CISM Practice Exam 55 — 20 Questions

Question 1

A company's incident response team is conducting a tabletop exercise. They are discussing the steps after containment to prevent recurrence. The facilitator asks: 'What is the MOST important next step after containing an incident?' The team considers several options.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identify the root cause of the incident. After containment, the most critical step is identifying the root cause to understand how the incident occurred and to implement effective remediation measures. Without root cause analysis, the organization cannot ensure that the same vulnerability or attack vector will not be exploited again, making containment temporary at best. This aligns with the NIST SP 800-61 incident response lifecycle, which places eradication and recovery after containment, driven by root cause identification.

Answer

Update the incident response plan with lessons learned

Answer

Forensically image all affected systems

Answer

Notify law enforcement about the incident

Question 2

During a major data breach investigation, legal counsel advises the incident response team to preserve attorney-client privilege over communications with external forensic investigators. Which of the following actions BEST supports this objective?

Accepted Answer

Direct the forensic investigators to report to legal counsel and mark all deliverables as privileged.. Directing forensic investigators to report directly to legal counsel and marking all deliverables as privileged establishes a clear legal framework for attorney-client privilege. This ensures that communications and work product are protected from discovery in litigation, as they are created under the direction of legal counsel for the purpose of providing legal advice.

Answer

Have all communications with the forensic firm go through the CISO.

Answer

Avoid documenting any findings related to the breach until after litigation is resolved.

Answer

Ensure the forensic engagement letter includes a clause acknowledging attorney-client privilege.

Question 3

An information security manager is implementing a risk management program. Which TWO of the following activities should be performed as part of the risk assessment process?

Accepted Answer

Analyzing threats and vulnerabilities. Analyzing threats and vulnerabilities is a core step in the risk assessment process, as defined by the NIST SP 800-30 and ISO 31000 frameworks. This activity identifies potential threat sources and existing vulnerabilities that could be exploited, enabling the calculation of likelihood and impact for risk scenarios.

Answer

Determining acceptable risk levels

Answer

Monitoring incident response plans

Answer

Selecting controls to mitigate risks

Question 4

Which THREE of the following are essential components of an information security governance framework?

Accepted Answer

Strategic alignment of security with business objectives.. Strategic alignment of security with business objectives (Option C) is essential because an information security governance framework must ensure that security initiatives directly support and enable the organization's mission and goals. Without this alignment, security becomes a siloed cost center rather than a strategic enabler, leading to misallocated resources and reduced executive sponsorship. This principle is foundational to the CISM governance domain, where security is viewed as a business function, not just a technical discipline.

Answer

A process for conducting security incident response.

Answer

Implementation of technical security controls such as firewalls.

Question 5

Refer to the exhibit. This error log indicates a failure in which component of information security governance?

Accepted Answer

Access control. The error shows that a user lacks privileges to update a policy, indicating a breakdown in access control. Option A (policy enforcement) is broader and refers to compliance with policies, not updating them. Option C (segregation of duties) is about dividing tasks to prevent fraud, not about insufficient privileges. Option D (audit trail) is about logging, which is functioning as the error was logged.

Answer

Policy enforcement

Answer

Segregation of duties

Answer

Audit trail

Question 6

Which TWO of the following are typically considered key components of an information security governance framework?

Accepted Answer

Adoption of a formal risk management process. Correct: A and C. A formal risk management process (A) is a fundamental component of an information security governance framework as it ensures risks are identified, assessed, and managed. A performance measurement system (C) is also key for evaluating the effectiveness of governance activities and aligning them with organizational objectives. Options B, D, and E are more operational or tactical in nature and are not typically considered core governance components.

Answer

Scheduling of regular penetration tests

Answer

Development of a detailed incident response plan

Answer

Implementation of specific technical controls

Question 7

Refer to the exhibit. A security manager notices that several contractors have been granted access to a financial system without documented exceptions. Based on the policy, what is the most likely governance deficiency?

Accepted Answer

Lack of documentation for approved exceptions.. The policy requires documented exceptions for any access granted outside standard provisioning rules. The security manager observed that contractors had access without such documentation, which directly violates the governance requirement for maintaining an audit trail of approved exceptions. Without this documentation, the organization cannot demonstrate that access was properly authorized, creating a compliance gap.

Answer

The policy does not specify quarterly review of access rights.

Answer

The data owner did not approve the exceptions.

