CISM Practice Test 49 — 15 Questions

Question 1

In designing a security operations centre (SOC), which TWO functions are core to the SOC's responsibilities? (Select TWO.)

Accepted Answer

Security monitoring and detection. The SOC core functions include monitoring security events, detecting threats, and responding to incidents. Vulnerability management and security architecture are typically separate functions, though they may interact with the SOC.

Answer

Vulnerability management

Answer

Security awareness training

Answer

Security architecture design

Question 2

A CISO is building a security operations center (SOC). Which TWO of the following are primary functions of a SOC?

Accepted Answer

Continuous monitoring of security events and alerts.. A SOC's core functions are monitoring for threats and responding to incidents. Vulnerability management and architecture are separate functions.

Answer

Conducting penetration tests of critical applications.

Answer

Performing vulnerability scans and patch management.

Answer

Developing secure coding standards for developers.

Question 3

Which THREE of the following are responsibilities of the board of directors regarding information security governance?

Accepted Answer

Approve the information security strategy. The board of directors is responsible for high-level governance, including approving the information security strategy to ensure alignment with business objectives. This strategic oversight ensures that security initiatives support organizational goals and comply with regulatory requirements, rather than involving hands-on technical execution.

Answer

Respond to security incidents

Answer

Conduct vulnerability scans

Question 4

An organization is preparing for a potential supply chain incident. According to CISM best practices, which THREE elements should be included in the supply chain incident playbook? (Select THREE.)

Accepted Answer

Procedures for isolating affected systems and networks.. Supply chain incidents require specific procedures for vendor coordination, technical response, and communication.

Answer

A step-by-step guide for paying ransoms to cybercriminals.

Answer

A list of approved vendors for DDoS mitigation services.

Question 5

During a P1 incident, the incident response manager is preparing an executive sitrep. Which of the following should be included to preserve legal privilege?

Accepted Answer

A statement that the sitrep is prepared under the direction of legal counsel. Involving legal counsel in communications can help preserve attorney-client privilege. The sitrep should avoid speculation and include legal counsel input.

Answer

An estimated financial impact

Answer

A detailed technical analysis of the attack vector

Answer

Names of the individuals involved in the response

Question 6

An organization is subject to GDPR and experiences a data breach involving personal data. What is the maximum timeframe to notify the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification within 72 hours of becoming aware of the breach.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 7

Following a data breach, an organization conducts a root cause analysis using the 5 Whys technique. The analysis identifies that a misconfigured firewall allowed unauthorized access. What is the most important next step to prevent recurrence?

Accepted Answer

Implement a change management process to prevent unauthorized configuration changes. Root cause analysis should uncover not just technical causes but also the process and governance failures that allowed the misconfiguration. Addressing the management failure (e.g., inadequate change management) provides a systemic fix.

Answer

Update the firewall rule base immediately

Answer

Conduct a vulnerability scan on all firewalls

Answer

Disconnect the firewall from the network

Question 8

Which of the following is the primary purpose of having a pre-established forensic retainer agreement?

Accepted Answer

To reduce the time required to engage external forensics during an incident. A pre-established retainer reduces the time to engage a forensics firm during an incident, ensuring rapid response.

Answer

To ensure the forensics firm is certified

Answer

To guarantee the lowest price for forensic services

Answer

To comply with regulatory requirements

Question 9

During a major security incident classified as P1, which of the following is the MOST appropriate communication frequency to the executive team?

Accepted Answer

Hourly situation reports (sitreps). For P1 (critical) incidents, hourly situation reports (sitreps) are expected to keep executives informed of rapidly evolving events.

Answer

Daily summary reports

Answer

Only upon significant changes

Answer

At the end of the incident

Question 10

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is unable to restore operations within the maximum tolerable downtime (MTD). Which action should be taken next?

Accepted Answer

Escalate to activate the business continuity/disaster recovery plan. When an incident cannot be resolved within MTD, it escalates to business continuity/disaster recovery activation to restore operations.

Answer

Notify law enforcement

Answer

Increase the ransom payment

Answer

Engage the forensics firm to preserve evidence

Question 11

During a P1 incident, the incident response team identifies that the root cause is a misconfigured firewall. According to best practices, which of the following should be the PRIMARY focus of the root cause analysis?

Accepted Answer

Determining why the firewall was misconfigured and why the change management process failed. Root cause analysis should identify not only the technical cause but also the process and management failures that allowed the misconfiguration to occur.

Answer

Patching the firewall immediately

Answer

Conducting a lessons learned meeting immediately

Answer

Restoring the firewall from backup

Question 12

During a major cybersecurity incident classified as P1, the incident response team has been activated. The crisis management team (CMT) is also convened. Which of the following is the PRIMARY responsibility of the CMT during this incident?

Accepted Answer

Making strategic decisions, managing communications, and allocating resources.. The CMT handles strategic decisions, communication, and resource allocation, while the IR team focuses on technical response.

Answer

Notifying law enforcement and regulatory bodies immediately.

Answer

Directly managing the technical containment and eradication of the threat.

Answer

Performing forensic analysis to identify the root cause of the incident.

Question 13

Which of the following is the PRIMARY reason for including communication templates in the incident response plan?

Accepted Answer

To ensure consistent and timely messaging to stakeholders.. Communication templates ensure that notifications are consistent, accurate, and timely during the stress of an incident, reducing the risk of errors or omissions.

Answer

To reduce the workload on the communications lead.

Answer

To comply with regulatory requirements for breach notification.

Answer

To avoid legal liability by using approved language.

Question 14

Which of the following is the PRIMARY role of the executive sponsor in the incident response team structure?

Accepted Answer

To provide strategic direction, resources, and decision-making authority.. The executive sponsor provides authority, resources, and strategic direction, and ensures the IR team has the support needed to respond effectively.

Answer

To handle all media inquiries and public relations.

Answer

To serve as legal counsel and ensure compliance.

Answer

To manage the technical investigation and forensic analysis.

Question 15

Which post-incident activity involves identifying the technical cause, the process failure that allowed it, and the management/governance failure that permitted the process failure?

Accepted Answer

Root cause analysis (RCA). Root cause analysis (RCA) digs into multiple layers to find underlying issues, often using techniques like 5 Whys or fishbone diagrams.

Answer

Lessons learned meeting

Answer

Incident closure report

Answer

Threat intelligence sharing