CISM Practice Exam 55 — 20 Questions

Question 1

A global manufacturing firm is expanding into a new region where data residency laws differ significantly from its home country. The CISO must present a risk treatment plan to the board. Which of the following is the MOST appropriate FIRST step in aligning risk treatment with the organization's risk appetite?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the board's risk appetite statement and tolerance levels for the new region.. Aligning risk treatment with risk appetite begins with understanding the board's appetite and tolerance. The risk appetite statement defines the amount and type of risk the organization is willing to accept, which then guides the selection of controls. Only after this alignment can a gap analysis, BIA, or control implementation be effectively prioritized. Thus, reviewing the board's risk appetite is the essential first step.

Answer

Implement encryption for all data stored in the new region.

Answer

Perform a gap analysis of current controls against the new region's regulatory requirements.

Answer

Conduct a business impact analysis (BIA) for all regional operations.

Question 2

A global insurance provider has just completed a quantitative risk assessment for a new claims-processing application. The assessment used the Annualized Loss Expectancy (ALE) formula and produced an ALE of $850,000 for the risk of a data breach. The vendor's proposed control has an Annualized Cost of the Safeguard (ACS) of $300,000 and a projected risk reduction of 60%. The CISO asks the information security manager to determine the cost-benefit of implementing this control. What is the net benefit (or loss) of the control?

Accepted Answer

$210,000 net benefit. The control reduces the ALE by 60%, leaving a residual ALE of $340,000. The value of that reduction is $510,000. After deducting the $300,000 annual safeguard cost, the net benefit is $210,000. This demonstrates a positive return and supports implementing the control, provided the quantitative assumptions are validated and the risk remains within tolerance.

Answer

$510,000 net benefit

Answer

$340,000 net benefit

Answer

$550,000 net loss

Question 3

A CISO is establishing a security governance framework for a decentralized organization where each business unit operates independently. The CISO wants to ensure that security policies are consistently applied while respecting business unit autonomy. Which two actions are MOST appropriate to achieve this? (Choose two.)

Accepted Answer

Develop a set of high-level security principles and allow business units to tailor implementation. Establishing a security steering committee with business unit representatives and developing high-level security principles with tailored implementation both balance central governance with local autonomy. The committee fosters collaboration and shared decision-making, while the principles provide a consistent framework that business units can adapt to their specific contexts. Together, they enable consistent risk management without stifling the flexibility required in a decentralized organization.

Answer

Implement a centralized security policy that mandates compliance from all business units

Answer

Allow each business unit to develop its own security policies independently without central oversight

Answer

Outsource all security operations to a managed security service provider (MSSP) to ensure uniformity

Question 4

A healthcare organization's information security program has a policy that requires all ePHI to be encrypted at rest. During a review, the CISO discovers that a legacy application storing ePHI does not support encryption. The application is critical for patient care and cannot be replaced immediately. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a risk assessment to evaluate the potential impact and likelihood of a data breach.. The CISO should first conduct a risk assessment to quantify the risk posed by the unencrypted ePHI. This assessment will identify the likelihood and impact of a breach, and inform decisions about compensating controls, exceptions, or remediation timelines. Other actions, such as granting an exception or disconnecting the application, are premature without understanding the risk. The risk assessment ensures a balanced approach that considers patient care and compliance.

Answer

Grant a policy exception for the legacy application and document the compensating controls.

Answer

Immediately disconnect the legacy application from the network to prevent a breach.

Answer

Update the security policy to allow unencrypted ePHI for legacy systems.

Question 5

A retail company's risk register lists a vulnerability in its point-of-sale system that could expose customer payment card data. The Chief Information Security Officer (CISO) wants to ensure the risk is managed appropriately. Which of the following should be the FIRST step in the risk treatment process?

Accepted Answer

Validate the risk and determine its priority based on likelihood and impact. The risk treatment process starts with validating the identified risk and prioritizing it based on likelihood, impact, and risk appetite. Only after the risk is confirmed and ranked can the organization evaluate treatment options such as mitigation, transfer, avoidance, or acceptance. Jumping directly to a control, insurance, or external reporting bypasses this essential prioritization step and may misallocate resources.

