CISM Practice Exam 53 — 20 Questions

Question 1

An organization has just experienced a malware outbreak that was contained by isolating affected endpoints. Before restoring the isolated systems to normal operation, the incident response team must decide what activity comes next in the response lifecycle. Which of the following should the team perform NEXT?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Eradicate the malware and remediate the root cause on affected systems before returning them to production.. The incident response lifecycle moves from preparation to detection and analysis, containment, eradication, recovery, and post-incident activity. Once containment has stopped the spread, the team must eradicate the malware and remediate the root cause before systems are returned to production. Recovery without eradication invites reinfection, while review and notification are either parallel obligations or later-phase activities. Eradication is the logical next technical step.

Answer

Conduct a full lessons-learned review and close the incident as resolved.

Answer

Begin recovery by reconnecting all isolated endpoints to the production network immediately.

Answer

Notify external regulators and law enforcement before any technical remediation is attempted.

Question 2

An organization is conducting a post-incident review after a major phishing-driven breach. The CISO wants to ensure that lessons learned are captured and translated into measurable improvements. Which TWO of the following activities are MOST important to achieve this objective? (Choose two.)

Accepted Answer

Assigning corrective actions with owners and due dates based on identified gaps.. Translating lessons learned into improvement requires both documentation and accountability. A formal after-action report records root cause, timeline, and response effectiveness, while assigning corrective actions with owners and due dates ensures findings are acted upon and tracked. Together they create a measurable, repeatable improvement cycle. Punitive measures, evidence deletion, or untargeted budget increases do not achieve this objective.

Answer

Disciplining all employees who clicked the phishing link to reinforce security awareness.

Answer

Increasing the security budget for the next fiscal year without linking it to specific findings.

Answer

Immediately deleting all affected mailboxes to remove any remaining malicious content.

Question 3

During a live intrusion, the incident response lead must decide how the team will communicate. The attackers are believed to be monitoring the corporate email and collaboration platform. Which of the following is the MOST appropriate action to maintain confidentiality of incident communications?

Accepted Answer

Move coordination to an out-of-band channel that was established and tested before the incident.. When the adversary is positioned to observe the organization's normal communication paths, coordination must shift to a channel the adversary cannot reach. An out-of-band method that was designed, provisioned, and exercised before the incident provides that assurance, keeping containment strategy, evidence handling, and executive decisions confidential while normal platforms are treated as untrusted.

Answer

Continue using the existing collaboration platform but add a second factor to all responder accounts.

Answer

Restrict incident discussions to a distribution list limited to the core response team.

Answer

Encrypt all incident-related email with the organization's standard message encryption gateway.

Question 4

A software development company is maturing its information security program. The CISO wants to integrate security into the software development lifecycle (SDLC) to reduce vulnerabilities in production. Which of the following is the MOST effective way to achieve this integration?

Accepted Answer

Implementing a secure coding training program for developers and integrating security gates into the CI/CD pipeline.. The correct answer is implementing a secure coding training program for developers and integrating security gates into the CI/CD pipeline. This approach proactively builds security into the development process, reducing vulnerabilities at the source. Training equips developers to write secure code, and automated gates enforce security checks early and consistently. Together, they embed security into the SDLC effectively.

Answer

Outsourcing all security testing to a third-party vendor.

Answer

Requiring developers to sign a security policy acknowledging their responsibilities.

Answer

Conducting a penetration test after each major release.

Question 5

A financial services firm is aligning its information security programme with the organisation's enterprise risk management framework. The CISO must ensure security risk is expressed and escalated consistently with other business risks. Which action BEST achieves this alignment?

Accepted Answer

Report security risk using the same likelihood and impact scales, risk appetite statements and escalation thresholds used by the enterprise risk function.. Aligning security risk with enterprise risk management means the same scales, appetite statements and escalation thresholds are used, so security risk can be aggregated and compared with other risk types. A separate technical register, transferred ownership or a security-only methodology all leave security risk expressed differently from the rest of the enterprise, defeating the purpose of alignment.

Answer

Maintain a separate security risk register scored on a technical severity scale, and provide the enterprise risk function with a monthly extract of open findings.

Answer

Transfer responsibility for scoring and owning security risks to the enterprise risk management team so that a single team manages all risk registers.

