CISM Practice Test 48 — 15 Questions

Question 1

An incident responder is handling a phishing attack that resulted in credential theft. Which TWO actions should be taken FIRST in the containment phase?

Accepted Answer

Disable the user's account temporarily.. Option A is correct because temporarily disabling the compromised user's account immediately stops the attacker from using the stolen credentials to access mail, VPN, or other resources, which is the fastest way to cut off the threat during containment. Option E is correct because resetting the compromised user's password invalidates the stolen credential and prevents its continued use, and it should be done as part of the initial containment actions (typically paired with revoking active sessions/tokens). Options B, C, and D, while useful, are not the first containment actions: notifying all users is awareness/communication rather than containment, forensic analysis is part of the investigation/eradication phase and should not precede stopping the active compromise, and blocking the phishing URL at the proxy is a broader mitigation that may be helpful but does not directly address the already-stolen credentials.

Answer

Notify all users about the phishing campaign.

Answer

Conduct a forensic analysis of the user's machine.

Answer

Block the phishing URL at the proxy.

Question 2

An information security manager is developing a program metric to measure the effectiveness of the security awareness training. Which metric is most appropriate?

Accepted Answer

Number of security incidents caused by human error.. The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

Answer

Percentage of employees who completed the training.

Answer

Average score on post-training tests.

Answer

Time taken to complete the training modules.

Question 3

Which TWO of the following are risk treatment strategies as defined in ISO 27005?

Accepted Answer

Risk avoidance. Risk avoidance (C) is a valid ISO 27005 risk treatment strategy in which the organization eliminates the activity or condition that gives rise to the risk, thereby removing the exposure entirely. Risk transfer (D) is also a valid treatment strategy, where the risk is shared with or shifted to another party, such as through insurance or contractual agreements, while the organization retains ultimate accountability. These two belong to the ISO 27005 treatment options that also include risk modification/reduction and risk retention. Risk analysis (A) is part of the risk assessment process, not a treatment strategy, as it identifies and evaluates risks. Risk monitoring (B) is an ongoing review and surveillance activity within the risk management process, not a treatment choice. Risk communication (E) is a supporting process for exchanging risk information among stakeholders, not a treatment strategy itself.

Answer

Risk analysis

Answer

Risk monitoring

Answer

Risk communication

Question 4

Which THREE elements should be included in an incident response plan to ensure effective communication during a security incident?

Accepted Answer

Escalation procedures for notifying management and legal. Escalation procedures define the specific thresholds and contact paths for notifying management and legal teams when an incident exceeds predefined severity levels. This ensures that decision-makers are informed promptly to authorize critical actions like legal holds or regulatory notifications, preventing delays that could worsen the incident's impact.

Answer

List of affected systems and data

Answer

Public relations strategy for external communication

Question 5

In designing a security programme for a mid-sized enterprise, the CISO is deciding which security framework to adopt for control selection. Which of the following frameworks is specifically structured around implementation groups (IG1, IG2, IG3) to help organizations prioritize controls based on risk and maturity?

Accepted Answer

CIS Controls v8. CIS Controls v8 is specifically structured around Implementation Groups (IG1, IG2, IG3) to help organizations prioritize controls based on risk and maturity. IG1 is for small organizations with limited resources, IG2 for mid-sized with more risk, and IG3 for mature organizations facing advanced threats. This makes it uniquely suited for the scenario described.

Answer

ISO 27001 Annex A

Answer

NIST SP 800-53

Answer

COBIT 2019

Question 6

During a major incident, the crisis management team (CMT) has been activated. Which of the following is typically NOT a member of the CMT?

Accepted Answer

Security analyst. The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications; a security analyst is part of the incident response team, not the CMT.

Answer

General counsel

Answer

Chief information security officer

Answer

CEO

Question 7

A large enterprise is implementing a new governance framework. The board has approved a risk appetite statement. What is the MOST important next step for the information security manager?

Accepted Answer

Define risk acceptance criteria and thresholds. Once the board has approved a risk appetite statement, the information security manager must translate that high-level appetite into actionable risk acceptance criteria and thresholds. This step is critical because it defines the specific boundaries (e.g., maximum acceptable monetary loss per incident, maximum tolerable downtime) that guide all subsequent risk treatment decisions. Without these criteria, technical controls (Option A) and training (Option D) cannot be properly scoped, and audit plans (Option B) would lack measurable benchmarks.

Answer

Implement technical controls to reduce risks

Answer

Develop an audit plan to monitor risk levels

Answer

Conduct security awareness training for employees

Question 8

Which THREE are key components of an effective post-incident review?

Accepted Answer

Document lessons learned. An effective post-incident review must capture and record lessons learned (A) so that knowledge gained from the incident is preserved and can drive future improvements. It must also determine the root cause (E) using techniques such as the 5 Whys or fishbone analysis, since identifying the underlying cause prevents recurrence rather than merely treating symptoms. The review should then update the incident response plan (D) to incorporate those findings, ensuring procedures, playbooks, and controls are revised for future incidents. Increasing the security budget (B) is a possible business outcome but is not a required component of the review itself, and assigning blame (C) is counterproductive because post-incident reviews are blameless, focusing on process and system failures rather than individuals.

