CISM Practice Exam 52 — 20 Questions

Question 1

Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Accepted Answer

Enforcing least privilege access controls. Options A and B are correct. Enforcing least privilege access controls reduces the risk by limiting user permissions, and implementing intrusion detection systems mitigates risk by detecting and alerting on threats. Option C (discontinuing a high-risk business process) is risk avoidance, option D (purchasing cyber insurance) is risk transfer, and option E (accepting the risk in a formal statement) is risk acceptance.

Answer

Discontinuing a high-risk business process

Answer

Purchasing cyber insurance

Answer

Accepting the risk in a formal statement

Question 2

Which role is primarily responsible for developing and maintaining the organization's security architecture?

Accepted Answer

Security Architect. The security architect designs and oversees the implementation of security architecture.

Answer

Security Analyst

Answer

GRC Analyst

Answer

Penetration Tester

Question 3

Refer to the exhibit. During a ransomware incident, the response team discovers that the backup server is also encrypted. Which phase of the playbook is MOST impacted?

Accepted Answer

Phase 4: Recovery. The Recovery phase (Phase 4) is most impacted when the backup server is encrypted during a ransomware incident. Without clean, unencrypted backups, the organization cannot restore systems and data to a known good state, which is the primary goal of the Recovery phase. The encryption of backups directly undermines the ability to recover, forcing the team to consider alternative recovery methods such as decryption keys, offline backups, or system rebuilds.

Answer

Phase 5: Post-Incident

Answer

Phase 3: Eradication

Answer

Phase 2: Containment

Question 4

A security operations center analyst receives an alert from the SIEM indicating a possible data exfiltration. The analyst is unsure if it is a true positive. What is the MOST appropriate action?

Accepted Answer

Review additional logs to confirm. The analyst must first validate the alert by reviewing additional logs (e.g., firewall, proxy, DNS, or endpoint logs) to confirm whether the SIEM alert represents a true positive. Jumping to containment or escalation without confirmation risks unnecessary disruption and false alarms, which violates the incident response principle of 'verify before acting.' The SIEM may have triggered on a benign pattern (e.g., a large file transfer to a trusted cloud service), and only correlated log analysis can establish intent and context.

Answer

Escalate to the incident response manager

Answer

Immediately block the source IP

Answer

Quarantine the affected system

Question 5

Which of the following is an example of an external stakeholder that should be included in the incident response plan's vendor contacts list?

Accepted Answer

External legal counsel. Third-party contacts such as legal firms, forensic investigators, PR agencies, and insurance providers are essential for incident response. Internal contacts are separate.

Answer

Chief Information Security Officer

Answer

Incident response manager

Answer

Board of directors

Question 6

A security manager is evaluating OKRs for the vulnerability management team. Which key result best aligns with an objective to reduce risk from vulnerabilities?

Accepted Answer

Reduce mean time to remediate critical vulnerabilities by 30%. Mean time to remediate critical vulnerabilities directly measures risk reduction, as faster remediation lowers exposure.

Answer

Conduct quarterly penetration tests

Answer

Achieve 95% scan coverage of assets

Answer

Increase the number of scans by 20%

Question 7

During a security incident, the incident response team discovers that an attacker has exfiltrated data via an encrypted tunnel over HTTPS. Which log source is MOST likely to provide evidence of the exfiltration?

Accepted Answer

Proxy logs. Proxy logs are the most likely source because they can record the full URL and HTTP headers of HTTPS requests, including the destination host and path, even though the payload is encrypted. Since the attacker exfiltrated data over an encrypted tunnel, the proxy log can show the outbound connection to the command-and-control server or data storage endpoint, providing evidence of the exfiltration activity.

Answer

Web server access logs

Answer

Firewall logs

Answer

Intrusion detection system (IDS) logs

Question 8

A global e-commerce company is designing its information security program. The CISO wants to implement a defense-in-depth strategy for the web application layer. Which combination of controls best achieves this objective?

Accepted Answer

WAF, input validation, and security logging. Defense-in-depth at the web application layer requires overlapping controls: prevention (input validation), detection (WAF), and monitoring/response (security logging). Option A (SSL/TLS and VPN) provides encryption but does not prevent application-layer attacks. Option B (WAF and IDS) misses a preventive control like input validation. Option D (patching and scanning) addresses vulnerabilities but lacks real-time detection and response.

Answer

SSL/TLS encryption and VPN access

Answer

Web application firewall (WAF) and intrusion detection system (IDS)

Answer

Regular patching and vulnerability scanning

Question 9

A company's incident response team is handling a confirmed ransomware infection that has encrypted files on several servers. The IT director requests that the team immediately restore data from backups to minimize downtime. However, the team suspects that the backup repository may also be compromised because the attacker had administrative credentials. What is the BEST course of action?

