CISM Practice Test 50 — 15 Questions

Question 1

A CISO at a healthcare insurer is revising the information security strategy after a merger with a smaller regional provider. The board has asked how security will support the combined company's growth targets while protecting patient data. Which action BEST aligns the security strategy with the business objectives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Map security initiatives to the business goals and regulatory obligations of the merged entity, then validate them with executive stakeholders.. The correct answer is the one that maps security initiatives to business goals and regulatory obligations and validates them with executives. In CISM, information security governance requires that security strategy be aligned with business objectives and driven by top management. After a merger, the business context changes, so the CISO must ensure the strategy supports the new goals while meeting compliance requirements. Executive validation ensures the strategy is owned at the right level.

Answer

Adopt the stricter of the two pre-merger security policies and enforce it across both organizations immediately.

Answer

Delegate the development of a new security strategy to the IT operations team, since they understand the technical infrastructure.

Answer

Benchmark the merged company's security program against industry peers and adopt their best practices.

Question 2

A global retailer's CISO is establishing an information security governance framework. The company operates in 20 countries, each with different privacy laws. The board wants assurance that security investments are justified and risks are managed consistently. Which governance mechanism BEST provides this assurance?

Accepted Answer

A security steering committee with representatives from each region, chaired by the CISO, that reviews risks and approves investments.. The correct answer is the security steering committee with regional representation. In CISM, governance is about directing and controlling the organization's security activities to achieve objectives. A steering committee provides the structure for oversight, decision-making, and accountability. It ensures that security investments are justified by business needs and risk, and that risks are managed consistently across diverse regions. This mechanism directly addresses the board's need for assurance.

Answer

A centralized security operations center (SOC) that monitors all countries 24/7.

Answer

A dashboard that reports security metrics to the board on a quarterly basis.

Answer

An annual penetration test conducted by an external firm across all locations.

Question 3

A newly appointed CISO is establishing an information security governance framework. The organization has a complex structure with multiple business units, each with its own IT function. The CISO wants to ensure that security decisions are made with input from all relevant stakeholders and that security risks are managed consistently across the enterprise. Which of the following should be the CISO's FIRST step in establishing this framework?

Accepted Answer

Create a security steering committee composed of senior leaders from each business unit and key corporate functions.. Establishing a security steering committee is the foundational step for governance because it creates the decision-making body that aligns security with business strategy, ensures cross-functional representation, and provides oversight for risk management. Without this structure, subsequent activities like risk assessment, policy development, and awareness training may lack coordination and strategic alignment.

Answer

Implement a security awareness training program for all employees to build a security culture.

Answer

Conduct a comprehensive security risk assessment to identify all vulnerabilities and threats.

Answer

Develop a detailed information security policy manual that mandates compliance from all business units.

Question 4

During a major incident, the incident response team determines that a compromised server must be rebuilt immediately to restore a critical service. A forensic analyst objects, noting that the server contains evidence relevant to a pending regulatory investigation. How should the incident manager resolve this conflict?

Accepted Answer

Capture a forensic image of the server's storage and volatile memory before rebuilding, then document the evidence handling.. When operational recovery and evidence preservation collide, the incident manager should pursue both by imaging the system before it is rebuilt. A forensic image of storage and memory preserves the artifacts regulators and investigators require while allowing the critical service to be restored. This balanced action aligns with CISM guidance to integrate incident response with legal and regulatory obligations rather than sacrificing one for the other.

Answer

Proceed with the rebuild because restoring the critical service takes priority over any investigative activity.

Answer

Rebuild the server and rely on the SIEM logs to reconstruct the evidence needed for the investigation.

Answer

Delay the rebuild until the regulatory investigation concludes so that the server remains untouched.

Question 5

A newly appointed CISO is reviewing the organization's information security governance framework. The CISO finds that security responsibilities are not clearly defined across business units, leading to gaps and overlaps. Which of the following should the CISO do FIRST to address this issue?

Accepted Answer

Develop a RACI chart to clarify roles and responsibilities for security activities.. The first step to address unclear security responsibilities is to develop a RACI chart. This tool clearly defines roles and responsibilities for specific security activities, eliminating gaps and overlaps. It provides a practical framework that can be used immediately to improve governance. Other actions like awareness, risk assessment, and policy revision are important but should follow after roles are clarified to ensure they are effective.

