CISM Practice Exam 57 — 20 Questions

Question 1

An organization's incident response plan includes a communication tree that lists internal contacts and external parties. During a moderate incident, the incident manager must notify the party responsible for making binding decisions about public statements and regulatory disclosures. Which role should be contacted for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The legal counsel or chief legal officer. Decisions about public statements and regulatory disclosures require legal authority because they carry statutory, contractual, and liability implications. Legal counsel evaluates notification deadlines, privilege, and the accuracy of messaging. Technical roles supply facts, and vendors supply their own obligations, but neither can authorize the organization's external communications or regulatory filings during an incident.

Answer

The third-party cloud hosting provider's account manager

Answer

The security operations center (SOC) shift lead

Answer

The IT service desk manager

Question 2

An organization is defining the composition of its incident response team. Which role is PRIMARILY responsible for coordinating communication with the media and the public during a high-profile incident?

Accepted Answer

The public relations or communications lead.. External communication during a high-profile incident belongs to a designated communications or public relations lead who can align messaging with legal requirements and executive direction. This separation keeps technical responders focused on containment and recovery while ensuring the organization speaks with one consistent voice. Legal counsel reviews for risk, and the incident response manager supplies accurate technical context, but neither owns the media and public communication role.

Answer

The legal counsel.

Answer

The IT operations director.

Answer

The incident response manager.

Question 3

A CISO is developing a business case for a new security initiative. The organization's executives are focused on cost reduction and operational efficiency. Which of the following approaches is BEST to gain executive support?

Accepted Answer

Present the initiative in terms of risk reduction and its impact on business objectives.. Presenting the initiative in terms of risk reduction and its impact on business objectives is most effective because it speaks the language of executives. It demonstrates how security contributes to the organization's strategic goals, such as protecting revenue, enabling growth, and reducing potential financial losses, thereby making a compelling business case.

Answer

Provide a detailed list of vulnerabilities that the initiative will address.

Answer

Emphasize the technical superiority of the proposed security controls.

Answer

Highlight compliance requirements that mandate the security controls.

Question 4

A financial services firm is defining the scope of its information security management system. The CISO must decide which assets and processes fall under the programme's governance. Which criterion should PRIMARILY drive scoping decisions?

Accepted Answer

The criticality of the business processes and information the assets support. Governance scope should be anchored to business criticality and information sensitivity, because that is where disruption, regulatory breach, or data loss would cause the greatest harm. Location, user population, and sourcing model are attributes that shape how controls are applied once an asset is in scope, but none of them reliably identifies which assets warrant programme governance in the first place.

Answer

The physical location of the data center hosting each system

Answer

The number of users who have accounts on each application

Answer

Whether the system was purchased or developed in-house

Question 5

A newly appointed CISO is formalizing the information security programme charter. The CIO asks which element MUST be documented in the charter to enable the CISO to enforce policy across business units that do not report to the CIO. Which element is MOST important to include?

Accepted Answer

A statement of the security programme's authority, scope, and mandate approved by executive leadership. A programme charter derives its force from executive endorsement of the security function's authority, scope, and mandate. That endorsement is what lets the CISO issue binding policy to business units beyond their own reporting line. Operational inventories, regulatory texts, and product roadmaps are supporting artifacts that change often and carry no governance authority, so they cannot resolve the enforcement question the CIO raised.

Answer

The full text of every regulatory requirement the organization must satisfy

Answer

A detailed inventory of every security tool currently deployed across the enterprise

Answer

A three-year roadmap listing specific security products planned for procurement

Question 6

An organization's incident response team is reviewing its post-incident activities after resolving a significant security incident. Management wants to ensure lessons learned are captured and that the response capability improves over time. Which TWO of the following activities are MOST important to include in the post-incident phase? (Choose two.)

Accepted Answer

Conduct a structured lessons-learned review with responders and stakeholders to identify gaps and assign improvement actions.. The post-incident phase exists to convert experience into improved capability. A structured lessons-learned review surfaces technical, procedural, and communication gaps and converts them into assigned corrective actions. Updating plans, playbooks, and contact lists based on validated findings ensures those improvements are institutionalized and available for the next event. Together, these activities close the improvement loop and build a more resilient response capability over time.

Answer

Immediately close the incident ticket and archive all communications to reduce administrative overhead.

Answer

Terminate all personnel who were involved in the incident response to reinforce accountability.

Answer

Publicly disclose full technical details of the incident to demonstrate transparency to competitors.

Question 7

An organization's incident response plan requires that evidence be collected in a forensically sound manner. A responder is about to capture volatile data from a compromised server. Which action BEST preserves the integrity of the evidence?

Accepted Answer

Document the system state, capture volatile data in order of volatility, and maintain a chain of custody.. Sound forensic collection follows the order of volatility, capturing memory and network state before disk, while documenting actions and maintaining chain of custody. Rebooting, powering off, or running antivirus modifies or destroys evidence. CISM stresses that evidence must be preserved in a manner that supports both incident analysis and potential legal or regulatory proceedings.

Answer

Run a full antivirus scan and allow it to quarantine any detected threats before collecting data.

Answer

Reboot the server first to clear any malicious processes before collecting data.

Answer

Immediately power off the server and store the hard drive in a secure location.

Question 8

A security manager is reviewing the organization's incident response capabilities. During a tabletop exercise, participants struggled to determine who has authority to shut down a critical production system during a suspected incident. Which action BEST addresses this gap?

Accepted Answer

Document and communicate clear decision-making authority and escalation paths in the incident response plan. The tabletop exercise revealed that the organization lacks clarity on decision-making authority during incidents. The most effective remedy is to define and communicate who can make high-impact decisions, such as shutting down production, and under what conditions. Documenting escalation paths ensures that responders know when and to whom to escalate. Technical controls and additional certifications do not resolve governance ambiguity, which is the root cause of the observed struggle.