Answer

Adopt the ISO/IEC 27005 risk assessment methodology and require all business units to complete annual security risk assessments using its process.

Question 6

A healthcare organization's information security program has a risk register with several high-risk items. The CISO is allocating budget for risk treatment. Which of the following is the MOST important factor when deciding whether to mitigate, transfer, or accept a risk?

Accepted Answer

The organization's risk appetite and tolerance levels.. The organization's risk appetite and tolerance levels are the most important factor because they establish the boundaries for acceptable risk. They guide whether to mitigate, transfer, or accept a risk, ensuring that decisions align with business strategy. Other factors like cost, likelihood, and regulations inform the decision but do not override the fundamental risk appetite.

Answer

Regulatory requirements for the specific risk.

Answer

The cost of the control versus the potential financial impact of the risk.

Answer

The likelihood and impact ratings from the risk assessment.

Question 7

An organization has just completed its response to a significant security incident. The information security manager is preparing the post-incident review and wants to ensure the effort produces lasting improvement rather than a one-time report. Which of the following activities is MOST important to include in the post-incident review?

Accepted Answer

Documenting lessons learned and assigning owners and due dates for corrective actions. The purpose of a post-incident review is continuous improvement, which requires converting observations into tracked corrective actions with accountable owners and deadlines. Distributing technical details, calculating cost, or archiving artifacts may support governance or records management, but none of them ensures the identified weaknesses are actually fixed, so they do not deliver the lasting improvement the manager seeks.

Answer

Distributing a detailed technical timeline of the attacker's activity to all employees

Answer

Calculating the total cost of the incident to present to the board of directors

Answer

Archiving all incident artifacts and closing the case file in the ticketing system

Question 8

A security manager is drafting the escalation criteria for the incident response plan. The organisation wants to ensure that incidents are escalated to the crisis management team (CMT) appropriately. Which of the following is the BEST basis for defining when an incident should be escalated to the CMT?

Accepted Answer

The incident has the potential to cause significant business, financial, legal, or reputational impact.. Escalation to the crisis management team should be driven by the potential business consequences of an incident. Criteria based on financial, legal, regulatory, or reputational impact ensure that enterprise-level events receive executive coordination while routine technical incidents remain with the incident response team. Detection timing, system count, and reporting source are technical or circumstantial factors that do not reliably indicate crisis-level impact and can cause inappropriate escalation decisions.

Answer

The incident was reported by an external party such as a customer or partner.

Answer

The incident involves more than one server or endpoint in the environment.

Answer

The incident was detected outside normal business hours or on a weekend.

Question 9

An organization has just contained a malware outbreak on several servers. The incident response manager must decide which activities belong in the eradication phase before restoration begins. Which TWO of the following activities are part of eradication? (Choose two.)

Accepted Answer

Removing the malicious binaries and persistence mechanisms from all affected hosts.. Eradication removes the adversary's artifacts and the conditions that enabled the compromise. Deleting malicious code and persistence satisfies the first, while patching the exploited flaw and resetting exposed credentials satisfies the second. Containment, root-cause identification, and restoration are separate phases, and completing eradication fully before restoration is what prevents the same incident from recurring.

Answer

Isolating the affected network segment to prevent the malware from spreading further.

Answer

Restoring affected servers from known-good backups and reconnecting them to production.

Answer

Identifying the vulnerability or misconfiguration that allowed the initial compromise.

Question 10

An information security manager is building the organization's incident response capability and wants to ensure the team can effectively detect, analyze, and respond to incidents. Which TWO of the following are essential elements that should be established before an incident occurs? (Choose two.)

Accepted Answer

Documented roles, responsibilities, and contact details for the response team and key internal stakeholders. Effective incident response depends on shared severity definitions and clearly assigned roles with current contacts, because these determine how quickly and consistently the organization triages, escalates, and coordinates. A vulnerability inventory supports prevention rather than response, while assuming incidents stay technical and publishing vendor lists for marketing do not strengthen the capability and can even increase exposure.

Answer

A complete inventory of every software vulnerability present across the enterprise

Answer

A guarantee that no incident will escalate beyond the technical response team

Answer

A published list of the organization's security tool vendors for marketing purposes

Question 11

A CISO is establishing an information security governance framework to ensure that security activities are aligned with business strategy. The organization has multiple business units, each with its own IT and security staff. Which of the following is the MOST effective way to ensure ongoing alignment?

