CISM Practice Exam 56 — 20 Questions

Question 1

You are the director of information security at a multinational corporation that operates in many countries with conflicting data privacy laws. The company's information security program includes a data classification policy and a data retention schedule, but there is no consistent method for handling cross-border data flows. Recently, a regulator in Country A fined the company for transferring personal data to Country B, which does not provide adequate protection. The legal department recommends implementing a binding corporate rules (BCR) approach, but the IT department says it would be too complex to implement across all systems. You must update the program to ensure compliance while minimizing operational impact. The board wants a solution that can be implemented within one year with reasonable cost. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a data mapping exercise and implement a data classification tagging system to automate controls on sensitive data flows.. Correct answer is C because a data mapping exercise with automated tagging provides the foundation to enforce controls without manual effort. This approach allows the company to understand where sensitive data flows, apply appropriate protections (such as BCR or SCCs) only where needed, and minimize operational impact. Option A (implement BCR globally) is complex and time-consuming. Option B (rely on standard contractual clauses for all flows) may not be sufficient for all jurisdictions and is administrative heavy. Option D (stop all cross-border transfers) is impractical and would harm business operations.

Answer

Implement binding corporate rules (BCR) across all entities as recommended by legal.

Answer

Rely on standard contractual clauses (SCCs) for all cross-border data flows.

Answer

Stop all cross-border data transfers until compliant mechanisms are fully implemented.

Question 2

An organization has implemented a new web application that processes sensitive customer data. The risk assessment identified a high likelihood of SQL injection attacks due to insufficient input validation. Which of the following is the BEST risk treatment strategy?

Accepted Answer

Remediate the risk by implementing parameterized queries and input validation. Parameterized queries (prepared statements) and input validation directly address the root cause of SQL injection by separating SQL logic from user-supplied data. This is a remediation (mitigation) strategy that reduces the likelihood of exploitation to an acceptable level, which aligns with the high-risk scenario described.

Answer

Transfer the risk by purchasing cyber insurance

Answer

Avoid the risk by discontinuing the web application

Answer

Accept the risk because the likelihood is low after compensating controls

Question 3

After a data breach involving personal data of EU residents, the incident manager must ensure compliance with GDPR notification requirements. Within how many hours must the organization notify the relevant supervisory authority of the breach?

Accepted Answer

72 hours. GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

96 hours

Answer

24 hours

Answer

48 hours

Question 4

During an incident, the incident response team determines that a compromised account was used to exfiltrate data. The account has been disabled. What is the NEXT best action to prevent similar incidents?

Accepted Answer

Perform a root cause analysis. Performing a root cause analysis (RCA) is the next best action because it systematically identifies the underlying vulnerability or control weakness that allowed the account compromise. Without understanding how the attacker gained access—whether through phishing, credential stuffing, or a software vulnerability—simply disabling the account does not prevent recurrence. The RCA will inform targeted remediation, such as patching, policy changes, or implementing multi-factor authentication (MFA).

Answer

Notify potentially affected customers

Answer

Reset passwords for all user accounts

Answer

Review authentication logs for other anomalies

Question 5

An organization has implemented a balanced scorecard to measure the effectiveness of its information security program. Which of the following metrics would be MOST appropriate for the 'internal processes' perspective?

Accepted Answer

Mean time to detect and respond to incidents. The 'internal processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of the operational workflows that deliver the security program. Mean time to detect (MTTD) and mean time to respond (MTTR) directly measure the performance of the incident response process, which is a core internal process. This metric reflects how quickly the organization can identify and contain threats, making it the most appropriate choice for this perspective.

Answer

Percentage of systems compliant with baseline

Answer

Percentage of users who completed security awareness training

Answer

Number of security incidents reported to management

Question 6

A government agency is criticized for poor security governance after a data breach. An external review finds that security policies are not aligned with agency's mission. The director wants to implement a governance framework that ties security to strategic objectives. Which framework is most suitable?

Accepted Answer

COBIT 2019. COBIT is designed for governance and alignment with enterprise goals. Option A is a management system. Option B is operational. Option D is industry-specific.

Answer

NIST Cybersecurity Framework

Answer

PCI DSS

Answer

ISO 27001

Question 7

A multinational corporation experiences a security breach involving customer PII. The incident response team needs to determine notification requirements. Which factor is MOST important in deciding which regulatory bodies to inform?

