CISM Practice Exam 51 — 20 Questions

Question 1

The security analyst reviews the SIEM alert and finds that the source IP is from a trusted VPN broker used by remote employees. What is the most likely explanation for the alert?

Accepted Answer

An attacker has compromised a remote employee's device and is brute-forcing the admin account. A trusted VPN broker IP address in a SIEM alert for brute-force attempts against an admin account strongly indicates that an attacker has compromised a remote employee's device and is using the established VPN tunnel to launch the attack. The VPN broker itself is not misconfigured; rather, the attacker is leveraging the legitimate VPN connection to bypass perimeter defenses and target internal systems, making the alert a valid security incident.

Answer

The VPN broker itself is misconfigured

Answer

A legitimate user forgot their password

Answer

The alert is a false positive due to SIEM rule threshold

Question 2

An organization has an incident response plan that designates a primary and alternate incident response team. During a simulated ransomware attack, the primary team is unavailable. What should the alternate team do FIRST?

Accepted Answer

Assess the situation and then activate the plan.. The alternate team must first assess the situation to understand the scope, impact, and validity of the ransomware attack before activating the plan. This aligns with the NIST SP 800-61 incident response lifecycle, where detection and analysis precede containment, eradication, and recovery. Jumping directly to execution without assessment could lead to inappropriate response actions, such as isolating systems that are not affected or failing to preserve critical forensic evidence.

Answer

Contact the primary team members for instructions.

Answer

Declare a disaster and escalate to senior management.

Answer

Execute the incident response plan as documented.

Question 3

A CISO is preparing a multi-year security roadmap. Which of the following is the MOST critical factor for ensuring the roadmap aligns with business strategy?

Accepted Answer

Understanding the organization's strategic business objectives and risk appetite. Understanding business objectives first ensures that security initiatives support the organization's goals and are prioritized accordingly.

Answer

Benchmarking against industry peers

Answer

Assessing current security maturity level

Answer

Reviewing recent security incidents and lessons learned

Question 4

After a ransomware attack, the incident response team successfully restores systems from backups. However, the ransomware encrypts files that were modified after the last backup was taken. Which of the following is the BEST way to minimize future data loss?

Accepted Answer

Use continuous data protection (CDP) with frequent snapshots.. Continuous data protection (CDP) with frequent snapshots captures every write operation in near real-time, allowing recovery to any point before the ransomware encryption. This eliminates the gap between the last backup and the attack, ensuring that even files modified after the last full backup can be restored without data loss.

Answer

Train users to save files to network drives.

Answer

Perform full backups daily instead of weekly.

Answer

Implement a data loss prevention (DLP) system.

Question 5

A multinational corporation must comply with both GDPR and CCPA. Which governance approach is most effective?

Accepted Answer

Develop a unified data protection framework with regional adjustments. A unified data protection framework with regional adjustments allows the organization to maintain consistent governance principles while accommodating specific legal requirements of GDPR (e.g., data subject rights, 72-hour breach notification) and CCPA (e.g., opt-out rights, broader definition of personal information). This approach aligns with the CISM domain of Information Security Governance by enabling scalable, risk-based compliance without duplicating efforts or creating conflicts between policies.

Answer

Create a single rigid unified policy applicable everywhere

Answer

Implement separate compliance programs for each regulation

Answer

Outsource compliance to a third-party service provider

Question 6

During a data breach investigation, legal counsel instructs the forensics team to preserve evidence under attorney-client privilege. Which of the following actions is most critical to maintain that privilege?

Accepted Answer

Limit distribution of forensic reports to individuals with a need-to-know and under legal direction. To preserve attorney-client privilege, communications and work product must be kept confidential and not shared with third parties unless protected by common interest or waiver.

Answer

Use a separate, isolated network for forensic analysis

Answer

Encrypt all forensic images with a strong algorithm

Answer

Destroy all preliminary notes after the final report is issued

Question 7

An organization has implemented a host-based intrusion prevention system (HIPS) on all endpoints. An internal audit reveals that many incidents go undetected because users often disable HIPS when it interferes with applications. Which of the following is the MOST effective control to address this issue?

Accepted Answer

Implement application whitelisting to allow approved applications while HIPS monitors.. Application whitelisting addresses the root cause: users disable HIPS due to false positives or performance issues with legitimate applications. By allowing only approved applications to run, HIPS can monitor without interference, reducing the need for users to disable it. This control maintains endpoint security while ensuring business-critical applications operate smoothly.

Answer

Disable HIPS and rely solely on network-based intrusion detection.