Answer

Increase security budget

Answer

Assign blame

Question 9

Which THREE of the following are key phases of the incident management lifecycle according to NIST or ISO? (Choose three.)

Accepted Answer

Detection & Analysis. Option E (Preparation) is correct because both the NIST SP 800-61 incident response lifecycle and ISO/IEC 27035 begin with a preparation phase, covering activities such as establishing an IR policy, forming the CSIRT, acquiring tools, and conducting training before an incident occurs. Option A (Detection & Analysis) is correct because it is the phase where monitoring, event triage, and validation determine whether an event is a genuine incident and establish its scope and impact. Option D (Containment, Eradication & Recovery) is correct because it is the core NIST phase that limits damage, removes the root cause (e.g., malware, compromised accounts), and restores affected systems to normal operation. Option B (Encryption) is not a lifecycle phase but a security control or technology that may be used within various phases. Option C (Board reporting) is not a defined phase in NIST SP 800-61 or ISO/IEC 27035; executive communication is an activity that can occur throughout the lifecycle rather than a distinct phase.

Answer

Encryption

Answer

Board reporting

Question 10

An organization's security steering committee meets quarterly but lacks decision-making authority. Projects are delayed due to lack of prioritization. What is the most effective improvement?

Accepted Answer

Empower the committee with budget and resource allocation authority. The core issue is that the security steering committee lacks decision-making authority, which prevents it from prioritizing projects and allocating resources. Empowering the committee with budget and resource allocation authority directly addresses this root cause by enabling it to make binding decisions, thereby eliminating delays caused by lack of prioritization. This aligns with the CISM governance principle that steering committees must have defined authority to effectively oversee the information security program.

Answer

Increase meeting frequency to weekly

Answer

Outsource project prioritization to external consultants

Answer

Replace committee members with senior executives

Question 11

A multinational corporation is designing an information security strategy to support its global operations. Which approach best ensures that the strategy is actionable and measurable?

Accepted Answer

Define KPIs and KRIs aligned with business goals. KPIs (Key Performance Indicators) and KRIs (Key Risk Indicators) provide quantifiable metrics that directly tie security activities to business objectives, ensuring the strategy is both actionable (through measurable targets) and measurable (through defined thresholds). This alignment allows the multinational corporation to track progress, demonstrate value to stakeholders, and adjust controls based on risk appetite, which is essential for global operations with diverse regulatory and operational contexts.

Answer

Conduct a cost-benefit analysis of security controls

Answer

Base the strategy on industry best practices

Answer

Adopt a leading-edge technology roadmap

Question 12

A multinational corporation is experiencing significant security incidents due to inconsistent security policies across subsidiaries. The CISO proposes implementing a centralized governance model. However, business unit leaders argue that local regulations require autonomy. Which approach best balances governance with local compliance?

Accepted Answer

Develop a framework of minimum security requirements, allowing local augmentation. A framework of minimum security requirements establishes a baseline that satisfies corporate governance needs while explicitly allowing local business units to add controls to meet regional regulations (e.g., GDPR, PIPL). This approach preserves the principle of subsidiarity in governance, ensuring that local compliance obligations are met without fragmenting the overall security posture.

Answer

Implement a single global security policy with mandatory compliance

Answer

Delegate all security decisions to local business units

Answer

Outsource security governance to a third-party managed service

Question 13

A security manager is selecting controls for a new application. Which of the following is the BEST approach for prioritization?

Accepted Answer

Prioritize critical controls that address the highest risks. Risk-based prioritization ensures that security resources are focused on the threats and vulnerabilities that could cause the most harm to the organization. By identifying and addressing the highest risks first, the security manager aligns controls with business objectives and maximizes risk reduction per unit of effort. This approach is a core principle of CISM and is consistent with frameworks like NIST RMF and ISO 27005.

Answer

Select controls based on vendor recommendations

Answer

Implement controls in the order of ease of deployment

Answer

Implement all controls simultaneously

Question 14

A security operations center receives an alert from an IDS indicating possible command and control traffic. The analyst is unsure if it's a true positive. Which combination of actions should be taken first?

Accepted Answer

Correlate the alert with firewall and proxy logs and review threat intelligence.. The first step in validating a potential command and control (C2) alert is to correlate the IDS event with other network logs (e.g., firewall, proxy) and threat intelligence. This helps confirm whether the traffic matches known C2 patterns (e.g., beaconing intervals, unusual DNS queries) before taking any disruptive action. Premature blocking or forensic analysis without correlation risks false positives or missing context.

Answer

Disable the IDS signature to prevent further alerts.

Answer

Immediately block the source IP and escalate to the incident response team.

Answer

Conduct a full forensic analysis of the affected host.

Question 15

An organization is developing its information security strategy. Which of the following should be the PRIMARY driver for defining security objectives?

Accepted Answer

Business objectives. Business objectives are the primary driver for defining security objectives because information security exists to enable the organization to achieve its mission and strategic goals. Security objectives must align with and support business objectives to ensure that resources are allocated effectively and that security controls are prioritized based on risk to the business, not just compliance or generic practices.

Answer

Industry best practices

Answer

Historical security incidents

Answer

Regulatory compliance requirements