Answer

Report the vulnerability to the payment card brand immediately

Answer

Implement a web application firewall in front of the point-of-sale system

Answer

Purchase a cyber insurance policy to cover potential card replacement costs

Question 6

A CISO is establishing a security metrics program to measure the effectiveness of the information security program. The CISO wants to include both key goal indicators (KGIs) and key performance indicators (KPIs). Which of the following are examples of KGIs? (Choose two.)

Accepted Answer

Achievement of ISO/IEC 27001 certification within the planned timeframe.. KGIs measure the achievement of strategic goals and outcomes, while KPIs measure the performance of processes. A reduction in successful breaches indicates that the goal of preventing breaches is being met, and achieving ISO/IEC 27001 certification represents the accomplishment of a strategic objective. The other options are process-oriented metrics that track efficiency or activity, not goal attainment. Thus, the two KGIs are the breach reduction and certification achievement.

Answer

Percentage of critical vulnerabilities remediated within 30 days.

Answer

Mean time to detect (MTTD) security incidents.

Answer

Percentage of employees who completed security awareness training.

Question 7

A global manufacturing firm is establishing a formal risk management program. The CISO has been asked to ensure that risk assessment outputs are consistently comparable across business units and over time. Which TWO of the following practices BEST support this objective? (Choose two.)

Accepted Answer

Adopting a common risk taxonomy and standardized likelihood and impact scales.. Comparability across units and over time depends on consistent definitions and repeatable methods. A common taxonomy with calibrated scales lets assessments be aggregated, while a documented methodology lets different assessors and different years produce ratings that can be meaningfully compared. Local scoring variation, purely qualitative records, and rotating frameworks all undermine that consistency.

Answer

Recording only qualitative ratings and omitting any quantitative data.

Answer

Reassessing all risks annually using a newly selected framework each cycle.

Answer

Allowing each business unit to define its own risk scoring methodology.

Question 8

An information security manager is updating the organization's risk register after a significant change in the threat landscape. The manager needs to ensure the register remains a useful tool for decision-making. Which TWO of the following activities are MOST important for maintaining the risk register's effectiveness? (Choose two.)

Accepted Answer

Assigning a risk owner for each entry who is accountable for treatment and monitoring. An effective risk register requires ongoing maintenance through scheduled and event-driven reviews, and clear assignment of risk owners who are accountable for treatment and monitoring. These two practices ensure the register stays current, actionable, and aligned with governance requirements. Removing accepted risks, restricting access, or limiting entries to technical vulnerabilities would reduce its value and completeness.

Answer

Limiting access to the risk register to only the information security team

Answer

Populating the register exclusively with technical vulnerabilities identified by scanners

Answer

Removing all risks that have been accepted by senior management to reduce clutter

Question 9

A retail company is building an information security risk register to support its risk management program. The risk manager wants to ensure the register captures the information needed to track and report risks to senior management. Which TWO of the following are essential elements that should be included for each identified risk? (Choose two.)

Accepted Answer

Risk owner and risk response. A useful risk register must record who owns each risk and what response is planned, because accountability and treatment drive progress. It must also capture likelihood and impact so risks can be scored, compared, and prioritized consistently. Other details may be linked or tracked elsewhere, but these two elements are fundamental for managing and reporting risk to senior management.

Answer

The name of the auditor who discovered the risk

Answer

The budget code of the department that reported the risk

Answer

A detailed list of every technical vulnerability associated with the risk

Question 10

A mid-sized manufacturing firm has decided to transfer the risk of a ransomware attack on its production network by purchasing a cyber insurance policy. The policy includes a $1 million coverage limit and a $50,000 deductible. Six months later, a ransomware incident causes $400,000 in recovery costs. The insurer approves the claim. What is the organization's financial responsibility for this incident?

Accepted Answer

$50,000. When a risk is transferred through insurance and the claim is approved, the organization bears the deductible while the insurer covers the covered loss above it, up to the policy limit. Here the loss is well below the limit, so the organization pays only the $50,000 deductible. This illustrates how insurance reduces financial impact but does not eliminate all residual risk.

Answer

$400,000

Answer

$350,000

Answer

$1,000,000

Question 11

A retail company has a risk register that includes a risk related to point-of-sale (POS) malware. The risk owner has decided to implement an endpoint detection and response (EDR) solution to reduce the risk. Which risk treatment strategy is being applied?

