet to the internal network 10.0.0.0/8?

Accepted Answer

All traffic from the internet to the internal network is denied.. The exhibit shows an access control list (ACL) that denies all traffic from any source to the 10.0.0.0/8 network. Since the ACL is applied inbound on the internet-facing interface, any traffic originating from the internet destined for the internal network 10.0.0.0/8 is implicitly denied by the explicit deny statement. Therefore, option B is correct: all traffic from the internet to the internal network is denied.

Answer

Internet traffic to 10.0.0.5 is permitted only if from 192.168.1.0/24.

Answer

Traffic from the internet to 10.0.0.5 port 80 is permitted.

Answer

Traffic from 192.168.1.0/24 to 10.0.0.5 port 80 is permitted.

Question 7

After a ransomware attack, a company discovers that backups are also encrypted. The incident response team has isolated the affected systems. What should be the next step?

Accepted Answer

Isolate additional systems and notify law enforcement.. After isolating affected systems, the next priority is to contain the incident by identifying and isolating any additional compromised systems to prevent further spread, and to notify law enforcement as required by legal and regulatory obligations. This aligns with the Incident Response (IR) process, specifically the Containment, Eradication, and Recovery phases, where containment must precede any recovery attempts to avoid re-infection.

Answer

Attempt restoration from encrypted backups.

Answer

Pay the ransom to obtain decryption keys.

Answer

Reimage all systems from known clean media.

Question 8

An organization's incident response plan (IRP) is being updated. Which stakeholder should be included in the IRP development to ensure legal and regulatory requirements are met?

Accepted Answer

Legal counsel. Legal counsel ensures the plan complies with relevant laws and regulations, such as breach notification requirements. The CISO (A) oversees security but may not have legal expertise. IT manager (B) focuses on technical aspects. External auditors (D) are not typically involved in plan development.

Answer

External auditors

Answer

Chief Information Security Officer (CISO)

Answer

IT manager

Question 9

An organization's incident response plan includes a step to 'contain the incident.' Which of the following actions is an example of containment?

Accepted Answer

Disconnecting an infected workstation from the network. Disconnecting an infected workstation from the network is a classic containment action because it immediately isolates the compromised system, preventing the spread of malware or unauthorized lateral movement to other hosts. Containment focuses on limiting the scope and impact of an incident, not on remediation or investigation. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is performed before eradication and recovery.

Answer

Restoring data from backup

Answer

Analyzing log files to determine the attack vector

Answer

Removing malware from the system

Question 10

Which THREE of the following are typical steps in a qualitative risk assessment?

Accepted Answer

Estimate likelihood and impact using rating scales. Option C is correct because identifying assets and threats is the foundational step of any risk assessment, including qualitative ones, since you must know what you are protecting and what could harm it before evaluating risk. Option A is correct because qualitative risk assessment characteristically uses subjective rating scales (such as High/Medium/Low or 1–5) to estimate likelihood and impact rather than numeric monetary values. Option B is correct because once risks are rated on those scales, the results are used to prioritize risks so that the highest-rated risks receive attention first. Option D is not correct because calculating annualized loss expectancy (ALE = SLE × ARO) is a quantitative technique requiring monetary figures. Option E is not correct because assigning monetary values to impact is also a quantitative step, whereas qualitative assessment relies on descriptive or ordinal ratings.

Answer

Calculate annualized loss expectancy (ALE)

Answer

Assign monetary values to impact

Question 11

Following a data breach, an organization conducts a root cause analysis using the 5 Whys technique. The analysis identifies that a misconfigured firewall allowed unauthorized access. What is the most important next step to prevent recurrence?

Accepted Answer

Implement a change management process to prevent unauthorized configuration changes. Root cause analysis should uncover not just technical causes but also the process and governance failures that allowed the misconfiguration. Addressing the management failure (e.g., inadequate change management) provides a systemic fix.

Answer

Update the firewall rule base immediately

Answer

Conduct a vulnerability scan on all firewalls

Answer

Disconnect the firewall from the network

Question 12

Which THREE of the following are essential roles in an effective information security governance structure? (Choose three.)

Accepted Answer

Board of directors.. The board of directors is essential because it holds ultimate accountability for the organization's risk posture and must approve the information security strategy, policies, and resource allocation. Without board-level oversight, security governance lacks the authority to enforce compliance and align security objectives with business goals. This aligns with the CISM framework's emphasis on top-down governance, where the board provides strategic direction and ensures adequate funding for security initiatives.

Answer

Help desk manager.

Answer

Network administrator.

Question 13

Which TWO of the following are best practices for preserving digital evidence during an incident? (Select exactly 2)

Accepted Answer

Create a forensic image of the hard drive using a write blocker. Creating a forensic image with a write blocker (Option A) is a best practice because it captures an exact bit-for-bit copy of the storage media without altering the original data. The write blocker intercepts write commands at the hardware or software level, ensuring the integrity of the evidence. This preserves the original state for later analysis and admissibility in legal proceedings.

Answer

Interview witnesses before collecting data

Answer

Run antivirus scans on the affected system

Answer

Reboot the system to clear memory

Question 14

Which of the following are key components of an Information Security Risk Management program? (Select TWO.)

Accepted Answer

Establishing a risk management framework. A is correct because establishing a risk management framework is the foundational component of an Information Security Risk Management program. It defines the policies, procedures, and governance structure for identifying, assessing, and treating risks, aligning with standards like ISO 31000 or NIST SP 800-39. Without a framework, risk management activities lack consistency and accountability.

Answer

Conducting vulnerability scanning

Answer

Performing internal audits

Question 15

An organization has experienced a data breach involving personal data of EU residents. Under GDPR, what is the maximum time frame within which the organization must notify the relevant supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to rights and freedoms.

Answer

48 hours

Answer

24 hours

Answer

96 hours