CISM Practice Questions 1 — 50 Questions

Question 1

An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)

Accepted Answer

Notify the relevant data protection authority within the required timeframe.. Data breach notification laws (e.g., GDPR Article 33, CCPA) require organizations to notify the relevant data protection authority within a specified timeframe (e.g., 72 hours under GDPR) once the breach is confirmed. This is a mandatory legal obligation in incident response to avoid penalties and demonstrate regulatory compliance.

Answer

Immediately issue a press release without consulting legal.

Answer

Ignore the incident if no customers have complained.

Answer

Delete all system logs to prevent further exposure.

Question 2

When selecting security controls based on NIST SP 800-53, which control family is MOST directly related to protecting the confidentiality of data?

Accepted Answer

Access Control (AC). Access control (AC) family includes controls that restrict access to data, directly protecting confidentiality.

Answer

Identification and Authentication (IA)

Answer

System and Communications Protection (SC)

Answer

Audit and Accountability (AU)

Question 3

Which of the following best describes the primary purpose of an information security program?

Accepted Answer

To manage security risks in alignment with business strategy. The primary purpose of an information security program is to manage security risks in alignment with business strategy, ensuring that security controls and investments support organizational objectives while balancing risk acceptance, mitigation, transfer, and avoidance. This aligns with the CISM framework, which emphasizes that security is a business enabler, not a technical silo. A program that fails to align with business strategy may over-prioritize technical controls, leading to wasted resources or misaligned risk tolerance levels.

Answer

To ensure 100% system availability

Answer

To eliminate all security risks

Answer

To achieve compliance with all applicable regulations

Question 4

Following containment of a ransomware incident, the incident response team is conducting a root cause analysis. Which method involves repeatedly asking 'why' to drill down to underlying causes?

Accepted Answer

5 Whys. The 5 Whys technique is a simple root cause analysis method that iteratively asks 'why' to move from symptoms to root causes.

Answer

Pareto analysis

Answer

SWOT analysis

Answer

Fishbone diagram

Question 5

After a data breach incident, the incident response team must preserve evidence for potential litigation. Which of the following actions should be taken FIRST?

Accepted Answer

Issue a legal hold. Issuing a legal hold ensures that all relevant data is preserved and not deleted, which is the first step in evidence preservation.

Answer

Update the IR plan

Answer

Begin remediation

Answer

Notify law enforcement

Question 6

Which document outlines the overall strategy, roles, and responsibilities for incident response across the organization?

Accepted Answer

Incident response plan. The incident response plan provides the high-level strategy and coordination framework.

Answer

Communication plan

Answer

Incident response policy

Answer

Incident response playbook

Question 7

An organization has just experienced a P1 incident. Which of the following communication steps should occur FIRST?

Accepted Answer

Notify executive leadership. Internal communication, especially to executives, is typically the first priority to ensure leadership is informed.

Answer

Inform customers

Answer

Notify law enforcement

Answer

Issue a media statement

Question 8

Which THREE of the following are typical roles in an incident response team?

Accepted Answer

Security analyst. The IR team includes security analysts, forensic investigators, and legal counsel; the CMT includes executives like CEO; HR is not a standard IR role.

Answer

Human resources manager

Answer

Chief executive officer (CEO)

Question 9

Which TWO of the following are incident categories in an incident management programme?

Accepted Answer

Insider threat. Ransomware and insider threat are defined incident categories; phishing is a technique, not a category; vulnerability is a condition; theft is too broad.

Answer

Theft

Answer

Vulnerability

Answer

Phishing

Question 10

An organization has experienced a ransomware attack that has encrypted critical servers and is causing major business disruption. According to incident severity levels, which priority should this incident be assigned?

Accepted Answer

P1 — Critical. A ransomware attack with major business impact is a critical incident (P1), requiring executive notification and 24/7 response.

Answer

P2 — High

Answer

P4 — Low

Answer

P3 — Medium

Question 11

During a DDoS attack, the incident response team determines that the attack cannot be mitigated within the maximum tolerable downtime (MTD). What should happen next?

Accepted Answer

Activate business continuity and disaster recovery plans. When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation.

Answer

Notify the board of directors

Answer

Continue current mitigation efforts

Answer

Declare a disaster immediately

Question 12

A risk manager is evaluating a control that reduces the likelihood of a threat from high to low. The cost of the control is $100,000 annually. The expected loss without the control is $500,000 per year. Which of the following should the risk manager recommend?

