CISM Practice Exam 51 — 20 Questions

Question 1

A CISO is updating the organization's information security policy to reflect a new regulatory requirement. The policy must be approved before it can be communicated to employees. Who is MOST appropriate to approve the updated policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The executive management committee or a designated senior executive, such as the CIO or COO.. Executive management or a designated senior executive is the most appropriate approver for an updated security policy because they have the authority to enforce it across the organization and ensure it aligns with business strategy. While the board is accountable and legal should review, operational policy approval is typically delegated to executives to enable timely updates and practical implementation.

Answer

The board of directors, because they have ultimate accountability for regulatory compliance.

Answer

The chief information security officer (CISO), as the owner of the security program.

Answer

The legal department, because the policy is driven by a regulatory requirement.

Question 2

A security manager is reviewing the incident response plan and notices that the plan does not specify how to handle a situation where the incident response team cannot reach the primary incident response manager. What should be done to address this gap?

Accepted Answer

Designate an alternate incident response manager and include contact information in the plan.. The most effective way to address the lack of a backup for the incident response manager is to designate an alternate and include their contact details in the plan. This ensures that leadership is maintained even if the primary manager is unavailable. It is a simple, cost-effective, and standard practice in incident response planning, aligning with CISM's emphasis on preparedness and resilience.

Answer

Outsource incident response management to a third-party provider.

Answer

Implement a policy that the incident response manager must always be available.

Answer

Require all incident response team members to report to the CISO in the absence of the manager.

Question 3

A CISO is developing a set of metrics to report to the board on the effectiveness of the information security governance program. Which of the following metrics would BEST demonstrate that security governance is aligned with business objectives? (Choose two.)

Accepted Answer

Percentage of security initiatives that are directly linked to business strategy objectives.. The two metrics that best demonstrate alignment with business objectives are the percentage of security initiatives linked to business strategy and the percentage of business units represented on the security governance committee. These metrics show that security activities are driven by business goals and that governance includes cross-functional input, ensuring decisions are aligned with organizational needs. They provide the board with tangible evidence of strategic integration.

Answer

Total security budget as a percentage of IT budget.

Answer

Number of security incidents reported to the board.

Answer

Average time to remediate critical vulnerabilities.

Question 4

A security manager is drafting the incident classification criteria for a new incident response plan. Executive leadership has asked how the team will decide, in the first few minutes of an event, whether to invoke the crisis management team. Which of the following is the MOST appropriate basis for that initial escalation decision?

Accepted Answer

The predefined severity level assigned to the incident type and its assessed business impact. Incident classification must be anchored to predefined severity levels that map directly to business impact, so responders can escalate consistently and quickly. This lets the organisation activate the crisis management team at the right threshold without debate, and it aligns response effort with the value at risk rather than with incidental signals such as alert counts or reporter rank.

Answer

The seniority of the person who first reported the event to the service desk

Answer

The number of alerts the SIEM generated for the affected host in the last 24 hours

Answer

Whether the affected system is covered by the current cyber insurance policy

Question 5

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this approach?

Accepted Answer

Network segmentation, intrusion detection system, and incident response plan. Network segmentation, intrusion detection system, and incident response plan represent a layered defense-in-depth approach because they combine preventive (segmentation), detective (IDS), and corrective (incident response) controls across different layers. This triad addresses network, monitoring, and process domains, which is the essence of defense in depth. The other options either focus on a single control type or lack the breadth of preventive, detective, and corrective measures.

Answer

Access control lists, data loss prevention, and encryption

Answer

Firewall, antivirus, and encryption

Answer

Security awareness training, vulnerability scanning, and patching

Question 6

A security analyst discovers that an employee's credentials were used to access a sensitive database containing customer PII. The analyst immediately disables the account and begins remediation. Which incident category best describes this scenario?

Accepted Answer

Account compromise. The incident involves unauthorized use of legitimate credentials to access a sensitive database, which is the defining characteristic of an account compromise. The immediate disabling of the account and remediation aligns with standard incident response procedures for credential theft, where the attacker has gained authenticated access without authorization. This is distinct from a data breach, which focuses on the exfiltration or exposure of data, not the method of access.

Answer

Data breach

Answer

Physical security

Answer

Insider threat

Question 7

During containment of a confirmed intrusion, the incident response manager must decide whether to immediately rebuild the compromised server or first acquire volatile data. Legal counsel has signalled that litigation is likely. Which of the following is the BEST course of action?

Accepted Answer

Capture volatile data in order of volatility, then rebuild the server from a known-good image. Forensic soundness requires capturing the most volatile data first because memory and connection state are lost on shutdown or rebuild. Once that evidence is preserved, the server can be rebuilt from a known-good image to restore service. This sequence respects the litigation hold implied by legal counsel while still meeting the organisation's recovery objectives.

Answer

Rebuild the server immediately to restore service, then document what was observed before the rebuild

Answer

Leave the server running untouched until the external forensic firm arrives several days later

Answer

Shut down the server immediately to preserve its current state for investigators

Question 8

A healthcare organization is developing an information security governance framework. The CISO needs to ensure that the framework supports regulatory compliance with HIPAA and aligns with the organization's strategic goals. Which of the following should be the FIRST step in this process?

