CISM Practice Questions 2 — 50 Questions

Question 1

During an audit, it was found that the organization's information security policy is not being followed by business units. Which of the following is the MOST effective way for the information security manager to improve compliance?

Accepted Answer

Establish a policy review committee with business unit representatives to align policy with operational needs.. The most effective way to improve compliance is to align the policy with operational realities by involving business unit representatives in a policy review committee. When policies conflict with business processes, users will bypass them; adjusting the policy to be both secure and practical increases voluntary adherence. This addresses the root cause—policy misalignment—rather than treating symptoms like lack of awareness or enforcement.

Answer

Provide additional security awareness training focused on policy requirements.

Answer

Escalate non-compliance to senior management for disciplinary action.

Answer

Increase the frequency of automated policy compliance checks.

Question 2

An organization has decided to adopt a risk-based approach to information security. What is the FIRST step the information security manager should take to implement this approach?

Accepted Answer

Identify and assess information assets and their associated threats and vulnerabilities.. The first step in implementing a risk-based approach is to identify and assess information assets along with their associated threats and vulnerabilities. This foundational activity provides the necessary context for all subsequent risk management decisions, including defining risk appetite, selecting a framework, and implementing controls. Without a clear understanding of what assets exist and what risks they face, any further steps would be based on assumptions rather than evidence.

Answer

Define the organization's risk appetite and risk tolerance levels.

Answer

Implement security controls based on industry best practices.

Answer

Select a risk management framework such as ISO 31000 or NIST RMF.

Question 3

An organization's security monitoring system detects multiple failed login attempts from an internal IP address to a critical database server. The attempts are occurring every few seconds. What is the FIRST step the incident response team should take?

Accepted Answer

Verify whether the activity is legitimate.. The first step is to verify if the activity is legitimate or malicious to avoid false positives and understand the context.

Answer

Block the IP address at the firewall immediately.

Answer

Disable the database server to prevent data breach.

Answer

Reset the password of the database service account.

Question 4

An organization has an incident response plan that designates a primary and alternate incident response team. During a simulated ransomware attack, the primary team is unavailable. What should the alternate team do FIRST?

Accepted Answer

Assess the situation and then activate the plan.. Option D is correct because the alternate team must first assess the situation to understand the scope, impact, and validity of the ransomware attack before activating the plan. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis precede containment, eradication, and recovery. Jumping directly to execution without assessment could lead to inappropriate response actions, such as isolating systems that are not affected or failing to preserve critical forensic evidence.

Answer

Contact the primary team members for instructions.

Answer

Declare a disaster and escalate to senior management.

Answer

Execute the incident response plan as documented.

Question 5

After a major security incident, the incident response team completes the containment, eradication, and recovery phases. The CISO is now planning the post-incident activities. Which activity is MOST critical to ensure that lessons learned are effectively incorporated?

Accepted Answer

Conducting a post-incident review and updating policies.. Conducting a post-incident review and updating policies is the most critical post-incident activity because it ensures that the root cause, response gaps, and process deficiencies are formally documented and translated into actionable improvements. This directly supports the continuous improvement cycle required by NIST SP 800-61 and ISO 27035, preventing recurrence of similar incidents.

Answer

Publishing a public disclosure of the incident.

Answer

Terminating the incident response team's engagement.

Answer

Restoring all systems to full production status.

Question 6

Which TWO of the following are key components of an effective incident response plan?

Accepted Answer

A clear chain of command and escalation procedures.. A clear chain of command and escalation procedures ensure that during an incident, decision-making authority and notification paths are predefined, reducing confusion and enabling rapid, coordinated response. This aligns with NIST SP 800-61 incident response guidelines, which emphasize the need for defined roles and communication hierarchies to avoid delays or missteps in critical situations.

Answer

Automatic detection and response tools.

Answer

Predefined response scripts for every possible incident.

Question 7

During an incident investigation, the forensic analyst discovers that a malware sample communicates with an external IP address. The organization's incident response plan requires a decision on whether to block the IP at the firewall. What should the incident response team do FIRST?

Accepted Answer

Check threat intelligence feeds to confirm maliciousness.. Option D is correct because the incident response team must first validate the maliciousness of the IP address using threat intelligence feeds before taking any irreversible action. Blocking an IP without confirmation could disrupt legitimate business operations or tip off an attacker, and the CISM framework emphasizes evidence-based decision-making during incident response.

Answer

Monitor the connection further without taking action.

Answer

Block the IP address immediately to prevent data exfiltration.

Answer

Notify law enforcement about the IP address.

Question 8

Which TWO of the following are indicators of a potential security incident?

Accepted Answer

Multiple unexpected system reboots.. Multiple unexpected system reboots (B) are a strong indicator of a potential security incident because they may result from malware, kernel-level exploits, or denial-of-service attacks that crash the operating system. Unusual outbound network traffic from a server (E) often indicates data exfiltration, command-and-control (C2) communication, or a compromised service sending sensitive data to an external host. Both behaviors deviate from baseline operations and warrant immediate investigation under the Incident Management domain.

Answer

Low disk space on a file server.

Answer

A new version of a critical software released.

Answer

A successful login by an authorized user.

Question 9

Based on the exhibit, what is the MOST likely issue?

Accepted Answer

A system is infected with malware that is beaconing to a command and control server.. The IDS alert indicates a malware beacon, and the firewall log shows periodic outbound connections to an external IP, which is typical of command and control traffic.

Answer

A user is streaming video from a legitimate site.

Answer

A software update is being downloaded from an external site.

Answer

A network scan is being performed from the internal IP.

Question 10

Match each CISM domain to its focus area.

Question 11

Match each business continuity term to its definition.

Question 12

Match each risk management term to its definition.

Question 13

Match each security metric to its description.

Question 14

Match each security framework to its primary purpose.

Question 15

Match each cryptographic term to its description.

Question 16

Match each incident management phase to its activity.

Question 17

Match each security role to its primary responsibility.

Question 18

Which of the following are key components of an Information Security Risk Management program? (Select TWO.)

Accepted Answer

Establishing a risk management framework. A is correct because establishing a risk management framework is the foundational component of an Information Security Risk Management program. It defines the policies, procedures, and governance structure for identifying, assessing, and treating risks, aligning with standards like ISO 31000 or NIST SP 800-39. Without a framework, risk management activities lack consistency and accountability.

Answer

Conducting vulnerability scanning

Answer

Performing internal audits

Question 19

An information security manager has identified a risk with a high likelihood and high impact. The cost of mitigating the risk exceeds the potential loss. What is the MOST appropriate risk treatment strategy?

Accepted Answer

Risk acceptance. When mitigation cost exceeds potential loss, risk acceptance is appropriate if the risk is within the organization's risk appetite. Alternatively, risk transfer (e.g., insurance) could be considered, but acceptance is often the primary choice when the cost-benefit is negative.

Answer

Risk mitigation

Answer

Risk transfer

Answer

Risk avoidance

Question 20

After a major security incident, the board of directors requests a review of the information security program. Which of the following metrics would be MOST useful to demonstrate the effectiveness of the program over the past year?

Accepted Answer

Number of security incidents detected and contained within defined SLAs. The number of incidents detected and contained within defined SLAs directly measures the program's ability to detect and respond to threats, which is a key indicator of operational effectiveness. Other metrics may be useful but do not directly measure the program's performance in protecting the organization.

Answer

Percentage of employees who completed security awareness training

Answer

Total cost of security investments compared to industry benchmarks

Answer

Number of vulnerabilities identified in the latest penetration test