CISM Practice Exam 54 — 20 Questions

Question 1

A security program manager is selecting metrics to report to the board. Which THREE metrics provide the BEST indication of the program's effectiveness?

Accepted Answer

Percentage of systems compliant with baseline. Percentage of systems compliant with baseline (Option C) directly measures the organization's adherence to security configuration standards, which is a leading indicator of control effectiveness. A high compliance rate reduces the attack surface and demonstrates that foundational security controls are properly implemented, making it a key metric for board-level reporting on program success.

Answer

Number of security incidents

Answer

Budget spent on security tools

Question 2

Which of the following is the PRIMARY purpose of a security program's key performance indicators (KPIs)?

Accepted Answer

To measure the effectiveness of security controls. KPIs are designed to provide measurable evidence of how well the security program is achieving its objectives, specifically by quantifying the effectiveness of security controls. For example, a KPI like 'mean time to detect (MTTD)' directly measures the performance of detection controls, enabling data-driven decisions on control improvements. This aligns with the CISM focus on governance and performance management, not just compliance or budgeting.

Answer

To ensure compliance with regulations

Answer

To assign accountability to individuals

Answer

To track the budget for security initiatives

Question 3

During a security audit, several deviations from policy are found. What should the security manager do first?

Accepted Answer

Investigate the root cause of the deviations. The security manager must first investigate the root cause of the deviations to understand why the policy was not followed. This aligns with the corrective action phase of the incident response lifecycle, where identifying the underlying issue (e.g., misconfigured access controls, lack of awareness, or technical gaps) is essential before implementing any remediation. Without root cause analysis, subsequent actions like policy updates or disciplinary measures may address symptoms rather than the actual problem, leading to recurring non-compliance.

Answer

Accept the risk and move on

Answer

Update the policies immediately

Answer

Take disciplinary action against responsible employees

Question 4

Based on the exhibit, what is the most significant security gap in this configuration?

Accepted Answer

The intrusion detection system is set to alert-only, so it cannot block attacks.. The intrusion detection system (IDS) is configured in alert-only mode, meaning it can only generate alerts and cannot take action to block or drop malicious traffic. This is a significant security gap because, unlike an intrusion prevention system (IPS), an IDS operates out-of-band and relies on manual intervention or separate security controls to stop attacks, leaving the network vulnerable during the response delay.

Answer

The vendor baseline is CIS Level 1, which may be too permissive.

Answer

The firewall allows inbound HTTPS from any source to web servers.

Answer

The database port 3306 is exposed to web servers without encryption.

Question 5

An incident response plan (IRP) is being tested. Which metric is MOST indicative of the team's effectiveness during an exercise?

Accepted Answer

Mean time to detect (MTTD). Mean time to detect (MTTD) is the most indicative metric of team effectiveness during an IRP exercise because it directly measures how quickly the team identifies a security incident. A lower MTTD reflects faster detection, which is critical for minimizing dwell time and limiting attacker impact. In contrast, cost, tool count, or log volume do not measure detection speed or response quality.

Answer

Total cost of the exercise

Answer

Number of tools used

Answer

Volume of logs generated

Question 6

During a P1 incident, the crisis management team (CMT) has been activated. The CEO asks for an hourly sitrep. Which of the following is the MOST appropriate content for the sitrep?

Accepted Answer

Current status of containment, confirmed facts, and actions taken, with legal counsel input.. During a P1 incident, the CEO requires a concise, actionable sitrep focused on containment status, confirmed facts, and actions taken. Legal counsel input is critical to avoid premature attribution or disclosure that could create liability or violate data breach notification laws. This aligns with the CISM incident management principle of providing decision-ready information to executive leadership without technical clutter.

Answer

A detailed technical analysis of the attack vector and exploited vulnerabilities.

Answer

Names of individuals potentially responsible for the incident.

Answer

Estimated financial impact and potential regulatory penalties.

Question 7

A company is restructuring its security governance due to rapid growth. The CISO reports to the CIO. What is the PRIMARY risk of this reporting structure?