Answer

Contractors should not have any access to financial systems.

Question 8

A security operations center (SOC) analyst receives an alert from the SIEM indicating a potential command and control (C2) communication. The alert is based on a signature that matches known C2 traffic. What is the MOST appropriate next step?

Accepted Answer

Verify the alert by correlating with other log sources. Verifying the alert by checking other log sources (e.g., firewall, DNS) reduces false positives before escalating. Escalating immediately (B) may waste resources if the alert is a false positive. Blocking the IP address at the firewall (A) could be premature if the traffic is legitimate. Running a full antivirus scan on all endpoints (D) is a reactive step that does not address the immediate investigation of the alert.

Answer

Block the destination IP address at the firewall

Answer

Escalate the alert to the incident response team immediately

Answer

Perform a full antivirus scan on all endpoints

Question 9

An organization experiences a DDoS attack that overwhelms their internet connection. Which containment strategy would be MOST effective?

Accepted Answer

Contact the ISP for traffic scrubbing or blackhole routing.. ISPs can perform traffic scrubbing to filter out malicious traffic while allowing legitimate traffic, thus mitigating the DDoS attack without completely cutting off connectivity. Option A (shutting down all external connectivity) would stop all traffic, including legitimate, causing a complete outage. Option B (changing firewall rules to block all traffic) would also block all traffic and likely not be sustainable. Option C (adding more bandwidth) might absorb some attacks but is not effective against large-scale DDoS attacks and does not address the malicious traffic.

Answer

Shut down all external connectivity.

Answer

Change firewall rules to block all traffic.

Answer

Add more bandwidth to absorb the attack.

Question 10

Refer to the exhibit.
Based on the exhibit, what is the security implication of this cloud storage bucket policy?

Accepted Answer

Allows only users from 10.0.0.0/8 to read and write. The bucket policy includes a Condition block with NotIpAddress for both read and write actions, denying access from IP addresses outside the 10.0.0.0/8 range. This restricts both read and write operations to users from the internal network, making Option B correct.

Answer

Denies all access except from 10.0.0.0/8

Answer

Allows any authenticated user to read and write objects

Answer

Allows any user from internal network to read objects, but any user can write objects from anywhere

Question 11

During incident response, a forensic investigator needs to collect evidence from a compromised server. Which action BEST preserves evidence integrity?

Accepted Answer

Pull the power cord. Pulling the power cord (Option C) is the best action because it immediately halts all system processes and prevents any further writes to the disk, preserving the exact state of the storage media at the time of incident. This method avoids the risk of the operating system altering metadata, logs, or file timestamps during a graceful shutdown, which could compromise forensic integrity. It also ensures that volatile memory (RAM) content is lost, but for disk-based evidence, this is the standard approach to maintain a pristine bit-for-bit copy.

Answer

Perform a graceful shutdown

Answer

Create a network-based image

Answer

Copy files to an external drive

Question 12

An organization's IDS logs show multiple outbound connections to an external IP address from a server that normally communicates only internally. The logs indicate the process is running under the SYSTEM account. Which of the following BEST describes the likely root cause?

Accepted Answer

A backdoor installed via a previous compromise. The SYSTEM account is the highest-privileged local account on Windows, and outbound connections from a server that normally only communicates internally strongly indicate a backdoor. A backdoor installed via a previous compromise would allow an attacker to maintain persistent remote access, often running as SYSTEM to evade detection and control the server. This matches the observed behavior of unauthorized outbound traffic from a privileged process.

Answer

A misconfigured application

Answer

An authorized administrative activity

Answer

A privilege escalation exploit

Question 13

After a security incident, which step should be taken first?

Accepted Answer

Containment. In incident management, containment is the immediate priority after detection because it stops the spread of the threat and limits damage. Without containment, the attacker may continue to move laterally, exfiltrate data, or destroy evidence, making recovery and eradication ineffective. CISM emphasizes that containment must precede eradication and recovery to preserve forensic integrity and reduce business impact.

Answer

Recovery

Answer

Lessons learned

Answer

Eradication

Question 14

An incident response team is analyzing a phishing email that successfully compromised a user's credentials. Which TWO indicators of compromise (IOCs) should the team prioritize collecting? (Choose two.)