Accepted Answer

Risk mitigation. Risk mitigation is the process of implementing controls to reduce the likelihood or impact of a risk. By deploying EDR, the organization aims to detect and respond to POS malware, thereby lowering the risk. Avoidance would mean stopping the activity, transfer would involve insurance, and acceptance would mean no action. Therefore, mitigation is the correct treatment strategy.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Risk avoidance

Question 12

A hospital’s CISO is reviewing a critical clinical application that cannot be patched due to vendor certification constraints. The risk of exploitation is assessed as high. The hospital has implemented network segmentation and enhanced monitoring as compensating controls. Which of the following is the MOST appropriate next step to manage this risk?

Accepted Answer

Perform a residual risk assessment to determine if the compensating controls reduce risk to an acceptable level.. When compensating controls are introduced, the risk profile changes and must be re-evaluated. A residual risk assessment determines whether segmentation and monitoring reduce the risk to a level the hospital can tolerate. Only after that assessment can leadership make an informed decision to accept, further mitigate or transfer the risk. Acting without this step risks either unnecessary disruption or unrecognized exposure.

Answer

Transfer the risk by purchasing cyber insurance that covers clinical system outages.

Answer

Accept the risk and document it in the risk register with a review date.

Answer

Immediately remove the application from the network until the vendor provides a patch.

Question 13

An information security manager at a multinational bank is reviewing the risk assessment methodology. The bank operates in multiple jurisdictions with different regulatory requirements. The manager wants to ensure the methodology produces consistent and comparable risk results across all business units. Which of the following is the MOST important characteristic of the risk assessment methodology?

Accepted Answer

It uses a defined and consistently applied risk scoring scale. Consistency across business units and jurisdictions depends on a defined, uniformly applied risk scoring scale. This ensures that likelihood and impact ratings are comparable, allowing the bank to aggregate risks, prioritize investments, and report meaningfully to the board and regulators. Local judgment and qualitative input are valuable, but they must operate within a common framework to produce reliable enterprise risk information.

Answer

It automatically assigns the highest possible risk rating to all regulatory findings

Answer

It uses qualitative ratings only, avoiding numerical scores

Answer

It relies on the judgment of each local risk manager without central guidance

Question 14

A global manufacturing company is expanding its operations into a region with unstable political conditions. The CISO has been asked by the board to provide a recommendation on the risk associated with building a new data center in that region. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a country risk assessment to identify threats and vulnerabilities specific to the region.. The correct first step is to conduct a country risk assessment. This provides the necessary information about the specific threats and vulnerabilities of operating in that region, enabling the board to make an informed decision. Other options like insurance, redundancy, or acceptance are all risk treatment strategies that should only be considered after the risk has been properly assessed and evaluated against the organization's risk appetite.

Answer

Implement a redundant data center in a stable region to ensure business continuity.

Answer

Accept the risk because the expansion is a strategic business decision.

Answer

Purchase political risk insurance to transfer the potential financial losses.

Question 15

An insurance company's risk committee has formally approved a risk treatment plan that relies on a new identity governance platform to reduce excessive access privileges. Six months into implementation, the project is 20 percent complete due to competing priorities. What should the information security manager do FIRST?

Accepted Answer

Update the risk register to reflect the increased residual risk and report the treatment shortfall to the risk committee.. Risk treatment plans are approved on the basis of projected residual risk, so slippage changes the factual basis of that approval. The security manager must first update the risk register and notify the risk committee, enabling it to decide whether to fund acceleration, accept the higher exposure temporarily, or mandate compensating controls. Execution and vendor actions come after risk visibility is restored.

Answer

Request an extension of the original project timeline from the vendor and continue monitoring.

Answer

Close the original risk entry and open a new one describing the delayed identity governance implementation.

Answer

Reassign the identity governance project to the security team so it can be completed faster.

Question 16

An information security manager is integrating risk management with the organization's enterprise risk management (ERM) program. The ERM director asks how information security risk should be reported alongside financial and operational risks. Which of the following is the MOST appropriate approach?

Accepted Answer

Express security risks in business impact terms and integrate them into the enterprise risk register using common scales.. Integrating security risk into ERM requires translating technical exposure into business impact and using the enterprise's common scales so that cyber risk can be compared, aggregated, and prioritized alongside other risk types. This gives executives a unified view while preserving enough detail for ownership and treatment decisions.