Accepted Answer

Define the scope and objectives of the governance framework.. The first step in developing a governance framework is to define its scope and objectives. This ensures that the framework is aligned with business strategy and regulatory requirements, such as HIPAA. It provides a clear direction for subsequent activities, including risk assessments, policy development, and control implementation. Without this foundational step, efforts may be unfocused and fail to meet stakeholder needs.

Answer

Conduct a gap assessment against the HIPAA Security Rule.

Answer

Develop a security awareness program for all staff.

Answer

Select and implement a governance, risk, and compliance (GRC) tool.

Question 9

A financial services firm's incident response team has contained a credential-stuffing attack that compromised several customer accounts. The CISO asks the incident manager to determine what should happen next before the team stands down. Which action BEST aligns with CISM incident management practices?

Accepted Answer

Conduct a post-incident review to capture lessons learned and update controls and the response plan.. The post-incident review is a core CISM activity that converts a contained incident into organizational improvement. It examines root cause, response effectiveness, and gaps, then updates the incident response plan and controls. Simply closing the ticket, over-escalating, or blindly reimaging systems skips the analysis needed to prevent recurrence and strengthen the security program.

Answer

Reimage all customer account systems and rotate every credential in the environment without further analysis.

Answer

Escalate the incident to law enforcement and suspend all customer-facing services pending investigation.

Answer

Immediately close the incident ticket and release the response team so normal operations can resume.

Question 10

An organization's incident response plan defines containment, eradication, and recovery phases. During a major incident involving a compromised application server, the incident response manager must decide whether to take the server offline immediately or keep it running to observe attacker behavior. Which of the following is the MOST important factor in making this decision?

Accepted Answer

The potential business impact of taking the server offline versus the risk of allowing the attacker to persist.. The containment decision during an incident must balance the risk of continued attacker presence against the business impact of taking systems offline. CISM emphasizes aligning incident response with business objectives, so the incident response manager should prioritize business impact and risk. Forensic preservation, threat intelligence, and past experience are supporting considerations but not the primary factor.

Answer

The attacker's known tactics, techniques, and procedures (TTPs) from threat intelligence.

Answer

The incident response team's previous experience with similar incidents.

Answer

The availability of forensic tools to capture volatile memory before shutting down the server.

Question 11

An organization is reviewing its incident response plan after a prolonged outage caused by a coordinated attack. Management wants to improve the organization's ability to communicate effectively during future incidents. Which TWO of the following should be included in the incident communication plan? (Choose two.)

Accepted Answer

Predefined communication templates for different stakeholder groups and incident types. An effective incident communication plan includes prepared templates for different audiences and incidents, plus designated spokespersons with clear approval workflows. Templates speed response and ensure consistency, while spokesperson designation and approval controls prevent unauthorized or harmful statements. Collecting personal contact data, mandating real-time technical disclosure, or centralizing all communication in one executive do not constitute sound communication planning and can introduce privacy, security, or operational problems.

Answer

A requirement that all technical details of the incident be shared publicly in real time

Answer

A list of all employees' personal mobile numbers for emergency mass texting

Answer

A policy that only the CEO may speak to any stakeholder during an incident

Question 12

An organization has just experienced a P1 incident. Which of the following communication steps should occur FIRST?

Accepted Answer

Notify executive leadership. For a P1 (highest severity) incident, the first communication step is to notify executive leadership so they can authorize resources, make business decisions, and activate the crisis management structure. Executives own the risk and must be informed before any external messaging occurs. Customer, legal, and media communications follow only after leadership is briefed and the facts are established.

Answer

Inform customers

Answer

Notify law enforcement

Answer

Issue a media statement

Question 13

During a forensic investigation, the external forensics firm discovers evidence that may indicate criminal activity. The incident manager wants to ensure attorney-client privilege is maintained. What should be done?

Accepted Answer

Involve legal counsel to manage privilege. Involving legal counsel is essential to establish and preserve attorney-client privilege over the forensic investigation. Legal counsel can direct the scope of the investigation, issue a 'Kovel letter' to engage the external forensics firm as an agent of the attorney, and ensure that all communications and findings are protected under the work-product doctrine. Without this step, any evidence of criminal activity could be deemed discoverable and waive privilege, potentially compromising the organization's legal defense.

Answer

Share evidence directly with law enforcement

Answer

Ignore privilege to speed up investigation

Answer

Publicly disclose the evidence

Question 14

A global financial services firm has a mature information security program with policies, standards, and procedures aligned to ISO/IEC 27001. The CISO is preparing for the annual management review of the program. The board has asked for assurance that the program remains effective as the threat landscape and business strategy evolve. Which activity BEST provides this assurance?

Accepted Answer

Reviewing the results of independent audits, control testing, and metrics against program objectives to evaluate effectiveness.. The board requires assurance that the program remains effective amid evolving threats and business strategy. Independent audits, control testing, and metrics provide objective, ongoing evidence of effectiveness across governance, risk, and controls. This integrated view supports informed management review and strategic decision-making, which is the core purpose of monitoring and reporting program performance.