Accepted Answer

Create a security steering committee composed of business unit leaders and the CISO.. A security steering committee that includes business unit leaders and the CISO provides a governance structure where security decisions are made collaboratively and aligned with business strategy. It ensures that security is not an isolated IT function but an integral part of business operations, enabling continuous alignment and effective risk management.

Answer

Conduct an annual penetration test to identify and prioritize vulnerabilities.

Answer

Delegate all security decisions to the IT department to ensure technical consistency.

Answer

Implement a monthly security awareness training program for all employees.

Question 12

An organization's incident response plan defines communication procedures, but during a recent incident, customers learned about a data breach from media reports before receiving any notification from the company. The information security manager has been asked to address this gap. Which of the following is the MOST effective improvement?

Accepted Answer

Pre-drafting notification templates and defining approval workflows with legal, communications, and executive stakeholders. When customers learn of a breach from media before official notice, the root cause is usually slow or undefined notification workflow. Pre-drafted templates plus agreed approval paths among legal, communications, and executives compress the time from confirmation to notification, ensuring the organization controls the narrative and meets regulatory deadlines. The other options either target unrelated risks or only partially address the coordination gap.

Answer

Requiring all employees to sign an updated nondisclosure agreement covering incident details

Answer

Publishing the full incident response plan on the corporate website to demonstrate transparency

Answer

Adding a public relations representative to the technical incident response team

Question 13

An organization operates in multiple jurisdictions and suffers a breach involving personal data of customers in several countries. The incident response manager must coordinate communication with regulators, customers, and internal stakeholders while the technical investigation continues. Which of the following is the MOST important consideration when developing the incident communication strategy?

Accepted Answer

Ensure all external communications are approved through legal counsel and aligned with applicable regulatory notification requirements and deadlines.. Multi-jurisdiction breaches trigger overlapping notification laws with different deadlines and content rules, so external communications must be reviewed by legal counsel and mapped to each applicable requirement. This ensures deadlines are met, statements are consistent, and privileges or ongoing investigations are not compromised. Timely, accurate, and compliant communication protects the organization legally and preserves stakeholder trust while the technical investigation proceeds in parallel.

Answer

Release detailed technical findings immediately to all customers so they can assess their own risk without delay.

Answer

Delay all notifications until the forensic investigation is fully complete to ensure accuracy in every statement.

Answer

Allow each regional business unit to communicate independently using its own messaging and timing without central coordination.

Question 14

A multinational corporation has a decentralized information security program. Each business unit has its own security team and budget. The CISO wants to improve consistency and reduce duplication of efforts. Which of the following is the MOST effective approach?

Accepted Answer

Establish a security governance framework with common policies, standards, and a steering committee.. Establishing a security governance framework with common policies, standards, and a steering committee is the most effective approach. It provides centralized direction while allowing business units to adapt to local needs, reducing duplication and improving consistency. This balances control with flexibility, which is essential for a multinational organization.

Answer

Outsource all security operations to a managed security service provider (MSSP).

Answer

Centralize all security functions under the CISO to ensure uniform control.

Answer

Mandate that each business unit follows the same security tools and technologies.

Question 15

A newly appointed CISO at a mid-sized financial firm discovers that the information security programme has been operating without a formally approved charter. Business units frequently bypass security review, and the security team lacks authority to enforce policy. Which action should the CISO take FIRST to establish the programme's foundation?

Accepted Answer

Obtain executive and board approval for a formal information security charter that defines scope, authority, and accountability.. Establishing a formal, executive-approved charter gives the information security programme its mandate, scope, and enforcement authority. In this scenario, business units ignore the security team because it lacks organizational legitimacy, not because controls or policies are missing. A charter is the foundational governance artifact from which policy, risk assessment, and control deployment derive their authority.

Answer

Deploy an automated compliance scanning tool across all business units to identify policy deviations.

Answer

Develop a comprehensive set of security policies and distribute them to all department heads for immediate adoption.

Answer

Conduct a full risk assessment of all critical business systems to quantify the current risk exposure.

Question 16

A security manager is drafting the information security strategy for a multinational retailer. Executive leadership has asked how the strategy should be structured to remain aligned with business objectives over the next three years. Which approach BEST addresses this request?

