CISM Practice Test 50 — 15 Questions

Question 1

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is working on containment. Which communication should the incident manager prioritize FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Notify the executive sponsor, legal counsel, and communications lead. Immediate containment and notification of key internal stakeholders (executive sponsor, legal, communications) is the first priority to coordinate response and manage legal/regulatory obligations.

Answer

Contact the organization's cyber insurance provider

Answer

Notify law enforcement

Answer

Issue a press release

Question 2

The SIEM alerts on this traffic. What should the incident analyst do FIRST?

Accepted Answer

Isolate the host for investigation.. The SIEM alert indicates suspicious traffic, and the first priority in incident response is containment to prevent further damage or lateral movement. Isolating the host (Option A) immediately stops the potential threat from communicating with the network, allowing for a safe forensic investigation. This aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized before eradication or recovery.

Answer

Accept the traffic as normal.

Answer

Block the IP at the firewall.

Answer

Check if the destination is a legitimate CDN.

Question 3

Based on the exhibit, an incident involves unauthorized access to a file server containing corporate training videos. No sensitive data is stored there. Which priority should the incident be assigned?

Accepted Answer

Low. The training videos are low-value data with no sensitive information and are easily restored. Option A is wrong because no sensitive data or regulatory implications. Option B is wrong because no sensitive business data. Option C is wrong because no operational data.

Answer

Critical

Answer

Medium

Answer

High

Question 4

A large healthcare organization recently experienced a ransomware attack that encrypted patient records (ePHI). The attack originated from a phishing email that bypassed the email security gateway. The security program includes annual security awareness training, but post-incident analysis reveals that employees often ignore suspicious emails. The CISO wants to revise the program to reduce the likelihood of similar incidents. Which course of action is most effective?

Accepted Answer

Increase the frequency of phishing simulations and enforce mandatory remedial training for employees who fall for them. Most effective because it directly addresses the human factor by increasing the frequency of phishing simulations and providing remedial training, which reinforces secure behavior. Option A improves technology but does not change employee behavior. Option B (next-generation email security gateway) may help block some phishing emails but does not address the root cause of employees ignoring suspicious emails. Option C (EDR) can detect ransomware after execution but does not prevent the initial phishing compromise.

Answer

Restrict users' ability to receive emails from external domains except from approved senders

Answer

Implement a next-generation email security gateway with AI-based threat detection

Answer

Deploy endpoint detection and response (EDR) on all workstations

Question 5

An organization is updating its incident response plan after a lessons learned meeting. Which of the following is the primary purpose of updating the plan based on lessons learned?

Accepted Answer

To incorporate improvements to prevent recurrence and enhance response. The primary purpose is to incorporate improvements to prevent recurrence and improve response effectiveness.

Answer

To assign blame for failures

Answer

To share threat intelligence with ISACs

Answer

To document the incident for regulatory compliance

Question 6

A security metrics program should include key performance indicators (KPIs) for board reporting. Which metric is most appropriate for executive oversight?

Accepted Answer

Mean time to detect (MTTD) incidents. Mean time to detect is a high-level metric that reflects security effectiveness.

Answer

Number of firewall rules configured

Answer

Daily log volume

Answer

Patch management tool version

Question 7

During a post-incident review, the incident response team identifies that the root cause of a data breach was a misconfigured firewall rule that allowed unrestricted inbound access from the internet. Which corrective action BEST addresses this issue?

Accepted Answer

Implement a change management process for firewall modifications. Implementing a change management process (D) ensures that firewall rule changes are reviewed and approved, preventing misconfigurations from recurring. A one-time review of all firewall rules (B) is temporary and does not address the underlying process failure. Increasing the frequency of penetration tests (A) may detect vulnerabilities but does not prevent misconfigurations. Restoring from a last known good backup (C) does not fix the process that led to the misconfiguration.

Answer

Increase the frequency of penetration tests

Answer

Conduct a one-time review of all firewall rules

Answer

Restore the firewall configuration from the last known good backup

Question 8

A large enterprise with a centralized Security Information and Event Management (SIEM) system is experiencing a high volume of false positive alerts. The security team is overwhelmed and has started to ignore many alerts. During a recent incident, a critical alert indicating lateral movement by an attacker was missed because it was buried among hundreds of false positives. The incident escalated significantly before it was discovered. The CISO has asked the incident response manager to recommend improvements to prevent this from happening again. What should the manager recommend as the primary action?

