CISM Practice Exam 56 — 20 Questions

Question 1

A software company is entering a new market that requires compliance with a strict data protection law. The CISO must determine whether the current security program can meet the law’s requirements. Which of the following should be the FIRST step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a gap analysis between the law’s requirements and the current security controls.. The first step in achieving compliance is to understand the difference between what the law requires and what the organization currently does. A gap analysis produces that understanding by mapping requirements to existing controls, identifying deficiencies and highlighting areas where evidence is missing. This allows the CISO to prioritize remediation, allocate budget and build a realistic compliance plan before making technical or policy changes.

Answer

Engage external legal counsel to interpret the law’s requirements.

Answer

Implement encryption for all data at rest and in transit across the enterprise.

Answer

Update the information security policy to reference the new law.

Question 2

An information security manager is calculating the annualized loss expectancy for a data center outage. The facility has a single point of failure, and a full outage is estimated to occur once every 25 years with a loss of $4,000,000 per event. A redundant power and cooling project would cost $900,000 and reduce the frequency to once every 100 years. What is the expected annual risk reduction, and how should the manager interpret it?

Accepted Answer

$120,000; the manager should compare it with the project cost and consider qualitative factors before recommending treatment.. Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence. Before the project the value is $160,000; after it is $40,000; the expected annual risk reduction is $120,000. The manager should treat this as one input, comparing it with the project cost and weighing qualitative and regulatory factors before recommending treatment.

Answer

$120,000; the project cost exceeds the annual benefit and should be rejected outright.

Answer

$40,000; the project should be approved because any reduction in high-impact risk is always cost-justified.

Answer

$160,000; the project is justified because the reduction equals the current annualized loss expectancy.

Question 3

A retail company's risk committee is reviewing the annual risk assessment. The CISO notes that the organization's stated risk appetite for customer data confidentiality is low, but a business unit wants to launch a loyalty program that shares purchase history with a third-party analytics provider. Which of the following should the CISO do FIRST?

Accepted Answer

Perform a risk assessment of the proposed data sharing and compare the residual risk to the defined risk appetite.. Risk decisions should begin with assessment. The CISO must evaluate the data-sharing risk and compare residual exposure to the organization's low confidentiality appetite before recommending acceptance, mitigation, or rejection. Approving on reputation, escalating without analysis, or rejecting categorically all skip the assessment step that makes the decision defensible.

Answer

Approve the program because the third party has a strong security reputation.

Answer

Reject the program because any third-party data sharing exceeds a low risk appetite.

Answer

Escalate the decision to the board of directors immediately.

Question 4

A financial services firm is building a risk register for its information security program. The CISO wants to ensure the register supports effective risk treatment decisions. Which TWO of the following elements are MOST essential to include for each identified risk? (Choose two.)

Accepted Answer

The risk owner accountable for managing the risk.. A risk owner and assessed likelihood and impact are essential because they enable accountability and prioritization. The owner ensures action is taken, while likelihood and impact ratings allow the CISO to compare risks and decide on treatment. Other details, such as identification date, auditor name or a specific vulnerability, may be useful for context but do not directly drive risk treatment decisions.

Answer

The name of the auditor who reviewed the risk.

Answer

The specific technical vulnerability that generated the risk.

Answer

The date the risk was first identified.

Question 5

An information security manager is reviewing a risk assessment for a core banking application. The assessment shows a high likelihood of insider misuse of privileged accounts and a high impact on regulatory compliance. The application owner proposes adding database activity monitoring, but the budget is limited and the control would take nine months to deploy. Which of the following is the MOST appropriate immediate action?

Accepted Answer

Implement interim compensating controls such as privileged access review, session logging, and least privilege while planning the monitoring deployment.. When a strategic control cannot be deployed quickly, interim compensating controls reduce exposure in the near term. Privileged access reviews, session logging, and least privilege target the insider misuse scenario directly and are feasible within budget. Acceptance, insurance-only transfer, or full delegation do not adequately address a high-likelihood compliance risk during the deployment gap.