Answer

Conduct a risk assessment to identify critical assets and threats.

Answer

Revise the information security policy to include detailed role descriptions.

Answer

Implement a security awareness program to educate employees on their security responsibilities.

Question 6

A global financial services firm is revising its information security governance framework. The board of directors has expressed concern that the current security strategy is not adequately aligned with the firm's business objectives and regulatory obligations. The CISO is tasked with improving this alignment. Which of the following actions would BEST address the board's concern?

Accepted Answer

Integrate security risk considerations into the enterprise risk management (ERM) process and report on them alongside other business risks.. Integrating security risk into the enterprise risk management process ensures that security is managed as a business risk, aligning it with business objectives and regulatory requirements. This approach provides the board with a comprehensive view of risk and demonstrates that security is not a standalone function but an integral part of the organization's risk posture.

Answer

Increase the security budget to hire more security staff and purchase advanced security tools.

Answer

Implement a balanced scorecard for security that tracks technical metrics such as patch compliance and antivirus coverage.

Answer

Conduct an annual penetration test and present the results to the board to demonstrate security effectiveness.

Question 7

A global retail company is establishing an information security governance framework. The CISO wants to ensure that the framework effectively supports business objectives while managing risk. Which TWO of the following are essential components of an effective security governance framework? (Choose two.)

Accepted Answer

A clear definition of security roles and responsibilities across the organization.. An effective security governance framework must include clear roles and responsibilities to ensure accountability, and a process for regularly updating policies to adapt to changes. These components provide the structure and adaptability needed to align security with business objectives and manage risk. Advanced technologies, centralized decision-making, and operational centers are not core governance elements; they are tactical or operational considerations that support the framework.

Answer

The use of advanced security technologies such as AI-based threat detection.

Answer

A requirement that all security decisions be made by the CISO without business input.

Answer

The implementation of a security operations center (SOC) to monitor for threats 24/7.

Question 8

An organization has recently experienced a data breach that resulted in the loss of customer personally identifiable information (PII). The board of directors is concerned about the effectiveness of the information security governance program. Which of the following should the CISO recommend as the MOST important action to improve governance?

Accepted Answer

Conduct a post-incident review to identify root causes and update security policies and controls accordingly.. Conducting a post-incident review is the most important action because it systematically identifies what went wrong and how to improve policies, controls, and governance. It provides the board with assurance that the organization is learning from the incident and taking concrete steps to prevent recurrence, which is a key aspect of effective governance.

Answer

Implement a new security awareness training program for all employees.

Answer

Terminate the employees responsible for the breach to demonstrate accountability.

Answer

Increase the security budget to purchase additional security technologies.

Question 9

A healthcare organization is developing its information security strategy. The CISO is considering how to best align the strategy with the organization's overall business strategy. Which of the following approaches would be MOST effective?

Accepted Answer

Integrate security objectives into the business strategy planning process and participate in business strategy discussions.. The most effective approach to align security strategy with business strategy is to integrate security objectives into the business strategy planning process and participate in business strategy discussions. This ensures that security is a core consideration in business decisions, enabling the organization to achieve its goals while managing risk. Other approaches, such as independent development or exclusive focus on compliance, can lead to misalignment and missed opportunities.

Answer

Focus the security strategy primarily on compliance with healthcare regulations such as HIPAA.

Answer

Ensure the security strategy is developed independently by the security team to avoid business influence.

Answer

Adopt a widely recognized security framework and tailor it to the organization's needs.

Question 10

A security manager is reviewing the organization's information security governance framework. The board has expressed concern that security decisions are not consistently aligned with the organization's risk appetite. Which of the following would BEST address this concern?

Accepted Answer

Define and document risk appetite and tolerance levels, and integrate them into the security decision-making processes.. The most effective way to address the board's concern is to formally define risk appetite and tolerance levels and integrate them into security decision-making. This ensures that every security initiative is assessed against the organization's willingness to accept risk, providing consistency and a clear basis for decisions. Other measures, such as committees or dashboards, support this but do not replace the need for explicit risk appetite integration.

