CISM Practice Test 49 — 15 Questions

Question 1

Which of the following is the best indicator that an organization has effective information security governance?

Accepted Answer

Security metrics are reviewed by the board quarterly. (ISO 27001 certification) indicates compliance, not necessarily governance performance. Option B (security budget increased) does not guarantee effectiveness. Option C (low number of incidents) could be due to luck. Option D (board review of metrics) demonstrates governance oversight and strategic alignment.

Answer

Achievement of ISO 27001 certification

Answer

The security budget has increased year over year

Answer

Low number of security incidents

Question 2

An organization's CISO reports to the CIO. The CISO is concerned that security initiatives are often deprioritized due to conflicts of interest. Which reporting structure would best address this concern?

Accepted Answer

Reporting to the board or risk committee. Reporting to the board or risk committee provides the CISO with an independent reporting line that is not subordinate to the CIO or other executives whose priorities may conflict with security. This structure ensures security concerns are elevated to a governance body with fiduciary oversight, reducing the likelihood that security initiatives are deprioritized due to operational or budgetary conflicts. It also aligns with governance best practices that separate security oversight from IT delivery.

Answer

Reporting to the CEO

Answer

Reporting to the COO

Answer

Reporting to the CFO

Question 3

A security analyst receives an alert from the SIEM indicating a high number of failed login attempts from a single external IP address targeting a public-facing web server. The analyst checks the logs and sees that the attempts are using common usernames. What is the MOST appropriate immediate response?

Accepted Answer

Block the IP address at the firewall.. The immediate response to a brute-force attack from a single external IP is to block that IP at the firewall. This stops the attack at the network perimeter, preventing further authentication attempts without affecting legitimate users (assuming the IP is not a known legitimate source). Delaying action could allow the attacker to compromise an account via password guessing, especially since common usernames are being targeted.

Answer

Ignore the alert as it is likely a false positive.

Answer

Disable the web server.

Answer

Notify law enforcement.

Question 4

During an incident, the team identifies that a contractor's credentials were used to access sensitive data. Which of the following should be the IMMEDIATE action?

Accepted Answer

Disable the compromised credentials and initiate forensic investigation.. When compromised credentials are identified during an incident, the immediate priority is to contain the threat by disabling the compromised credentials to prevent further unauthorized access, and then to initiate a forensic investigation to determine the scope, method, and impact of the breach. Option D correctly follows the incident response containment and investigation phases, ensuring that evidence is preserved and the attack vector is understood before any notification or contractual actions are taken.

Answer

Notify the client whose data was accessed.

Answer

Revoke the contractor's access and terminate the contract.

Answer

Contact the contractor to ask about the activity.

Question 5

After a data breach incident, the incident response team must preserve evidence for potential litigation. Which of the following actions should be taken FIRST?

Accepted Answer

Issue a legal hold. Issuing a legal hold is the first action because it triggers the duty to preserve evidence and suspends normal data retention or deletion policies, ensuring that logs, disk images, and other artifacts are not destroyed. Under FRCP and similar rules, once litigation is reasonably anticipated, spoliation of evidence can lead to sanctions, so the legal hold must precede any remediation or notification. This step also formally directs custodians and IT staff to retain relevant records, creating a defensible chain of custody.

Answer

Update the IR plan

Answer

Begin remediation

Answer

Notify law enforcement

Question 6

A financial institution is integrating a newly acquired fintech startup. The startup has a very different security culture. What governance approach best ensures integration without stifling innovation?

Accepted Answer

Use a transitional risk-based approach, phasing in critical controls while allowing flexibility. A transitional, risk-based governance approach lets the acquiring institution phase in critical security controls (e.g., identity, data protection, logging) while preserving the startup's agile practices in lower-risk areas. This balances the need for enterprise-wide risk alignment with the reality that abrupt policy imposition damages culture and velocity. It is the standard M&A security integration pattern recommended by ISACA and similar bodies.

Answer

Allow the startup to maintain its own security policies indefinitely

Answer

Force the startup to adopt all of the institution's policies immediately

Answer

Create a separate security team for the startup

Question 7

What is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Accepted Answer

To update the incident response plan and procedures. Lessons learned aims to improve future response by identifying what worked and what didn't.

Answer

To determine if legal action is needed

Answer

To calculate the financial impact of the incident

Answer

To assign disciplinary actions

Question 8

An organization has implemented a risk management framework based on ISO 27005. During the risk identification phase, a new vulnerability is discovered in a critical business application that could lead to a data breach. According to ISO 27005, which of the following is the NEXT step the organization should take?

Accepted Answer

Analyze the likelihood and impact of the vulnerability being exploited.. According to ISO 27005, after risk identification (including discovering a new vulnerability), the next step is risk analysis, which involves assessing the likelihood and impact of the vulnerability being exploited. This analysis is required before any decision on risk treatment (e.g., mitigation, acceptance) can be made. Option C correctly identifies this sequential step in the ISO 27005 risk management process.

Answer

Escalate the vulnerability to senior management for acceptance.

Answer

Update the risk register with the new vulnerability.

Answer

Select and implement controls to mitigate the vulnerability.

Question 9

You are the information security manager for a mid-sized e-commerce company. The company operates a web application that handles credit card transactions and stores customer data in a backend database. The incident response team has just been alerted to a potential data breach: an intrusion detection system (IDS) flagged a SQL injection attack pattern on the web application's login page. The attack originated from an external IP address (5.5.5.5) and appears to have been successful, as the IDS also detected a large outbound data transfer from the database server to another external IP (6.6.6.6) shortly after. The database server is not segmented from the web server. The company has a legal obligation to report breaches involving cardholder data within 72 hours. The incident response plan is being activated. The team includes a forensic analyst, a network engineer, and a legal advisor. The web application is currently running and serving customers. The CEO wants to minimize business disruption. Which of the following actions should the incident response team take FIRST?