Accepted Answer

Derive the security strategy from the organization's business strategy and refresh it through an annual governance review tied to business planning.. Strategy alignment means the security programme exists to enable business objectives, so the strategy must be derived from the business strategy and revisited on the same planning cadence. Governance review tied to business planning keeps risk appetite, funding, and priorities synchronized. Technical artefacts such as penetration tests or competitor frameworks inform tactics but cannot define strategic direction for the organization.

Answer

Base the strategy on the most recent penetration test findings and reissue it whenever a critical vulnerability is discovered.

Answer

Let the IT steering committee define the strategy and forward it to the CISO for technical review before board approval.

Answer

Adopt the security framework used by the largest competitor and implement its controls in the same sequence.

Question 17

An organization's information security program is being developed. The CISO needs to ensure that the program's objectives are aligned with the organization's strategic goals. Which of the following is the BEST source of input for defining the security program's objectives?

Accepted Answer

The organization's business strategy and objectives.. The organization's business strategy and objectives are the best source of input. The security program must be aligned with the business to ensure it supports and enables the achievement of strategic goals. This alignment ensures that security investments are justified and prioritized based on business risk and value.

Answer

The results of the most recent vulnerability assessment.

Answer

Regulatory compliance requirements applicable to the industry.

Answer

Industry best practices and standards such as ISO 27001.

Question 18

A global insurer completes an annual enterprise risk assessment and reports its top information security risk as a residual risk score of 16 (5x3 on a 5x5 matrix) after applying a data loss prevention solution and security awareness training. The board has stated that any residual risk above 12 must be escalated for a formal risk treatment decision. The CISO is asked to present options at the next risk committee meeting. Which of the following is the MOST appropriate action for the CISO to take FIRST?

Accepted Answer

Present the residual risk to the risk committee with documented treatment options, including additional controls, risk transfer, or risk avoidance, and their associated costs and impacts.. Because the residual risk exceeds the board-defined threshold of 12, the CISO must escalate it to the risk committee for a formal treatment decision. The most appropriate first action is to present the risk along with viable treatment options, costs, and business impacts so the committee can make an informed choice. This respects governance, ensures accountability, and provides the decision-makers with the information they need.

Answer

Escalate the residual risk to the risk committee with a recommendation to accept the risk because the existing controls already reduce it below the original inherent score.

Answer

Initiate a new risk assessment to recalculate the inherent risk score, because the residual score may be inaccurate due to control effectiveness assumptions.

Answer

Implement additional technical controls immediately to reduce the residual risk below 12, then inform the risk committee of the change at the next quarterly meeting.

Question 19

A security operations center (SOC) analyst receives an alert about anomalous outbound traffic from a database server to an unfamiliar external IP address. The analyst confirms the traffic is not authorized and suspects data exfiltration. According to CISM incident management principles, which of the following should the analyst do FIRST?

Accepted Answer

Escalate the incident according to the incident response plan and begin documenting actions.. The analyst should escalate according to the incident response plan and begin documenting actions. This ensures proper authorization, coordination, and evidence handling before containment or notification. Premature blocking, shutdown, or external notification can tip off attackers, destroy evidence, or create legal and reputational risk. Following the plan supports a measured, defensible response aligned with CISM incident management principles.

Answer

Notify law enforcement and the media before performing any internal investigation.

Answer

Block the external IP address at the firewall to stop the exfiltration immediately.

Answer

Immediately take the database server offline to prevent further data loss.

Question 20

A CISO is designing the security programme's organisational structure for a multinational manufacturer. The CISO wants to ensure the structure supports both central governance and responsiveness to regional regulatory requirements. Which TWO structural elements BEST support these goals? (Choose two.)

Accepted Answer

A central security governance function that sets policy, standards and the risk assessment methodology used worldwide.. A federated model works best here: central governance sets consistent policy, standards and methodology, while regional security officers within the security reporting line adapt implementation to local regulation and feed requirements back. This balances enterprise consistency with local responsiveness. Full delegation, complete outsourcing or fully independent country teams each break either central accountability or local regulatory fit.

Answer

Outsourcing the entire security function to a managed security service provider so that regional staffing costs are eliminated.

Answer

Delegating all security decision-making to regional business unit leaders so that each can respond quickly to local market conditions.

Answer

Creating a separate security team in every country, each reporting to that country's general manager with no common standards.