Accepted Answer

Security objectives may be overridden by IT operational goals. When the CISO reports to the CIO, security objectives are subordinate to IT operational goals. The CIO's primary mandate is system availability, performance, and cost efficiency, which can lead to security controls being deprioritized or bypassed to meet IT project deadlines. This structural conflict is the primary risk because it directly undermines the independence required for effective security governance.

Answer

Compliance with regulations may become difficult

Answer

The security budget may be insufficient

Answer

Cooperation between IT and security may decrease

Question 8

A security manager is conducting a risk assessment for a new cloud-based system. The system will store sensitive customer data. Which of the following should be the FIRST step in the risk assessment process?

Accepted Answer

Identify and classify information assets. In the risk assessment process, the first step is to identify and classify information assets because you cannot assess risks to assets you haven't identified. For a cloud-based system storing sensitive customer data, this means cataloging data types (e.g., PII, financial records), their locations (e.g., specific cloud storage buckets), and their classification levels (e.g., confidential, restricted) before any threat or vulnerability analysis can be meaningfully performed.

Answer

Select appropriate security controls

Answer

Conduct vulnerability scanning

Answer

Identify potential threat sources

Question 9

An organization calculates that the single loss expectancy (SLE) for a server failure is $10,000, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

Accepted Answer

$5,000. The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $10,000 and an ARO of 0.5, the ALE is $10,000 × 0.5 = $5,000. This represents the expected annual financial loss from server failures based on the frequency and impact of such events.

Answer

$10,000

Answer

$20,000

Answer

$2,500

Question 10

An incident response team is dealing with a persistent threat that uses fileless malware. Which containment strategy is most effective?

Accepted Answer

Isolate affected endpoints from the network while preserving memory. Isolating affected endpoints preserves volatile memory evidence needed to analyze fileless malware.

Answer

Disable user accounts

Answer

Block known malicious IPs

Answer

Reimage all endpoints

Question 11

A multinational organization needs to comply with GDPR and CCPA. What is the best approach for the information security program?

Accepted Answer

Implement a unified privacy framework covering all regulations. A unified privacy framework (e.g., ISO/IEC 27701 or NIST Privacy Framework) allows the organization to map overlapping requirements from GDPR and CCPA into a single set of controls, reducing duplication and ensuring consistent data protection across jurisdictions. This approach leverages common principles like data minimization, consent management, and breach notification, which are foundational to both regulations, while accommodating specific differences such as GDPR's 72-hour breach notification versus CCPA's broader definition of personal information.

Answer

Adopt the most restrictive requirements from any regulation

Answer

Outsource compliance to a third-party provider

Answer

Create separate security programs for each region

Question 12

Which of the following is the PRIMARY responsibility of a steering committee in an information security program?

Accepted Answer

Providing strategic direction and oversight. The steering committee's primary role is to provide strategic direction and oversight for the information security program, ensuring alignment with business objectives and risk appetite. This includes approving the overall security strategy, budget, and major initiatives, rather than engaging in operational tasks like policy drafting or technical assessments.

Answer

Approving individual security policies

Answer

Conducting vulnerability assessments

Answer

Implementing security controls

Question 13

A security manager is selecting a controls framework for a new organization. Which framework provides the most granular control families and is widely used for US federal agencies?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is a comprehensive catalog of controls organized into families, commonly used by US federal agencies and many private organizations.

Answer

CIS Controls v8

Answer

ISO 27001 Annex A

Answer

COBIT 2019

Question 14

An organization's incident response plan includes a ransomware playbook. After detecting ransomware on a critical server, which of the following should be the FIRST action according to best practices?

Accepted Answer

Disconnect the server from the network and isolate it.. The immediate priority in ransomware containment is to prevent lateral movement and further encryption of systems. Disconnecting the server from the network (e.g., unplugging the Ethernet cable or disabling the virtual switch port) stops the ransomware from communicating with its command-and-control (C2) server and encrypting additional network shares. This aligns with the NIST SP 800-61 incident response containment strategy, which emphasizes isolation before any other action.