Accepted Answer

Location of the affected individuals. Data privacy regulations (e.g., GDPR, CCPA, LGPD) base their notification requirements on the residency or location of the affected data subjects, not on where the breach originated or where the company's executives sit. The incident response team must map the affected PII to the specific jurisdictions whose laws impose breach notification duties, making the location of the affected individuals the primary driver for determining which regulatory bodies to inform.

Answer

Location of the attacker

Answer

Location of the company's CIO

Answer

Location of the data custodian

Question 8

Which TWO of the following are primary goals of the containment phase in incident response? (Select TWO)

Accepted Answer

Prevent the incident from spreading to other systems. The primary goals of the containment phase are to limit the scope and impact of the incident (E) and prevent it from spreading to other systems (D). These actions aim to stop further damage and isolate affected resources. Eradication (B) is a separate phase, preserving evidence (C) is important but not a primary containment goal, and restoring normal operations (A) belongs to the recovery phase.

Answer

Restore normal business operations

Answer

Eradicate the root cause of the incident

Answer

Preserve evidence for legal proceedings

Question 9

An organization has just completed a risk assessment and identified several high-risk vulnerabilities. The security program manager needs to prioritize remediation efforts. Which of the following should be the primary factor in determining priority?

Accepted Answer

Risk level (likelihood × impact). Risk level, calculated as likelihood multiplied by impact, is the primary factor for prioritizing remediation because it quantifies the overall exposure to the organization. While regulatory requirements, likelihood alone, or ease of remediation are important considerations, they do not capture the combined effect of both probability and consequence, which is essential for effective risk management in an information security program.

Answer

Regulatory requirements only

Answer

Likelihood of exploitation

Answer

Ease of remediation

Question 10

A risk manager is presenting risk treatment options to senior management. Which of the following is the BEST approach to communicate risk in a way that supports informed decision-making?

Accepted Answer

Translate risk into potential financial impact. Translating risk into potential financial impact (Option C) is the best approach because it aligns risk with business objectives, enabling senior management to make cost-benefit decisions. Financial quantification, such as Annualized Loss Expectancy (ALE), provides a common language that executives understand, directly supporting informed decision-making on risk treatment options.

Answer

Focus only on high and extreme risks

Answer

Use technical language to accurately describe vulnerabilities

Answer

Present risk in qualitative terms only

Question 11

After a major security incident, the incident response team completes the containment, eradication, and recovery phases. The CISO is now planning the post-incident activities. Which activity is MOST critical to ensure that lessons learned are effectively incorporated?

Accepted Answer

Conducting a post-incident review and updating policies.. Conducting a post-incident review and updating policies is the most critical post-incident activity because it ensures that the root cause, response gaps, and process deficiencies are formally documented and translated into actionable improvements. This directly supports the continuous improvement cycle required by NIST SP 800-61 and ISO 27035, preventing recurrence of similar incidents.

Answer

Publishing a public disclosure of the incident.

Answer

Terminating the incident response team's engagement.

Answer

Restoring all systems to full production status.

Question 12

An analyst receives an alert indicating a potential data exfiltration. The alert shows a host IP address 10.10.50.200 sending large amounts of data to an external IP address 203.0.113.5 over port 443. What should the analyst do FIRST?

Accepted Answer

Verify the alert by checking logs and network traffic. The first step in incident response is to validate the alert. The analyst must verify that the traffic is indeed anomalous and not legitimate (e.g., a large backup or software update) by examining logs and packet captures. Premature action without verification could disrupt business operations or destroy forensic evidence.

Answer

Block the external IP address immediately

Answer

Escalate to the incident response team

Answer

Isolate the host from the network

Question 13

A multinational corporation is implementing an information security governance framework. The board has requested a mechanism to ensure that security investments align with business objectives. Which of the following is the BEST approach to achieve this alignment?

Accepted Answer

Develop a risk-based prioritization framework linking security initiatives to business risk appetite.. A risk-based prioritization framework directly maps security initiatives to the organization's risk appetite, ensuring that investments target the most critical business risks. This aligns with the CISM principle that governance must link security activities to business objectives through risk management, not through arbitrary cost-cutting or blanket compliance.

Answer

Minimize security spending to maximize ROI.

Answer

Adopt a best-practice framework such as NIST CSF and implement all controls.

Answer

Focus on regulatory compliance to ensure legal requirements are met.

Question 14

An incident response plan should include which three key components to ensure effective response? (Choose three.)