Answer

Conduct an annual security awareness training for all employees to reinforce risk management principles.

Answer

Establish a security steering committee that includes business unit leaders to review and approve security initiatives.

Answer

Implement a security metrics dashboard that reports the number of security incidents to the board quarterly.

Question 11

A CISO is designing a security governance framework for a multinational corporation. The framework must address the need for clear accountability, alignment with business strategy, and effective risk management across diverse business units. Which TWO of the following are essential components of such a governance framework? (Choose two.)

Accepted Answer

A process for regularly reviewing and updating security policies to reflect changes in the threat landscape and business environment.. A defined security organizational structure and a process for regularly reviewing policies are essential governance components. The structure ensures accountability and clear roles, while the policy review process ensures ongoing alignment with business strategy and emerging risks. These elements provide the foundation for effective decision-making and oversight.

Answer

A comprehensive set of technical security controls, such as firewalls and intrusion detection systems.

Answer

A centralized security operations center (SOC) that monitors all security events 24/7.

Answer

An annual penetration test to validate the effectiveness of security controls.

Question 12

A CISO is establishing an information security governance framework for a financial services firm. The board has asked for assurance that security risks are managed effectively and that the program aligns with regulatory requirements. Which TWO elements are MOST critical for the CISO to define as part of this governance framework? (Choose two.)

Accepted Answer

A process for reporting security metrics and risk posture to the board on a regular basis.. Defining security roles and responsibilities and establishing a regular reporting process are the most critical elements of a governance framework because they establish accountability and provide the board with the necessary information for oversight. Roles ensure that decision-making authority is clear, while reporting enables the board to monitor risk and compliance. Together, they form the foundation for effective governance and assurance.

Answer

A list of all security tools deployed across the enterprise with their versions and patch levels.

Answer

The annual security budget with line-item allocations for each department.

Answer

Detailed technical procedures for incident response and disaster recovery.

Question 13

A global financial services firm is establishing an information security governance framework. The board of directors wants assurance that security risks are managed effectively across all business units. Which of the following is the MOST important element for the CISO to implement to provide this assurance?

Accepted Answer

A security governance committee with representation from all business units, reporting to the board.. The most important element is a security governance committee with representation from all business units, reporting to the board. This committee provides the structure for consistent risk management, oversight, and accountability across the organization. It ensures that security risks are considered in business decisions and gives the board a direct line of sight into how risks are being managed, which is essential for effective governance.

Answer

A security awareness program for all employees.

Answer

An annual penetration test of all critical systems.

Answer

A centralized security operations center (SOC) that monitors all network traffic.

Question 14

An organization's information security strategy is being developed. The CISO wants to ensure that the strategy supports business objectives while managing risk. Which of the following should be the PRIMARY input to the strategy development process?

Accepted Answer

The organization's business strategy and objectives.. The primary input to security strategy development must be the organization's business strategy and objectives. This ensures that security efforts are directly tied to what the business is trying to achieve, enabling risk management that supports rather than hinders business goals. Other inputs, such as frameworks or technical reports, are secondary and should be used to inform implementation once the business direction is clear.

Answer

Industry best practice frameworks such as ISO/IEC 27001.

Answer

The IT department's technology roadmap.

Answer

The latest vulnerability scan reports.

Question 15

A security manager is developing the incident classification scheme for a multinational retailer. The organization must decide how to categorize an incident involving unauthorized access to a database containing 50,000 customer payment card records, where the breach is confirmed but containment has not yet begun. Which factor is MOST important when assigning the incident severity level?

Accepted Answer

The potential business impact and regulatory notification obligations arising from the exposed records. Severity levels exist to drive escalation, resource allocation, and executive notification. The determinant must be the consequence to the business, including legal and regulatory exposure. With confirmed unauthorized access to payment card data, notification obligations and financial impact are concrete and significant. Technical indicators such as failed logins, malware family, or acknowledgment time inform response but do not define the severity of the incident.

Answer

The specific malware family or attacker tooling identified during initial triage

Answer

The number of failed login attempts recorded before the successful breach

Answer

The elapsed time between the first alert and the analyst's acknowledgment of the ticket