Answer

Notify the CEO and legal counsel before taking any action.

Answer

Pay the ransom immediately to regain access.

Answer

Immediately reboot the server to remove the ransomware.

Question 15

After a merger, two companies with different security cultures are being integrated. What is the BEST approach for the information security manager to achieve a unified governance structure?

Accepted Answer

Develop a new framework incorporating strengths from both companies. Merging two distinct security cultures requires a deliberate, collaborative approach that leverages the best practices from both organizations. Developing a new framework that incorporates strengths from both companies ensures buy-in from stakeholders and creates a unified governance structure that is tailored to the combined entity's risk profile, rather than imposing one side's culture or waiting for an uncertain natural convergence.

Answer

Implement a regulatory framework as the baseline

Answer

Maintain separate frameworks until a natural convergence occurs

Answer

Adopt the security framework of the acquiring company

Question 16

Which TWO of the following are examples of key risk indicators (KRIs) for cybersecurity risk?

Accepted Answer

Time to patch critical vulnerabilities. The time to patch critical vulnerabilities directly measures the organization's exposure window to known exploits, which is a leading indicator of cybersecurity risk. A longer patch time increases the likelihood of a successful attack, making it a key risk indicator (KRI) for vulnerability management.

Answer

Number of successful phishing simulations

Answer

Number of vendors with SOC 2 reports

Answer

Percentage of employees completing security training

Question 17

Based on the exhibit, what is the PRIMARY risk of the automated response policy as configured?

Accepted Answer

Automatic approval may cause unnecessary disruption on false positives. An automated response policy that approves blocking actions without human validation can trigger unnecessary disruption when false positives occur. Even if the severity threshold is appropriate, the lack of a verification step means legitimate traffic may be blocked, impacting business operations. The primary risk is not the effectiveness of the block but the operational impact of automated decisions on benign events.

Answer

Blocking the IP may be ineffective against dynamic IPs

Answer

The SOC manager may not receive notifications in time

Answer

The trigger severity is too low

Question 18

Which of the following best describes the role of a security architect in a security program?

Accepted Answer

Designs security controls and integrates them into IT systems. The security architect designs and oversees the implementation of security solutions and ensures they align with the overall architecture.

Answer

Performs penetration testing to identify vulnerabilities

Answer

Develops and delivers security awareness training

Answer

Monitors security alerts and responds to incidents

Question 19

Refer to the exhibit. A security analyst reviews the ACL on the organization's border router. Based on the exhibit, which of the following is the MOST significant governance concern?

Accepted Answer

The ACL does not include filtering for outbound traffic, which may allow spoofed internal IPs to exit the network.. The ACL shown only filters inbound traffic on the border router's external interface. Without an outbound ACL (or an inbound ACL on the internal interface), spoofed packets with internal source IP addresses can exit the network, enabling IP spoofing attacks that bypass anti-spoofing best practices (RFC 2827, BCP 38). This is a governance concern as it violates the principle of preventing source address spoofing, which is a fundamental security control for network perimeter defense.

Answer

The ACL is applied to the outbound interface, which is ineffective for blocking inbound attacks.

Answer

The ACL permits any traffic after denying specific IP ranges, creating a security gap.

Answer

The ACL permits all traffic from private IP addresses, which could allow internal IP spoofing.

Question 20

During the identification phase of incident response, which of the following is the MOST reliable indicator of a security incident?

Accepted Answer

Antivirus software detects a known malware signature.. Antivirus software detecting a known malware signature is the most reliable indicator because it uses signature-based detection, which matches file hashes or byte sequences against a known database of malicious code. This provides definitive, automated evidence of a security incident with minimal false positives, unlike subjective or ambiguous observations.

Answer

A network administrator notices unusual traffic patterns.

Answer

An employee reports slow computer performance.

Answer

A vendor sends a vulnerability disclosure.