Accepted Answer

Rebuild the servers from scratch and restore from an offline backup taken before the compromise.. Restoring from an offline backup taken before the compromise ensures that the restored data is free of the ransomware and that the backup itself was not encrypted or tampered with. Since the attacker had administrative credentials, any online backup repository could have been accessed and compromised, making offline backups the only trustworthy source. This approach also eliminates the risk of re-infection by rebuilding the servers from scratch, ensuring no residual malware remains.

Answer

Proceed with restoration from the most recent backup to restore operations quickly.

Answer

First, clean the backup repository and verify integrity before restoring to prevent re-infection.

Answer

Engage law enforcement before any restoration activities.

Question 10

Which TWO of the following are valid risk response options?

Accepted Answer

Risk mitigation. The correct answers are C (Risk mitigation) and D (Risk acceptance). These are two of the standard risk response options recognized in frameworks such as ISO 31000 and COBIT, alongside risk avoidance and risk transfer. Options A (Risk amplification) and B (Risk neutralization) are not standard risk response terms. Option E (Risk retention) is sometimes considered a form of risk acceptance, but it is not listed as a separate standard response option; the question specifically expects 'acceptance' and 'mitigation' as the correct choices.

Answer

Risk amplification

Answer

Risk neutralization

Answer

Risk retention

Question 11

An information security manager is developing a security scorecard for the board. Which combination of metrics BEST provides a balanced view of security program effectiveness?

Accepted Answer

Number of security incidents and percentage of systems with critical patches applied within SLA. Leading indicators (patch compliance) predict future performance, while lagging indicators (breach count) measure past outcomes. Both are needed for balance.

Answer

Percentage of employees who completed security awareness training and number of reported phishing emails

Answer

Number of security incidents and mean time to detect (MTTD)

Answer

Phishing click rate and percentage of systems with critical patches applied within SLA

Question 12

During a data breach investigation, the legal counsel advises the incident response team to ensure that communications with external forensic experts are protected by attorney-client privilege. Which action best preserves this privilege?

Accepted Answer

Engaging the forensic firm through legal counsel and ensuring that their work is done at the direction of legal. Engaging the forensic firm through legal counsel and having them work under the direction of legal helps protect communications under attorney-client privilege. Direct engagement by the business may waive privilege.

Answer

Using a pre-existing retainer agreement without legal involvement

Answer

Having the forensic firm report directly to the CISO

Answer

Having the forensic firm sign a non-disclosure agreement

Question 13

During a risk assessment, a security manager discovers that the residual risk after implementing planned controls is still above the risk appetite threshold. What should the manager do NEXT?

Accepted Answer

Escalate the residual risk to senior management. When residual risk exceeds the risk appetite threshold after planned controls, the security manager cannot simply accept or ignore it; the risk must be escalated to senior management because they hold the authority to decide whether to accept the risk, allocate additional budget for further controls, or adjust the risk appetite. This aligns with the CISM domain of Information Security Risk Management, where risk acceptance is a management decision, not an operational one.

Answer

Implement additional controls immediately

Answer

Document the risk as accepted

Answer

Reassess the risk using a different methodology

Question 14

A company's information security manager notices that several business units have implemented shadow IT systems that bypass the central security governance. Which of the following governance strategies would most effectively address this issue in the long term?

Accepted Answer

Establish a formal process for business units to request exceptions to the standard IT policy, with risk acceptance.. Establishing a formal exception process with risk acceptance allows business units to innovate while maintaining security governance. This approach addresses shadow IT by integrating it into formal oversight rather than punishing or ignoring it. Option A is incorrect because penalizing non-compliant units may drive shadow IT further underground, reducing visibility. Option B is incorrect because deploying a CASB is a technical control that helps discover and manage shadow IT, but it does not address the root governance issue of why business units bypass central IT. Option C is incorrect because a strict prohibition policy is difficult to enforce and may hinder business agility, leading to further shadow IT.

Answer

Conduct periodic audits to discover shadow IT and penalize non-compliant units.

Answer

Deploy a cloud access security broker (CASB) to discover and integrate shadow IT into the infrastructure.

Answer

Enforce a strict policy that prohibits any IT system without prior security approval.

Question 15

Match each information security program component with its correct description.