Answer

Accept the risk until the monitoring solution is deployed and document the decision.

Answer

Transfer the risk by purchasing cyber insurance covering insider fraud.

Answer

Defer the risk decision to the application owner because they own the budget.

Question 6

A CISO is explaining the concept of risk appetite to a newly formed security steering committee. Which of the following BEST describes risk appetite?

Accepted Answer

The amount and type of risk that the organization is willing to pursue or retain to achieve its objectives.. Risk appetite expresses the amount and type of risk an organization is willing to pursue or retain in pursuit of its objectives. It is a strategic, governance-level concept that sets the boundaries for risk-taking and guides decisions about security investments and risk treatment. It is distinct from tolerance, which defines acceptable variation, and from assessment or residual risk, which are operational concepts.

Answer

The residual risk that remains after all reasonable controls have been implemented.

Answer

The process of identifying, analyzing and evaluating risks to determine their significance.

Answer

The maximum level of risk that the organization can tolerate before exceeding its risk tolerance.

Question 7

A software company is entering a market that requires compliance with a new data protection regulation. The CISO must present a risk-based implementation plan to the executive committee. Which of the following BEST demonstrates alignment between the security program and the organization's compliance obligations?

Accepted Answer

A gap assessment mapping current controls to each regulatory requirement with prioritized remediation based on risk.. A gap assessment that maps controls to regulatory requirements and prioritizes remediation by risk directly demonstrates alignment between the security program and compliance obligations. It gives executives a clear view of exposure and a plan for closure. Tool inventories, commitment statements, and peer benchmarks lack the requirement-to-control mapping needed for a risk-based implementation plan.

Answer

A benchmark comparison showing that peer companies spend more on security.

Answer

A list of all security tools currently deployed with their license costs.

Answer

A statement that the organization will comply with the regulation by the deadline.

Question 8

A security manager is building a risk register for a newly deployed customer relationship management platform. Which TWO of the following entries are most appropriate to record as risks rather than as controls or assets? (Choose two.)

Accepted Answer

A disgruntled employee could export the entire customer database before their account is disabled.. A risk register records uncertain events that could affect objectives, expressed as a threat exploiting a weakness with a potential impact. The misconfigured API exposure and the disgruntled employee data export both meet that definition and require owners, likelihood, impact, and treatment. The access control, redundant data center, and service-level agreement are controls or assurances, not risks.

Answer

The platform enforces role-based access control for all administrative functions.

Answer

The platform is hosted in a tier III data center with redundant power and cooling.

Answer

The vendor's contract includes a 99.9 percent uptime service-level agreement.

Question 9

An information security manager is advising a business unit that wants to launch a customer-facing mobile application in a market with new data protection regulations. The unit's leadership prefers to launch quickly and address compliance later. Which action BEST aligns with effective information security risk management?

Accepted Answer

Perform a risk assessment of the launch against the new regulations and present treatment options with business impact to leadership.. Effective risk management supports business objectives by making risk visible and manageable rather than by blocking initiatives. Assessing the launch against the new regulations and presenting treatment options with their business impact allows leadership to weigh speed against compliance exposure and make a documented, risk-aware decision within their authority.

Answer

Recommend blocking the launch until the security team completes a full independent audit of the application.

Answer

Delegate the regulatory risk decision to the business unit's legal counsel and document the outcome.

Answer

Advise the unit to proceed with the launch and remediate regulatory gaps in a post-launch phase.

Question 10

A security manager is selecting a risk analysis method for a new mobile banking feature. The team has limited historical data, and leadership wants a defensible view of which threats matter most before committing budget. Which approach BEST fits this situation?

Accepted Answer

Qualitative analysis using structured scenario ranking with defined likelihood and impact scales.. When historical loss data is scarce, a structured qualitative analysis using consistent likelihood and impact scales lets the organization rank threats defensibly and allocate budget. It relies on expert judgment but remains repeatable and auditable, and it can transition to quantitative methods as actual incident and loss data become available for the new feature.

