CISM Practice Exam 53 — 20 Questions

Question 1

An organization's security budget is 8% of the IT budget. Industry benchmarks suggest 10-15% for mature programs. Which of the following should the CISO do FIRST to justify an increase?

Accepted Answer

Present a cost-benefit analysis showing breach avoidance value. Linking budget requests to specific risk reductions and potential breach costs provides a business case for investment.

Answer

Reduce other IT expenses to free up funds

Answer

Request additional budget for emerging threats

Answer

Highlight the percentage gap compared to peers

Question 2

Based on the incident response policy exhibit, which phase should include notifying external stakeholders such as law enforcement?

Accepted Answer

Post-Incident. B is correct because the post-incident phase is the appropriate time to notify external stakeholders such as law enforcement, as it occurs after containment and eradication are complete. During this phase, the incident is fully documented, evidence is preserved, and legal obligations (e.g., breach notification laws like GDPR Article 33 or HIPAA Breach Notification Rule) are fulfilled. Notifying law enforcement earlier could compromise forensic integrity or operational continuity, so it is deliberately deferred to the post-incident stage.

Answer

Recovery

Answer

Detection

Answer

Containment

Question 3

An organization's incident response team has completed the initial response to a ransomware incident. During the post-incident review, they identify that the detection was delayed because security logs from different systems were not correlated. The team wants to improve detection capabilities. What should the team recommend as the primary improvement?

Accepted Answer

Implement a Security Information and Event Management (SIEM) system. A SIEM system is the primary improvement because it aggregates and correlates security logs from diverse sources in real time, enabling automated detection of patterns like ransomware propagation that manual or siloed logging cannot achieve. By normalizing log formats and applying correlation rules, a SIEM reduces detection latency and provides actionable alerts, directly addressing the identified gap in log correlation.

Answer

Hire additional security analysts to manually correlate logs

Answer

Increase the amount of logging on all systems

Answer

Reduce log retention to lower storage costs

Question 4

An organization has a decentralized security governance model. The CISO is struggling to enforce consistent security policies across business units. What is the BEST approach to improve consistency?

Accepted Answer

Establish a central security governance committee with representation from each business unit.. In a decentralized governance model, the best approach to enforce consistent security policies without undermining business unit autonomy is to establish a central security governance committee with representation from each business unit. This federated approach ensures that policies are collaboratively developed, agreed upon, and uniformly applied, leveraging cross-unit input to balance security requirements with operational needs. It directly addresses the CISO's enforcement challenge by creating a formal, inclusive decision-making body that drives policy standardization.

Answer

Allow each business unit to define its own security policies.

Answer

Implement a federated model where business units have complete autonomy.

Answer

Mandate that all business units adopt the same security tools and processes.

Question 5

During an incident investigation, the incident response team needs to collect volatile data from a compromised server. Which of the following data should be collected FIRST?

Accepted Answer

Contents of system memory (RAM). Volatile data, such as the contents of system memory (RAM), is lost when the system is powered off. Collecting RAM first preserves evidence of running processes, network connections, and encryption keys that would otherwise be destroyed. This follows the order of volatility (RFC 3227), which mandates capturing the most volatile data first.

Answer

Network connection logs from the firewall

Answer

Contents of the hard drive

Answer

Event logs from the system

Question 6

A large financial institution is maturing its information security program and wants to move from a reactive to a proactive posture. Which of the following initiatives would best support this transition?

Accepted Answer

Establish a threat intelligence unit that analyzes adversary tactics and shares indicators across the organization.. Establishing a threat intelligence unit directly supports a proactive posture by enabling the organization to anticipate and prepare for emerging threats based on adversary tactics, techniques, and procedures (TTPs). Unlike reactive measures, this initiative shifts focus from responding to incidents to preventing them by sharing actionable indicators across the enterprise, aligning with the CISM goal of maturing the security program toward proactive risk management.

Answer

Deploy an automated compliance monitoring tool.

Answer

Implement a bug bounty program to uncover vulnerabilities.

Answer

Increase the number of security operations center (SOC) analysts.

Question 7

Which TWO of the following are primary objectives of information security governance? (Choose two.)