Answer

Increasing the security awareness training frequency and tracking completion rates across all business units.

Answer

Conducting a penetration test of all externally facing applications and reporting the number of critical findings.

Answer

Updating the information security policy to reflect the latest regulatory changes and obtaining executive sign-off.

Question 15

An organization experiences a data breach involving customer personally identifiable information (PII). The incident response team has contained the breach. Which of the following should be the PRIMARY consideration when deciding whether to notify affected customers?

Accepted Answer

Legal and regulatory requirements for breach notification.. The primary consideration for notifying affected customers after a data breach is compliance with legal and regulatory requirements. These laws dictate the circumstances, timing, and method of notification. Failure to comply can result in significant penalties and legal liability. While cost, PR, and stock price are important, they are secondary to legal obligations and the ethical duty to protect customers.

Answer

The cost of providing credit monitoring services.

Answer

The potential impact on the organization's stock price.

Answer

The organization's public relations strategy.

Question 16

During a major incident, the incident response team discovers that the attacker is still active in the environment and is moving laterally. The incident response manager must decide on the immediate course of action. Which of the following should be the PRIMARY consideration when determining whether to isolate affected network segments?

Accepted Answer

The potential impact on business operations and critical services.. In an active incident with lateral movement, the incident response manager must balance containment against business continuity. The primary consideration is the impact on business operations and critical services, because isolation can disrupt essential functions. This reflects CISM's emphasis on aligning incident response decisions with organizational risk management and business priorities, rather than purely technical or financial factors.

Answer

The attacker's presumed skill level and tools.

Answer

The cost of replacing the affected network hardware.

Answer

The number of security staff available to monitor the isolated segments.

Question 17

A financial services firm has just contained a breach in which an attacker exfiltrated customer records from a database server. Legal counsel advises the incident manager that the matter will likely result in litigation and regulatory inquiry. Which TWO actions should the incident manager take to preserve the evidentiary value of the affected server? (Choose two.)

Accepted Answer

Capture a forensic image of the server's volatile memory and disk before any remediation or reboot occurs.. Preserving evidence in a matter destined for litigation and regulatory scrutiny requires capturing volatile and non-volatile data before any remediation and maintaining rigorous chain-of-custody records. These two actions protect admissibility and demonstrate due diligence. Rebuilding the server, deleting malware, or resuming backups would overwrite or destroy artifacts, weakening both the legal case and the organization's regulatory defensibility.

Answer

Allow the database administrator to resume normal backups on the server to maintain recovery capability.

Answer

Delete the attacker's malware binaries to prevent accidental execution during the investigation.

Answer

Rebuild the server from a known-good image immediately to restore service and eliminate attacker persistence.

Question 18

An organization is reviewing its incident response plan after a tabletop exercise revealed confusion about roles during a major incident. The CISO wants to clarify which activities belong to the incident response team versus the crisis management team. Which TWO of the following activities are PRIMARY responsibilities of the crisis management team during a major incident? (Choose two.)

Accepted Answer

Authorizing the expenditure of emergency funds to engage external counsel and forensic vendors.. The crisis management team owns strategic decisions such as approving external communications and authorizing emergency spending for legal and forensic support. These activities require executive authority and affect the entire enterprise. Forensic imaging, malware analysis, and firewall changes are tactical tasks belonging to the incident response team and should remain with technical responders to keep the CMT focused on governance and business impact.

Answer

Performing forensic imaging of compromised servers to preserve evidence.

Answer

Analyzing malware samples to determine the attacker's command-and-control infrastructure.

Answer

Configuring firewall rules to block identified malicious IP addresses.

Question 19

A security operations center (SOC) analyst receives an alert indicating that a workstation is communicating with a known command-and-control (C2) server. The analyst confirms the traffic is malicious. According to CISM best practices, which action should the analyst take NEXT?

Accepted Answer

Isolate the workstation from the network and escalate according to the incident response plan.. Once malicious C2 traffic is confirmed, the priority is to contain the threat without destroying evidence. Network isolation of the affected endpoint stops ongoing attacker communication and limits lateral movement, while escalation triggers the formal incident response process so that severity, notification, and forensic requirements are handled correctly. Remediation actions such as powering off or scanning the host are premature and can compromise the investigation.

Answer

Immediately power off the workstation to stop the C2 communication.

Answer

Run a full antivirus scan on the workstation to remove the malware.

Answer

Wait for the next scheduled vulnerability scan to confirm the finding.

Question 20

A security manager is designing a security awareness program for a mid-sized organization. Which of the following is the MOST effective approach to ensure that training is relevant to different employee roles?

Accepted Answer

Provide role-based training that addresses specific risks for each job function.. Role-based training is the most effective approach because it tailors content to the specific risks, tools, and data each job function handles, increasing relevance and retention. For example, finance staff need payment fraud and invoice manipulation training, while developers need secure coding and secrets management. This targeted approach addresses the actual threat surface of each role rather than delivering generic content.

Answer

Deliver the same annual training to all employees to ensure consistency.

Answer

Focus only on senior executives since they are the primary targets of social engineering.

Answer

Conduct quarterly phishing simulations without any formal training.