Answer

A control self-assessment survey completed by the mobile development team.

Answer

A penetration test of the mobile application to identify exploitable vulnerabilities.

Answer

Quantitative analysis using annualized loss expectancy derived from actuarial tables.

Question 11

An organization's risk appetite statement says it will tolerate only low residual risk for systems processing payment card data. A recent assessment shows a payment gateway with medium residual risk after existing controls. What should the information security manager do NEXT?

Accepted Answer

Document the gap and recommend additional controls to bring residual risk within appetite.. Risk appetite defines the amount of risk the organization is willing to accept, and residual risk above that threshold requires treatment. The manager should document the deviation and recommend additional controls to reduce residual risk to a low level for the payment gateway, then present the options and costs to leadership for a decision consistent with governance.

Answer

Transfer the risk by purchasing cyber insurance and take no further action.

Answer

Accept the residual risk because existing controls already reduce it from high to medium.

Answer

Revise the risk appetite statement so that medium residual risk becomes acceptable.

Question 12

During a major cybersecurity incident, the crisis management team (CMT) is activated. Which THREE roles are typically part of the CMT? (Select THREE.)

Accepted Answer

Chief executive officer (CEO). The Chief Executive Officer (CEO) (A) is a core CMT member because this role owns ultimate business accountability, authorizes major decisions such as taking systems offline or notifying regulators, and communicates with the board and public during a crisis. The General Counsel (GC) (B) belongs on the CMT to assess legal, regulatory, and contractual obligations, including breach-notification laws, litigation risk, and law-enforcement engagement. The Chief Financial Officer (CFO) (E) is included to manage financial impact, authorize emergency spending, handle cyber-insurance claims, and evaluate materiality for financial disclosures. The Security Analyst (C) is a hands-on technical responder who performs triage, log analysis, and containment tasks rather than strategic crisis-management decisions, so is not typically a CMT member. The Incident Response Manager (D) coordinates the tactical incident-response effort and reports to the CMT, but is not itself a standing CMT role.

Answer

Security analyst

Answer

Incident response manager

Question 13

Which is a key component of an information security program?

Accepted Answer

Security policy. A security policy is the foundational component of an information security program because it defines the organization's strategic direction, governance structure, and high-level principles for protecting information assets. Unlike specific technologies (encryption, firewalls, antivirus), the policy establishes the rules, roles, and responsibilities that drive the selection and implementation of all security controls. Without a policy, technical measures lack context, authority, and alignment with business objectives.

Answer

Encryption technology

Answer

Firewall

Answer

Antivirus software

Question 14

A CISO at a financial services firm is aligning the information security program with the business strategy. The organization is pursuing a merger that will significantly expand its customer base and require integration of disparate IT environments. The board wants assurance that security risks are managed during the merger. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a security risk assessment of the target company's environment.. The correct answer is to conduct a security risk assessment of the target company's environment. This step is foundational because it identifies risks that must be managed during the merger. It enables the CISO to provide the board with a clear picture of the security landscape, ensuring that subsequent actions such as strategy updates or control implementations are based on actual risks rather than assumptions.

Answer

Update the information security strategy to include merger integration goals.

Answer

Implement security controls from the acquiring company on the target's systems.

Answer

Develop a security integration plan for post-merger activities.

Question 15

An organization is establishing an information security program. The CISO wants to ensure that the program has the necessary authority and resources. Which of the following is the MOST important to establish first?

Accepted Answer

A formal security charter approved by executive management.. A formal security charter approved by executive management is the most important first step because it establishes the program's authority, scope, and resources. It ensures that security is aligned with business objectives and provides the CISO with the mandate to implement and enforce the program. Without this foundation, other activities may lack support and effectiveness.

Answer

An incident response plan.