Answer

Increase the sensitivity of HIPS signatures to detect more threats.

Answer

Remove the ability for users to disable HIPS.

Question 8

A financial institution is implementing a risk-based approach to prioritize its information security initiatives. The risk manager has completed a risk assessment and identified several risks with varying impact and likelihood. Which TWO of the following are the most important benefits of using the risk assessment results to determine the order of security projects?

Accepted Answer

Aligns security spending with business objectives. A risk-based approach ensures that security spending is directed toward mitigating the risks that most threaten the institution's critical business objectives, such as protecting customer financial data or ensuring transaction integrity. By prioritizing initiatives based on assessed risk levels, the organization directly links security investments to business value, avoiding waste on low-priority controls.

Answer

Eliminates the need for qualitative analysis

Answer

Ensures compliance with all applicable regulations

Answer

Reduces the total number of security controls needed

Question 9

An organization has a risk appetite that allows for a maximum residual risk level of 'medium' for all operational risks. A new project introduces a risk with inherent risk level 'high' and control effectiveness rated as 'partially effective'. The risk owner proposes to accept the risk. As the CISM, what is the best course of action?

Accepted Answer

Insist on additional controls to reduce residual risk to at least 'medium'.. The organization's risk appetite mandates that residual risk must be at 'medium' or lower. With an inherent risk of 'high' and controls rated 'partially effective', the residual risk remains above the acceptable threshold. Therefore, the best course is to insist on additional controls to bring residual risk down to at least 'medium', ensuring compliance with the risk appetite.

Answer

Accept the risk since the risk owner has agreed.

Answer

Transfer the risk to an insurance company.

Answer

Recommend revising the risk appetite to accommodate this risk.

Question 10

During an internal audit, it was found that the security policy does not address the use of personal devices for work. Which governance action should be taken first?

Accepted Answer

Develop a mobile device management policy and conduct a risk assessment. The first governance action should be to develop a mobile device management (MDM) policy and conduct a risk assessment because governance requires establishing a formal framework before implementing technical controls. Without a policy, any subsequent actions (like purchasing MDM software or training) lack a defined scope, risk appetite, and compliance baseline. The risk assessment identifies specific threats (e.g., data leakage via unmanaged devices, lack of encryption) and informs the policy's requirements, aligning with the CISM governance domain's emphasis on policy as the foundation for all security activities.

Answer

Train users on security awareness

Answer

Purchase MDM software

Answer

Immediately ban all personal devices

Question 11

A financial services company is updating its risk treatment plan for a high-risk legacy system that processes customer data. The risk owner has recommended acceptance of the risk. Which TWO conditions must be met for the risk acceptance to be valid according to ISACA CISM (Certified Information Security Manager) best practices?

Accepted Answer

The risk acceptance must be formally documented and signed off by the risk owner.. Risk acceptance requires formal documentation and approval by the risk owner (business owner). Periodic review is also necessary to ensure the risk remains acceptable. The board does not approve all accepted risks; only those exceeding certain thresholds. Controls should be documented but are not required if risk is accepted.

Answer

The risk acceptance must include a detailed plan to reduce the risk level within one year.

Answer

The risk acceptance must be approved by the board of directors.

Answer

The risk owner must agree to implement compensating controls within a defined timeline.

Question 12

Which TWO of the following are primary responsibilities of the board of directors with regard to information security governance? (Select exactly two.)

Accepted Answer

Ensuring security strategy aligns with business goals. The board of directors is responsible for ensuring that the information security strategy aligns with business goals, objectives, and regulatory requirements. This is a governance-level duty that sets the strategic direction and ensures security investments support the organization's mission, rather than being a tactical or operational task.

Answer

Performing vulnerability scans

Answer

Implementing security controls

Answer

Conducting daily security monitoring

Question 13

A CISO is planning the security programme budget and wants to justify the investment to the CFO. The organization has a moderate risk appetite and an IT budget of $10 million. What is the most appropriate budget range for the security programme based on industry benchmarks?

Accepted Answer

$1,000,000 to $1,500,000. For a mature security programme, industry benchmarks suggest 10-15% of IT budget. For a $10M IT budget, that is $1M to $1.5M. 0.2-0.5% of revenue is another benchmark but not directly applicable here without revenue data.

Answer

$500,000 to $1,000,000

Answer

$1,500,000 to $2,000,000

Answer

$200,000 to $500,000

Question 14

Refer to the exhibit. The security analyst observes these alerts. What is the MOST likely sequence of events?