Accepted Answer

Tune SIEM rules to eliminate known false positives. Tuning the SIEM rules to reduce false positives is the most direct way to improve alert quality without losing coverage. Increasing thresholds may cause missed real alerts. Hiring more staff is a longer-term solution. Disabling non-critical alerts could remove important detection capabilities.

Answer

Increase all alert thresholds to reduce volume

Answer

Hire additional security analysts to handle the load

Answer

Disable all non-critical alert categories

Question 9

What is the recommended timeframe for holding a lessons learned meeting after an incident has been resolved?

Accepted Answer

Within 2 weeks. Conducting the meeting within two weeks ensures details are fresh and improvements can be implemented quickly.

Answer

Within 1 month

Answer

Within 3 months

Answer

Within 24 hours

Question 10

Which THREE of the following are incident severity levels defined in a typical incident management program? (Select three.)

Accepted Answer

P3 – Medium. Common severity levels include P1 (critical), P2 (high), P3 (medium), and P4 (low). P0 is not standard; P5 is not used.

Answer

P5 – Low

Answer

P0 – Emergency

Question 11

A security awareness program includes phishing simulations. After six months, the click rate has decreased from 15% to 8%, but the number of reported phishing emails has also dropped. The CISO wants to measure the effectiveness of the program. Which metric would best indicate sustained improvement in security behavior?

Accepted Answer

Phishing click rate trend over the last 12 months. A sustained low click rate over time, with increasing or stable reporting rates, is a leading indicator of improved security awareness. A decreasing click rate alone may be confounded by other factors, but combined with reporting trends it shows behavioral change.

Answer

Pass rate on post-training knowledge assessments

Answer

Number of security incidents caused by phishing

Answer

Number of employees who completed training

Question 12

After successfully containing an incident, the incident response team discovers that the attacker exploited a previously unknown vulnerability in a web application. The vulnerability is not yet patched by the vendor. The organization's management is concerned about the risk of another attack using the same vulnerability. What should the team recommend as the immediate action to reduce this risk?

Accepted Answer

Implement a workaround to mitigate the vulnerability. Implementing a workaround (such as a web application firewall rule or configuration change) reduces the immediate risk while waiting for a vendor patch. Developing a patch in-house is not advisable due to complexity and risk. Reporting to vendor is important but does not provide immediate protection. Disabling the service may be too disruptive.

Answer

Disable the web application until a patch is available

Answer

Report the vulnerability to the software vendor

Answer

Develop an in-house patch for the vulnerability

Question 13

An incident response team is conducting an exercise to test its playbook for a ransomware incident. Which of the following is the PRIMARY benefit of such an exercise?

Accepted Answer

Validating the incident response plan and identifying areas for improvement. Exercises validate the effectiveness of the plan and identify gaps before a real incident.

Answer

Documenting the exercise for future reference

Answer

Complying with regulatory requirements

Answer

Testing the technical skills of the team

Question 14

Based on the exhibit, which role is responsible for notifying affected users about the phishing attack?

Accepted Answer

Communications Lead. The Communications Lead is responsible for notifying affected users about the phishing attack because this role manages external and internal communications, including user notifications, during an incident. In the exhibit, the Communications Lead is explicitly assigned the task of 'Notify affected users' under the communication plan, ensuring timely and accurate messaging to reduce further risk.

Answer

Technical Lead

Answer

Legal Counsel

Answer

Incident Response Manager

Question 15

An organization is developing an information security strategy aligned with business objectives. Which of the following is the BEST approach to prioritize security investments?

Accepted Answer

Use a risk-based approach aligned to business impact. A risk-based approach aligns security investments with the organization's risk appetite, ensuring resources are directed to the most critical areas.

Answer

Follow industry benchmarks without adjustment

Answer

Prioritize based on the cost of security controls

Answer

Allocate budget equally across all security domains