Accepted Answer

Isolate the database server from the network and block outbound traffic to the external IP.. The immediate priority is to contain the breach by isolating the compromised database server and blocking outbound traffic to the attacker's IP (6.6.6.6). This stops the exfiltration of cardholder data, preserves evidence on the isolated server, and minimizes business disruption by keeping the web application running. Shutting down servers (Option A) would cause unacceptable downtime, while patching (Option C) or imaging (Option D) without containment would allow continued data loss.

Answer

Shut down the web application and database server immediately to stop the breach.

Answer

Patch the SQL injection vulnerability in the web application and continue monitoring.

Answer

Take a full forensic image of all servers before taking any containment actions.

Question 10

During a merger, the acquiring company's board insists on integrating the target company's information security governance into its own within 90 days. However, the target has a significantly different risk culture and lacks documented policies. What is the most critical governance risk in this scenario?

Accepted Answer

The acquiring company may inadvertently accept unknown high-risk exposures.. The most critical governance risk is that the acquiring company may inadvertently inherit unknown high-risk exposures from the target company. Without documented policies and a compatible risk culture, the target's security posture is opaque, meaning the acquirer cannot assess or control inherited vulnerabilities, compliance gaps, or threat vectors. This violates the core governance principle of risk visibility and could lead to material breaches or regulatory penalties post-merger.

Answer

The acquiring company's security team may lack the capacity to train the target's staff.

Answer

The target's employees may resist the new security culture.

Answer

There will be insufficient time to develop new security policies for the combined entity.

Question 11

An organization is developing a security scorecard for the CISO. Which of the following is a leading indicator that would be most useful for predicting future security incidents?

Accepted Answer

Percentage of systems compliant with patch SLAs. A leading indicator predicts future outcomes, whereas lagging indicators measure past events. The percentage of systems compliant with patch SLAs is a leading indicator because it reflects the current state of vulnerability management, which directly influences the likelihood of future security incidents. High compliance with patching reduces the attack surface and is a proactive measure.

Answer

Mean time to respond (MTTR) to incidents

Answer

Number of security incidents in the past quarter

Answer

Total cost of security incidents

Question 12

A financial services company has a policy requiring annual risk assessments for all critical vendors. During an internal audit, it is discovered that several vendors have not been reassessed in over two years. The CISO needs to address this governance gap. Which action should be taken FIRST?

Accepted Answer

Review the vendor risk management process to identify why reassessments were not performed and implement controls to prevent recurrence.. The most effective first step is to review the vendor risk management process to determine why reassessments were not conducted and to implement corrective actions. This addresses the root cause and ensures the governance framework is strengthened. Immediate assessments or terminations may be needed later, but understanding and fixing the process is fundamental to preventing recurrence and demonstrating effective security governance.

Answer

Conduct immediate risk assessments for all overdue vendors to close the compliance gap.

Answer

Escalate the non-compliance to the board of directors and request additional budget.

Answer

Immediately terminate contracts with all vendors that are overdue for reassessment.

Question 13

A newly appointed CISO at a healthcare payer discovers that business units independently purchase security tools, resulting in overlapping capabilities and no central oversight. The CISO wants to establish a governance structure that ensures security investments align with enterprise risk appetite. Which action should the CISO take FIRST?

Accepted Answer

Create an information security steering committee with business unit representation to prioritize and approve security initiatives.. Establishing an information security steering committee is the foundational governance action because it creates a formal, cross-functional body responsible for aligning security investments with enterprise risk appetite. This committee provides the authority and structure to prioritize initiatives, resolve conflicts, and ensure ongoing oversight. Other actions, such as centralizing budgets or conducting assessments, are either tactical or lack the collaborative governance needed to sustain alignment.

Answer

Develop a security metrics dashboard that reports tool utilization and spending to the board of directors.

Answer

Conduct a gap assessment of all existing security tools against the NIST Cybersecurity Framework to identify redundancies.

Answer

Implement a centralized security budget and require all business units to submit purchase requests to the CISO for approval.

Question 14

A CISO is updating the organization's information security strategy to address emerging risks from cloud adoption and remote work. Which of the following should be the FIRST step in this process?

Accepted Answer

Conduct a risk assessment to identify new threats and vulnerabilities.. The first step in updating the security strategy is to conduct a risk assessment, as it provides the necessary understanding of new risks introduced by cloud adoption and remote work. This risk-based approach ensures that subsequent decisions on controls, training, and investments are prioritized according to business impact and risk appetite.

Answer

Implement a cloud access security broker (CASB) solution.

Answer

Revise the security awareness training program.

Answer

Benchmark the organization's security posture against industry peers.

Question 15

An organization's information security strategy is being updated to align with the business goal of expanding into new markets. The CISO must ensure that the strategy addresses the varying legal and regulatory requirements of these markets. Which of the following should be the PRIMARY consideration when updating the strategy?

Accepted Answer

The potential impact of regulatory non-compliance on the organization's reputation and ability to operate.. When updating the security strategy to support business expansion, the primary consideration is the impact of regulatory non-compliance, as it directly affects the organization's ability to operate in new markets and its reputation. This ensures that the strategy is aligned with business objectives and prioritizes risk management. Other factors like cost, resources, and framework extensibility are important but secondary to understanding and mitigating compliance risks.

Answer

The cost of implementing additional security controls required by new regulations.

Answer

The existing security control framework's ability to be extended to cover new requirements.

Answer

The availability of security personnel with expertise in the new markets' regulations.