Answer

Recommended practice or advisory action

Answer

High-level statement of management intent

Answer

Detailed step-by-step instructions

Answer

Mandatory requirement to support policy

Question 16

A large e-commerce company detects a sophisticated attack that has compromised a web application server. The server contains customer payment card information. The incident response team is activated. During triage, the team discovers that the attacker has gained administrative access and installed a backdoor. The company's public relations department wants to issue a press release as soon as possible to maintain customer trust. Legal counsel advises that the breach must be reported to regulators within 72 hours. The technical team is working on containment. What is the MOST important priority for the incident manager at this point?

Accepted Answer

Focus on containing the breach and eradicating the threat before any disclosure.. The primary responsibility of the incident manager during an active breach is to contain the threat and prevent further damage. While forensic investigation (Option A) is important, it can be conducted after containment. Reporting to regulators (Option B) must occur within 72 hours, but containment takes precedence to prevent additional data loss. Authorizing a press release (Option D) could compromise containment efforts and legal strategy. Therefore, focusing on containment and eradication (Option C) is the most important priority.

Answer

Conduct a thorough forensic investigation to determine the full extent of the breach before taking action.

Answer

Immediately report the breach to regulators to comply with the 72-hour requirement.

Answer

Authorize the press release to manage public perception.

Question 17

You are the information security program manager for a government agency. The agency has a highly regulated environment and is in the process of updating its incident response plan. During a tabletop exercise, it becomes clear that the detection capabilities are strong, but the response coordination between IT, legal, and public affairs is poor. This caused delays in containing a simulated ransomware attack. The existing program includes an incident response policy but no formal procedures for cross-department coordination. The agency's leadership wants quick improvement with minimal budget impact. What should you recommend?

Accepted Answer

Develop a detailed incident response coordination plan with defined roles and communication channels, and conduct quarterly joint exercises.. Correct answer is D because developing a detailed incident response coordination plan with defined roles and communication channels, and conducting quarterly joint exercises, directly addresses the coordination gap at low cost. Option A (outsourcing) is expensive and may not align with government requirements. Option B (dedicated team) could be costly and does not leverage existing staff. Option C (new SIEM) does not fix coordination.

Answer

Outsource incident response to a managed security service provider (MSSP).

Answer

Create a dedicated incident response team that reports directly to the CISO.

Answer

Purchase a new SIEM solution to improve detection accuracy.

Question 18

You are the CISO of a retail company that is planning to implement a new e-commerce platform. The information security program currently consists of a set of high-level policies, but there are no detailed standards or guidelines for secure development. The development team uses agile methodologies and is accustomed to rapid releases. They have resisted security reviews in the past, citing delays. You need to integrate security into the development lifecycle without causing friction. The company's risk appetite is moderate; they accept some risk for speed but not if it leads to major breaches. The board expects you to manage this risk effectively. Which approach should you take?

Accepted Answer

Assign a security champion to each development team and create a lightweight secure coding checklist.. Assigning a security champion to each team and creating a lightweight secure coding checklist integrates security into the agile development process without causing significant friction. Security champions provide ongoing guidance and can help enforce secure coding practices in real-time, which aligns with the rapid release cycles. Option A (annual training) is insufficient to change behavior and does not provide continuous oversight. Option C (separate security team review after development) introduces delays and friction, as developers have already completed their work. Option D (mandatory security gate before release) can cause bottlenecks and resentment, likely being bypassed or causing slowdowns that the company wants to avoid.

Answer

Provide annual security training to all developers.

Answer

Establish a separate security team that reviews all code after development is complete.

Answer

Implement a mandatory security gate before each release, requiring a full security review.

Question 19

A mature security program allocates 12% of IT budget to security. Which combination of budget components is most balanced for a program seeking to improve detection and response capabilities?

Accepted Answer

Personnel 40%, Technology 30%, Services 20%, Training 10%. For improving detection and response, investment in technology (SIEM, SOAR) and personnel (SOC analysts) is most critical, with services for assessments and training for skills.

Answer

Personnel 20%, Technology 50%, Services 20%, Training 10%

Answer

Personnel 50%, Technology 20%, Services 20%, Training 10%

Answer

Personnel 30%, Technology 30%, Services 30%, Training 10%

Question 20

Which of the following are key components of an Information Security Risk Management program? (Select TWO.)

Accepted Answer

Establishing a risk management framework. A is correct because establishing a risk management framework is the foundational component of an Information Security Risk Management program. It defines the policies, procedures, and governance structure for identifying, assessing, and treating risks, aligning with standards like ISO 31000 or NIST SP 800-39. Without a framework, risk management activities lack consistency and accountability.

Answer

Conducting vulnerability scanning

Answer

Performing internal audits