Accepted Answer

Align security strategy with business goals.. Information security governance's primary objective is to ensure that security strategy is aligned with business goals, enabling the organization to protect assets while supporting its mission. This alignment is achieved through governance frameworks like COBIT or ISO 38500, which mandate that security investments and controls are directly tied to business objectives, not isolated technical measures.

Answer

Eliminate all information security risks.

Answer

Maximize profitability through security investments.

Answer

Achieve compliance with all applicable regulations.

Question 8

Which of the following best describes the primary purpose of a security program's governance framework?

Accepted Answer

To provide oversight and alignment with business objectives. The primary purpose of a security program's governance framework is to provide oversight and ensure that security activities are aligned with business objectives, risk appetite, and regulatory requirements. It establishes the policies, roles, and accountability structures that guide decision-making, rather than directly executing technical tasks. This alignment is critical for the program to be sustainable and supported by executive management.

Answer

To implement technical security controls

Answer

To conduct vulnerability assessments

Answer

To manage security incidents

Question 9

A security awareness programme is being evaluated. Which metric BEST indicates a positive security culture?

Accepted Answer

Number of security incidents reported. The best metric for indicating a positive security culture is the number of security incidents reported. A high number of reported incidents demonstrates employee engagement, vigilance, and trust in the reporting process. This proactive behavior is a stronger indicator of a positive culture than metrics like phishing click rates, which primarily measure specific awareness effectiveness.

Answer

Number of policy violations

Answer

Percentage of employees who completed training

Answer

Phishing simulation click rate

Question 10

A multinational corporation is expanding its cloud infrastructure across multiple regions. The risk team has identified that the shared responsibility model for cloud security is not well understood by business units. After a recent audit, several misconfigurations led to a data exposure incident that affected one region. The CISO wants to implement a risk management program that ensures consistent control across all regions. As the risk manager, what is the most effective course of action to reduce the risk of similar incidents?

Accepted Answer

Develop and enforce cloud security baseline standards and conduct regular compliance audits.. Developing and enforcing cloud security baseline standards and conducting regular compliance audits directly address the root cause of misconfigurations due to lack of understanding. A CASB provides monitoring but does not enforce standards. Transferring risk to cloud providers shifts liability but does not prevent misconfigurations. Acceptance with focus on incident response is reactive and does not reduce likelihood.

Answer

Transfer the risk to cloud providers by renegotiating contracts to include liability clauses.

Answer

Implement a cloud access security broker (CASB) to monitor all cloud activities centrally.

Answer

Accept the risk as inherent to cloud adoption and focus resources on incident response.

Question 11

A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?

Accepted Answer

NIST Cybersecurity Framework. The NIST Cybersecurity Framework (CSF) is the most appropriate choice because it is designed to be flexible and scalable, allowing small businesses with limited budget and staff to implement a risk-based information security program using a prioritized, outcome-driven approach. Unlike ISO/IEC 27001, which requires formal certification and extensive documentation, or COBIT 2019, which is geared toward enterprise IT governance, the NIST CSF provides a customizable set of core functions (Identify, Protect, Detect, Respond, Recover) that can be adopted incrementally without heavy resource investment.

Answer

ISO/IEC 27001

Answer

COBIT 2019

Answer

PCI DSS

Question 12

A retail company's security governance includes a policy that all software must be approved by a security committee. This delays critical business applications. The CIO complains. How should the CISO adjust governance?

Accepted Answer

Implement a risk-based approval process with expedited paths. A risk-based approval process with expedited paths allows the security committee to focus on high-risk software while fast-tracking low-risk or critical business applications. This balances security governance with business agility, addressing the CIO's complaint without compromising security. It aligns with CISM's emphasis on aligning security with business objectives through risk management.

Answer

Increase committee meeting frequency

Answer

Remove the approval requirement

Answer

Automate software approval

Question 13

An organization's risk management policy requires a quantitative risk assessment for all new projects. The project team estimates that a data breach could occur once every 5 years with an average loss of $2 million. What is the annualized loss expectancy (ALE)?

Accepted Answer

$400,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, the ARO is 1/5 = 0.2 (one event every five years), and the SLE is $2,000,000. Thus, ALE = 0.2 × $2,000,000 = $400,000.