Answer

A security awareness training program.

Answer

A comprehensive risk assessment.

Question 16

A CISO is presenting the information security program's value to the board. The board is particularly concerned about the organization's ability to detect and respond to advanced threats. Which of the following metrics would BEST demonstrate the program's effectiveness in this area?

Accepted Answer

The mean time to detect (MTTD) and mean time to respond (MTTR) to advanced threats.. Mean time to detect (MTTD) and mean time to respond (MTTR) are outcome-based metrics that directly reflect the program's ability to detect and respond to threats. They are meaningful to the board because they quantify operational effectiveness and can be benchmarked. Other metrics like incident counts or control counts do not provide the same level of assurance regarding detection and response capabilities.

Answer

The percentage of critical assets covered by continuous monitoring.

Answer

The number of security incidents detected per quarter.

Answer

The total number of security controls implemented across the enterprise.

Question 17

A startup company is developing its first information security program. The CISO has been asked to present a business case to the executive team for funding the program. The CISO wants to demonstrate how the program will support business objectives and manage risk. Which of the following should the CISO include in the business case to BEST achieve this?

Accepted Answer

An analysis of the potential financial impact of security incidents and how the program will mitigate those risks to protect revenue and reputation.. An analysis of potential financial impact and risk mitigation directly aligns the security program with business objectives by showing how it protects revenue and reputation. Executives are more likely to fund initiatives that clearly address business risk and demonstrate a return on investment. This approach makes the business case compelling and strategic.

Answer

A detailed list of all security controls that will be implemented and their associated costs.

Answer

A comparison of the company's security posture to industry benchmarks and competitor practices.

Answer

A timeline for achieving compliance with relevant regulations such as GDPR or HIPAA.

Question 18

A security manager is integrating security into the organization's project management lifecycle. A new customer relationship management (CRM) system is being deployed. At which phase should the security team be involved to ensure that security requirements are addressed?

Accepted Answer

During the requirements gathering phase.. Security should be involved from the requirements gathering phase to ensure that security requirements are identified and incorporated early. This proactive approach reduces costs and risks. Later phases are for validation and verification, but they cannot compensate for missing requirements.

Answer

During the testing phase.

Answer

During the post-implementation review.

Answer

During the deployment phase.

Question 19

A multinational corporation operates in multiple jurisdictions with varying data protection laws. The CISO is establishing a governance structure to manage compliance with these laws while maintaining a consistent security posture. Which of the following is the MOST effective approach for the CISO to take?

Accepted Answer

Develop a common governance framework with baseline controls, supplemented by local addenda to address specific regulatory requirements.. The most effective approach is a common governance framework with baseline controls and local addenda. This ensures a consistent global security posture while allowing for compliance with varying local laws. It provides centralized oversight and scalability, avoiding the pitfalls of a one-size-fits-all policy or full decentralization. This hybrid model is a recognized best practice for multinational governance.

Answer

Delegate compliance responsibility entirely to local business units to tailor security controls to each jurisdiction.

Answer

Adopt the regulatory requirements of the headquarters country as the global standard for all locations.

Answer

Implement a single global security policy that meets the strictest regulatory requirements across all jurisdictions.

Question 20

An organization's information security program has a risk management process that identifies and assesses risks. However, the CISO notices that risk treatment decisions are often delayed, and some high-risk items remain unaddressed for months. Which of the following is the MOST likely root cause?

Accepted Answer

Risk treatment responsibilities and decision authorities are not clearly defined.. The most likely root cause is that risk treatment responsibilities and decision authorities are not clearly defined. Effective risk management requires that each risk has an owner who is accountable for treatment decisions, and that decision-making authority is established. Without this clarity, risks may be assessed but not acted upon, causing delays and leaving high-risk items unaddressed.

Answer

The risk assessment methodology is not quantitative.

Answer

The organization lacks a formal risk register.

Answer

Senior management does not review the risk assessment results.