Accepted Answer

Attacker compromised jsmith's credentials, established C2, and exfiltrated data. The correct sequence is that an attacker compromised jsmith's credentials, established command-and-control (C2) communication, and then exfiltrated data. The alerts show a brute-force or credential-stuffing attempt from an external IP (10.0.0.45) against jsmith's account, followed by an outbound C2 beacon (e.g., DNS or HTTP) from jsmith's workstation, and finally a large data transfer to an external destination. This matches the typical kill chain: initial access via compromised credentials, persistence via C2, and data exfiltration as the final objective.

Answer

Insider threat: jsmith intentionally exfiltrated data

Answer

Network scan from 10.0.0.45 triggered false positives

Answer

Malware downloaded on jsmith's workstation and exfiltrated data

Question 15

Which of the following incident categories would typically require the involvement of the crisis management team?

Accepted Answer

A P1 critical-severity ransomware attack encrypting critical systems.. A P1 critical-severity ransomware attack encrypting critical systems requires immediate activation of the crisis management team because it poses an existential threat to business operations, often involving legal, PR, executive, and regulatory stakeholders. The crisis management team handles incidents that exceed the capacity of the incident response team, typically those with high business impact, widespread system compromise, or potential for significant financial/reputational damage.

Answer

A P2 high-severity DDoS attack that has been mitigated within a few hours.

Answer

A P3 medium-severity insider threat involving unauthorized access to a non-critical system.

Answer

A P4 low-severity phishing email reported by a user.

Question 16

What is the primary purpose of having a pre-established forensic retainer agreement with an external forensics firm?

Accepted Answer

To reduce time to engage during an incident. The primary purpose of a pre-established forensic retainer agreement is to reduce the time to engage during an incident. By having a contract already in place, the organization can bypass procurement and legal review delays, enabling the forensics firm to begin work immediately when an incident occurs, which is critical for preserving volatile evidence and minimizing damage.

Answer

To ensure chain of custody

Answer

To reduce legal liability

Answer

To guarantee confidentiality

Question 17

An organization is updating its security policies. After drafting the policy, which step should occur NEXT?

Accepted Answer

Legal review. Legal review ensures the policy complies with applicable laws and regulations before seeking approval.

Answer

Stakeholder consultation

Answer

Training and awareness

Answer

Approval by management

Question 18

A financial institution has a mature incident response program. During a security incident, the incident response team identifies that a business-critical application is affected. The team must decide whether to continue containing the incident or allow limited operations to continue. Which factor should be given the HIGHEST priority?

Accepted Answer

Regulatory compliance and data protection.. In a mature incident response program, regulatory compliance and data protection take precedence because financial institutions are subject to strict data privacy laws (e.g., GDPR, PCI DSS, SOX) that mandate safeguarding sensitive data during an incident. Allowing limited operations could lead to unauthorized data exposure or breach of legal obligations, resulting in severe penalties and reputational damage that outweigh the benefits of continued uptime.

Answer

Maintaining customer trust.

Answer

Minimizing downtime of the application.

Answer

Preserving evidence for potential litigation.

Question 19

An organization is implementing a new cloud-based ERP system. Which of the following is the MOST important action for the information security manager to ensure alignment with the organization's risk appetite?

Accepted Answer

Conduct a risk assessment to identify and evaluate risks associated with the cloud deployment.. Conducting a risk assessment (A) is the most important action because it directly evaluates the cloud ERP deployment against the organization's risk appetite, identifying, analyzing, and evaluating risks such as data exposure, vendor lock-in, and compliance gaps. This foundational step ensures that subsequent controls, contracts, and policies are aligned with the acceptable level of risk, as defined by the organization's risk tolerance thresholds.

Answer

Review the cloud provider's SOC 2 report for compliance with relevant regulations.

Answer

Negotiate contract terms including data protection clauses with the cloud provider.

Answer

Develop a detailed access control policy specifically for the cloud ERP system.

Question 20

An organization has a high residual risk after implementing all feasible controls. According to CISM best practices, which of the following should the information security manager do? (Select TWO.)

Accepted Answer

Escalate to senior management for risk acceptance. When residual risk remains high after all feasible controls are implemented, the information security manager should escalate the risk to senior management for formal risk acceptance (Option A). This aligns with CISM best practices, as senior management holds the authority to accept risks that exceed the organization's risk appetite. Additionally, implementing compensating controls (Option C) can further reduce residual risk to an acceptable level, even if primary controls are already in place.

Answer

Document the risk in the risk register and accept it

Answer

Immediately perform a new risk assessment