Accepted Answer

Implement the control. The control reduces the annualized loss expectancy (ALE) from $500,000 to a much lower value (since likelihood drops from high to low). The annual cost of the control is $100,000, which is significantly less than the $500,000 expected loss without it. Implementing the control provides a positive return on investment (ROI) and is the most cost-effective risk mitigation strategy.

Answer

Avoid the risk by discontinuing the process

Answer

Transfer the risk through insurance

Answer

Accept the risk

Question 13

Which control family from NIST SP 800-53 is MOST directly associated with ensuring that users have appropriate access rights?

Accepted Answer

Access Control (AC). The Access Control (AC) family specifically addresses user access management.

Answer

System and Communications Protection (SC)

Answer

Identification and Authentication (IA)

Answer

Personnel Security (PS)

Question 14

A large financial institution is updating its information security program to align with a new regulatory framework. The program currently has a decentralized governance model. Which of the following is the MOST significant risk of maintaining a decentralized model?

Accepted Answer

Inconsistent security levels across business units. Decentralized governance leads to inconsistent security levels across business units, which is a major regulatory and risk concern. Option A is possible but less critical. Option C may increase but is a consequence. Option D may be slower but inconsistent security is more fundamental.

Answer

Slower incident response

Answer

Higher cost of compliance

Answer

Duplication of controls

Question 15

The security team is designing a security awareness program. Which topic should be prioritized FIRST?

Accepted Answer

Phishing recognition and reporting. Phishing is a common initial attack vector, and training users to recognize it can immediately reduce risk. Option B is wrong password policies are important but often covered later. Option C is wrong incident reporting is critical but follows awareness of threats. Option D is wrong data classification is more advanced.

Answer

Password creation and management

Answer

Incident reporting procedures

Answer

Data classification and handling

Question 16

An organization has a mature security program with documented policies and standards. However, during a recent audit, it was found that several business units are not following the mandated data classification standard. What is the MOST likely root cause?

Accepted Answer

Lack of enforcement mechanisms. A mature security program with documented policies and standards indicates that the classification rules are already defined. The audit finding that business units are not following the mandated standard points to a failure in enforcement mechanisms—such as automated Data Loss Prevention (DLP) rules, access control policies, or mandatory labeling in SharePoint—rather than a lack of awareness or outdated policy. Without enforcement (e.g., Group Policy Objects blocking unclassified data uploads or SIEM alerts for missing classification tags), even well-trained staff may bypass the standard.

Answer

Inadequate security awareness training

Answer

Outdated data classification policy

Answer

Insufficient budget for security tools

Question 17

Which of the following is the primary purpose of an information security program?

Accepted Answer

Protect the confidentiality, integrity, and availability of information assets.. The primary purpose of an information security program is to safeguard the confidentiality, integrity, and availability (CIA) of information assets. This aligns with the core definition of information security as defined in standards like ISO/IEC 27001 and NIST SP 800-53, which frame security controls around protecting these three attributes. A program must be risk-based and business-aligned, not just a collection of tools or compliance checklists.

Answer

Implement firewalls and antivirus software.

Answer

Achieve compliance with regulations only.

Answer

Eliminate all security risks.

Question 18

An organization is implementing an identity and access management (IAM) program. Which THREE of the following are key components of a mature IAM program?

Accepted Answer

Role-based access control (RBAC) aligned with job functions.. Mature IAM includes lifecycle management (provisioning/de-provisioning), role-based access control (RBAC), and periodic access reviews to ensure least privilege.

Answer

Biometric authentication for all users.

Answer

Single sign-on (SSO) for all cloud applications.

Question 19

During a merger, the acquiring company's security program must integrate with the target company's program. What is the HIGHEST priority action?

Accepted Answer

Conduct a comprehensive risk assessment of the target. A comprehensive risk assessment of the target company's environment identifies integration risks and informs the integration plan. Option A is premature without understanding risks. Option C and D are tactical steps that should follow risk assessment.

Answer

Consolidate all security tools

Answer

Merge the security teams into one reporting structure

Answer

Standardize security policies immediately

Question 20

A multinational organization handles personal data of EU residents. Which regulatory requirement must the information security program address?

Accepted Answer

GDPR. GDPR applies to any organization processing personal data of EU residents, regardless of location.

Answer

SOX

Answer

PCI DSS

Answer

HIPAA