Answer

Convert all security risks into a single aggregate score and report only that score to ERM.

Answer

Report security risks separately to the CISO only, keeping ERM focused on financial and operational risks.

Answer

Report only risks that have already materialized as incidents so ERM deals with confirmed events.

Question 17

A global retailer operates point-of-sale systems in 12 countries. The risk register shows a single entry titled 'Payment card data breach' with a likelihood of 4 and an impact of 5. A new CISO argues this entry is too coarse to support treatment decisions. Which action BEST improves the usefulness of the risk register for decision-making?

Accepted Answer

Decompose the entry into distinct risk scenarios mapped to specific threat events, assets, and existing controls.. Risk registers support decisions only when entries describe discrete scenarios that can be individually assessed, owned, and treated. Splitting an aggregated payment card breach entry into specific threat-asset-control combinations enables targeted control selection, meaningful residual scoring, and clear accountability. Merely re-scoring, downgrading to qualitative labels, or transferring to insurance leaves the underlying analytical deficiency untouched.

Answer

Transfer the risk to a cyber insurance policy and remove it from the active risk register.

Answer

Replace the numeric likelihood and impact scores with a simple high, medium, or low qualitative rating.

Answer

Increase the impact rating to 5 and add a note that the risk is critical to the business.

Question 18

An information security manager is reviewing the organization's risk register and notices that a risk related to unpatched software has been assigned a risk score of 9 (on a scale of 1-10) with a note that the risk is 'accepted' because patching would disrupt a critical production system. Which of the following should the manager do NEXT?

Accepted Answer

Verify that the risk acceptance is documented and approved by the appropriate business owner.. The next step is to verify that the risk acceptance is properly documented and approved by the business owner. Risk acceptance is a formal process that requires accountability. If the acceptance is not valid, the manager can then take appropriate action, such as proposing compensating controls or escalating. Verifying the process ensures that the organization's risk governance is upheld and that the decision to accept the risk was made at the correct level.

Answer

Immediately implement a compensating control such as network segmentation to reduce the risk.

Answer

Update the risk register to reflect that the risk is mitigated by the acceptance decision.

Answer

Escalate the risk to the board of directors because a score of 9 is unacceptable.

Question 19

An information security manager is selecting a risk analysis methodology for a new enterprise resource planning (ERP) deployment. The organization has limited historical incident data, the deployment timeline is aggressive, and executives want a defensible ranking of risks within two weeks. Which approach is MOST appropriate?

Accepted Answer

A qualitative analysis using a defined likelihood and impact scale with calibrated subject matter expert judgment.. When historical loss data is scarce and results are needed quickly, a qualitative analysis with documented likelihood and impact scales and calibrated expert judgment is the most practical and defensible choice. It produces a consistent ranking without fabricating quantitative precision, and the documented scales allow reviewers to understand and challenge how each ERP risk was rated.

Answer

A quantitative analysis using annualized loss expectancy derived from industry breach cost benchmarks.

Answer

A hybrid analysis that assigns monetary values to every identified ERP risk regardless of data availability.

Answer

A control gap analysis mapped to ISO/IEC 27002 that ranks risks by the number of missing controls.

Question 20

A manufacturing company is integrating a newly acquired subsidiary into its enterprise risk management program. The CISO must establish controls to ensure risk assessments from the subsidiary are reliable. Which TWO of the following activities BEST provide assurance that the subsidiary's risk assessment results are trustworthy? (Choose two.)

Accepted Answer

Require the subsidiary to use the parent company's approved risk assessment methodology, scales, and scoring criteria.. Reliability of subsidiary risk data rests on two pillars: a common methodology so outputs are comparable, and independent validation so the process is actually followed and conclusions are evidence-based. Filtering reported risks, retaining divergent templates, and delegating acceptance without oversight each undermine one or both pillars, leaving the parent unable to trust or aggregate subsidiary assessments.

Answer

Delegate full authority for risk acceptance to the subsidiary's local management without oversight.

Answer

Allow the subsidiary to retain its existing risk assessment templates to preserve continuity with prior years.

Answer

Instruct the subsidiary to report only risks that exceed the enterprise risk appetite threshold.