Answer

$10,000,000

Answer

$500,000

Answer

$2,000,000

Question 14

A security program manager is reviewing the results of a recent internal audit that identified several security gaps. The manager must prioritize remediation efforts. Which factor should be given the MOST weight?

Accepted Answer

Business impact of the vulnerability. In the context of information security program management, the primary driver for prioritizing remediation efforts is the business impact of the vulnerability. While likelihood, compensating controls, and cost are relevant factors, the CISM framework emphasizes that risk is ultimately a function of impact. A vulnerability with high business impact—such as one affecting a critical financial transaction system or protected health information (PHI)—demands immediate attention regardless of its exploitation likelihood, because the potential damage to revenue, compliance, and reputation is unacceptable.

Answer

Likelihood of exploitation

Answer

Availability of compensating controls

Answer

Cost of remediation

Question 15

A financial institution is developing an information security program based on the COBIT framework. The board has requested a balanced scorecard to communicate program effectiveness. Which of the following metric categories would best align with the 'Internal Processes' perspective?

Accepted Answer

Percentage of security incidents detected within defined SLAs. The 'Internal Processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of internal operational processes. The percentage of security incidents detected within defined SLAs directly measures the performance of the security monitoring and incident response processes, which are core internal processes in a COBIT-based information security program.

Answer

Cost of security incidents as a percentage of revenue

Answer

Number of security training hours per employee

Answer

Customer satisfaction survey scores on data protection

Question 16

Match each security control type to its example.

Accepted Answer

Preventive: Firewall. The correct matches are: Preventive controls prevent incidents (e.g., firewall), Detective controls identify incidents (e.g., IDS), Corrective controls fix issues (e.g., backup/restore), and Deterrent controls discourage attacks (e.g., warning signs). Options E and F are common confusions where definitions are swapped.

Answer

Preventive: Backup and restore

Answer

Detective: Firewall

Question 17

Which TWO of the following are primary objectives of a security awareness program?

Accepted Answer

Reduce the number of security incidents. A primary objective of a security awareness program is to reduce the number of security incidents by educating employees on threats like phishing, social engineering, and unsafe practices. By raising awareness, employees are less likely to fall for attacks that could lead to data breaches or malware infections, directly lowering incident frequency.

Answer

Improve password sharing practices

Answer

Increase the security budget

Answer

Ensure compliance with regulations

Question 18

A data breach has occurred exposing customer personal information. The risk manager needs to select a response to reduce the likelihood of similar incidents. Which risk response is most appropriate?

Accepted Answer

Mitigate the risk by implementing stronger access controls. Mitigating the risk by implementing stronger access controls directly addresses the root cause and reduces the likelihood of future breaches. Accepting the risk is inappropriate when a breach has already occurred. Transferring via insurance only covers financial loss but does not reduce likelihood. Avoiding by discontinuing online services is extreme and not immediately necessary.

Answer

Avoid the risk by discontinuing online services

Answer

Transfer the risk through cyber insurance

Answer

Accept the risk

Question 19

Which document should be created FIRST when establishing an information security program?

Accepted Answer

Information security policy. The information security policy is the foundational document that establishes management's intent, direction, and support for the security program. It defines the scope, objectives, and responsibilities, and all other security documents (risk assessments, incident response plans, BCPs) derive their authority and alignment from this policy. Without an approved policy, subsequent activities lack governance and executive backing.

Answer

Risk assessment report

Answer

Incident response plan

Answer

Business continuity plan

Question 20

After a data breach, the CISO is updating the incident response plan. Which of the following is MOST critical to include?

Accepted Answer

Communication templates for stakeholders. After a data breach, the incident response plan must prioritize clear, consistent communication to manage stakeholder expectations, regulatory notifications, and legal repercussions. Communication templates ensure that notifications to customers, regulators, and executives are accurate, timely, and compliant with breach notification laws (e.g., GDPR Article 33, state-specific 72-hour requirements). Without predefined templates, the response team risks delays or inconsistent messaging, which can exacerbate reputational damage and legal liability.

Answer

Technical forensic procedures

Answer

Root cause analysis methodology

Answer

Legal hold instructions for data preservation