Accepted Answer

The IP address of the sending server.. The correct options are B and C. The IP address of the sending server is a critical IOC because it identifies the source infrastructure used to deliver the phishing email, enabling network-level blocks and threat intelligence correlation. The malicious URL or attachment hash is another key IOC as it represents the payload that compromised the credentials, allowing for signature-based detection and blocking. The other options (browser history, personal phone number, company website) are not primary IOCs from the phishing email itself.

Answer

The user's browser history.

Answer

The user's personal phone number.

Answer

The company's public website.

Question 15

Which of the following best describes the difference between risk appetite and risk tolerance?

Accepted Answer

Risk appetite is the amount of risk an organization is willing to accept, while risk tolerance is the acceptable variation around that appetite for specific objectives. Ly distinguishes risk appetite as the broad, strategic level of risk an organization is willing to accept in pursuit of its objectives, while risk tolerance is the specific, measurable deviation allowed from that appetite for individual objectives or risks. This aligns with the ISACA CISM Review Manual, which defines risk appetite as the 'amount of risk an entity is willing to accept in pursuit of its mission' and risk tolerance as the 'acceptable level of variation relative to the achievement of objectives.' Understanding this distinction is critical for establishing proper risk management thresholds and ensuring that security controls are aligned with business goals.

Answer

Risk appetite is the maximum risk tolerance

Answer

Risk tolerance is the total risk, and risk appetite is the residual risk

Answer

Risk appetite is qualitative, and risk tolerance is quantitative

Question 16

Which of the following is the primary purpose of an Information Security Program?

Accepted Answer

To align security with business objectives and manage risk. The primary purpose of an Information Security Program is to align security initiatives with business objectives and manage risk to an acceptable level. While technology implementation, compliance, and risk elimination are components, they are means to the end of supporting the organization's mission and risk appetite. A program that does not align with business goals will lack executive support and fail to prioritize resources effectively.

Answer

To implement the latest security technologies

Answer

To comply with all applicable regulations

Answer

To eliminate all security risks

Question 17

Match each incident management phase to its activity.

Accepted Answer

Detection: Identifying signs of an incident.. The correct phases are: Detection (identifying signs), Response (immediate containment), Mitigation (controls to reduce impact), and Recovery (restoration). Common confusions include swapping Detection and Response activities, or Mitigation and Recovery activities.

Answer

Detection: Taking immediate containment actions.

Answer

Mitigation: Restoring normal operations.

Question 18

A security analyst detects unusual outbound traffic from a critical server to an unknown external IP address during business hours. Which step should be taken FIRST in the incident response process?

Accepted Answer

Contact the server owner to verify the traffic. The first step in incident response is to verify and validate the alert. Contacting the server owner to confirm whether the outbound traffic is authorized prevents unnecessary disruption and false positives. This aligns with the NIST SP 800-61 incident response lifecycle, where identification and initial triage precede containment or escalation.

Answer

Notify law enforcement about the potential breach

Answer

Isolate the server from the network immediately

Answer

Report the incident to senior management

Question 19

A risk assessment identifies that the organization's email system has a high likelihood of phishing attacks. The current controls include spam filtering and user awareness training. What should the organization do NEXT to manage this risk effectively?

Accepted Answer

Evaluate the residual risk and decide on additional controls. After implementing initial controls (spam filtering and user awareness training), the organization must evaluate the residual risk—the risk that remains after controls are applied. This step is required by the CISM risk management process to determine whether the residual risk level is acceptable or if additional controls are needed. Option B correctly follows the risk assessment lifecycle: identify risk, apply controls, assess residual risk, then decide on further action.

Answer

Accept the risk as it is already controlled

Answer

Transfer the risk to a cyber insurance provider

Answer

Conduct another round of user awareness training

Question 20

A healthcare organization is developing an information security strategy. The board has mandated that the strategy must support innovation while protecting patient data. Which governance approach BEST balances these priorities?

Accepted Answer

Establish a risk appetite framework that defines acceptable risk levels for innovation initiatives.. A risk appetite framework (Option B) is the correct governance approach because it explicitly defines the level of risk the organization is willing to accept in pursuit of innovation, allowing the board to balance patient data protection with strategic growth. This framework provides a decision-making boundary for security controls, ensuring that innovation initiatives are not stifled by overly restrictive measures while still maintaining compliance with healthcare regulations like HIPAA and HITECH.

Answer

Implement strict access controls and encryption for all data.

Answer

Adopt a 'security by design' approach for all new projects.

Answer

Create a separate innovation sandbox with limited data access.