Accepted Answer

Communication procedures for internal and external stakeholders.. A is correct because effective incident response requires structured communication procedures to coordinate with internal stakeholders (e.g., management, legal, PR) and external parties (e.g., law enforcement, regulators, customers). Without predefined communication channels, critical updates may be delayed or mishandled, increasing organizational risk.

Answer

Detailed step-by-step technical instructions for all possible incidents.

Answer

A list of pre-approved vendors for forensic services.

Question 15

Based on the exhibit, which of the following is true about traffic from the internet to the internal network 10.0.0.0/8?

Accepted Answer

All traffic from the internet to the internal network is denied.. The exhibit shows an access control list (ACL) that denies all traffic from any source to the 10.0.0.0/8 network. Since the ACL is applied inbound on the internet-facing interface, any traffic originating from the internet destined for the internal network 10.0.0.0/8 is implicitly denied by the explicit deny statement. Therefore, option B is correct: all traffic from the internet to the internal network is denied.

Answer

Internet traffic to 10.0.0.5 is permitted only if from 192.168.1.0/24.

Answer

Traffic from the internet to 10.0.0.5 port 80 is permitted.

Answer

Traffic from 192.168.1.0/24 to 10.0.0.5 port 80 is permitted.

Question 16

After a ransomware attack, a company discovers that backups are also encrypted. The incident response team has isolated the affected systems. What should be the next step?

Accepted Answer

Isolate additional systems and notify law enforcement.. After isolating affected systems, the next priority is to contain the incident by identifying and isolating any additional compromised systems to prevent further spread, and to notify law enforcement as required by legal and regulatory obligations. This aligns with the Incident Response (IR) process, specifically the Containment, Eradication, and Recovery phases, where containment must precede any recovery attempts to avoid re-infection.

Answer

Attempt restoration from encrypted backups.

Answer

Pay the ransom to obtain decryption keys.

Answer

Reimage all systems from known clean media.

Question 17

During a data breach investigation, the team discovers that an attacker exfiltrated data via encrypted HTTPS to a server abroad. Which forensic step is most critical?

Accepted Answer

Capture memory from the endpoint to find encryption keys. Capturing memory from the endpoint is the most critical step because encryption keys for HTTPS sessions are often stored in plaintext within the process memory of the web browser or application (e.g., in the TLS master secret). Without these keys, the encrypted traffic captured on the wire cannot be decrypted, making memory forensics essential to recover the plaintext data exfiltrated by the attacker.

Answer

Analyze firewall logs for the connection

Answer

Decrypt the traffic using the server's private key

Answer

Trace the IP address to identify the attacker

Question 18

Which TWO of the following are essential components of an effective information security governance framework? (Select exactly two.)

Accepted Answer

Process for aligning security strategy with business strategy. An effective information security governance framework must include a process for aligning security strategy with business strategy. This ensures that security initiatives support organizational objectives, risk tolerance, and regulatory requirements, rather than operating in isolation. Without this alignment, security investments may conflict with business goals, leading to inefficiencies or reduced adoption.

Answer

Implementation of a SIEM system

Answer

Automated patch management system

Answer

Intrusion prevention system (IPS)

Question 19

Which of the following is the PRIMARY reason for having a pre-established forensic retainer agreement before an incident occurs?

Accepted Answer

To reduce the time needed to bring forensic experts on board during an incident.. The primary reason for a pre-established forensic retainer agreement is to reduce the time needed to bring forensic experts on board during an incident. In incident management, every minute of delay can allow an attacker to exfiltrate data or destroy evidence; a retainer bypasses the procurement and contracting process, enabling immediate deployment of the forensic team to preserve volatile memory and capture network artifacts.

Answer

To ensure the forensic firm is familiar with the organization's environment.

Answer

To lock in a favorable pricing structure.

Answer

To ensure the forensic firm has the necessary certifications.

Question 20

A security manager is preparing a risk report for the board of directors. Which of the following should be included to best support strategic risk-based decisions?

Accepted Answer

Summary of top risks, risk appetite alignment, and treatment status. The board requires strategic-level information to make risk-based decisions. Option D provides a summary of top risks, alignment with risk appetite, and treatment status, which directly supports strategic oversight. Operational details like firewall counts or patch levels are tactical and do not convey the business impact or risk posture needed for board-level decisions.

Answer

Operational metrics such as number of firewalls and intrusion detection alerts

Answer

List of all past security incidents and their root causes

Answer

Detailed vulnerability scan results and patch levels