Answer

Require all incident responders to obtain a forensic certification before the next exercise

Answer

Increase the frequency of technical vulnerability scans on the critical production system

Answer

Implement an automated tool that shuts down production systems when malware is detected

Question 9

A CISO is reviewing the information security program's performance measurement framework. The organization wants to ensure that the metrics used are effective in demonstrating the program's value to senior management. Which of the following are characteristics of effective security metrics? (Choose two.)

Accepted Answer

They are directly linked to business objectives.. Effective security metrics are directly linked to business objectives and are consistently measurable over time. These characteristics ensure that metrics demonstrate how security supports the organization's strategic goals and allow for trend analysis and benchmarking. They provide senior management with meaningful information to make informed decisions about the security program.

Answer

They are focused on technical vulnerabilities.

Answer

They are based on the number of security incidents.

Answer

They are updated in real time.

Question 10

An organization is building a security metrics program. The CISO wants to ensure metrics drive improvement rather than just report status. During a review, the team debates whether a specific metric is a key performance indicator (KPI) or a key risk indicator (KRI). Which characteristic BEST distinguishes a KRI from a KPI in a security program?

Accepted Answer

A KRI provides early warning of increasing risk exposure.. A key risk indicator is forward-looking, providing early warning of increasing risk exposure so leadership can act before incidents occur. A key performance indicator measures how well processes meet targets. The CISO should use KRIs to anticipate risk and KPIs to assess operational effectiveness, ensuring the metrics program supports proactive risk management.

Answer

A KRI is always a lagging indicator of past incidents.

Answer

A KRI is reported only to the board, while a KPI is reported to management.

Answer

A KRI measures how well security processes are performing against targets.

Question 11

A security manager is establishing a security metrics program to report to executive management. Which TWO of the following are characteristics of effective security metrics? (Choose two.)

Accepted Answer

They are aligned with business objectives.. Effective security metrics are aligned with business objectives and are actionable, leading to decisions. These characteristics ensure that metrics are relevant to executive management and support strategic oversight. Other traits, such as ease of collection or technical jargon, do not guarantee effectiveness.

Answer

They remain static over time.

Answer

They are based on data that is easy to collect.

Answer

They are expressed in technical jargon.

Question 12

A CISO is building a new information security program for a multinational financial services firm. The board has approved a budget but wants assurance that security investments are aligned with business objectives. Which of the following should the CISO do FIRST to establish this alignment?

Accepted Answer

Conduct a comprehensive risk assessment to identify and prioritize threats to business objectives.. The correct answer is to conduct a risk assessment first. This step identifies which business objectives are at risk and prioritizes threats, enabling the CISO to align security investments with what the business values most. It provides the evidence needed to justify budget allocation and ensures that subsequent security activities are driven by business needs rather than technology or compliance alone.

Answer

Develop a security awareness training program for all employees.

Answer

Adopt an industry-recognized framework such as ISO/IEC 27001 to structure the program.

Answer

Implement a security information and event management (SIEM) system to monitor for threats.

Question 13

A security manager is defining the incident classification scheme for a multinational retailer. Executive leadership wants to know which incidents will trigger a formal crisis management team (CMT) activation. Which criterion should PRIMARILY determine whether an incident is classified as a crisis-level event?

Accepted Answer

The incident has the potential to cause significant harm to the organization's brand, finances, or regulatory standing.. Crisis-level classification hinges on the potential for enterprise-wide harm to reputation, finances, operations, or regulatory compliance. This impact-based threshold ensures the CMT is convened only when executive authority, cross-functional coordination, and external stakeholder management are genuinely required. Detection source, staffing needs, and asset criticality labels are useful inputs but cannot by themselves indicate that an incident has crossed the crisis threshold.

Answer

The incident requires more than one analyst to investigate and remediate within the standard service-level agreement.

Answer

The incident was detected by the security operations center (SOC) outside of normal business hours.

Answer

The incident affects a system that is listed in the configuration management database (CMDB) as business-critical.

Question 14

During a major incident, the incident response team determines that the attacker used compromised credentials of a privileged administrator. The team wants to prevent the attacker from re-entering while keeping the business running. Which of the following is the MOST appropriate containment action?

Accepted Answer

Disable the compromised administrator account and rotate all credentials for privileged accounts.. The most effective containment against credential-based intrusion is to remove the compromised access and invalidate related secrets. Disabling the known compromised administrator account stops the confirmed entry path, while rotating all privileged credentials closes the likely other paths the attacker obtained. This approach contains the threat without unnecessarily halting business operations, which reflects CISM's balance between security response and business continuity. Blanket shutdowns and passive monitoring fail to remove the adversary's access.

Answer

Enable full packet capture on the network and continue monitoring for attacker activity.

Answer

Reset the password on the compromised administrator account only and force a change at next logon.

Answer

Shut down all servers that the administrator account could access until the investigation is complete.

Question 15

A CISO is reviewing the information security strategy and needs to ensure that security investments are justified in business terms. The CFO has requested that each security initiative be tied to a financial metric that reflects potential loss from cyber events. Which approach is MOST appropriate for the CISO to use?

Accepted Answer

Calculate the annualized loss expectancy (ALE) for each initiative based on risk assessment data.. Using annualized loss expectancy translates risk into monetary terms, enabling direct comparison of security initiatives against expected financial loss. This aligns security governance with business objectives and provides the CFO with a quantifiable basis for investment decisions, which is a core CISM principle for integrating security into business strategy.

Answer

Benchmark the organization's security budget against industry peers.

Answer

Track the percentage of employees who completed security awareness training.

Answer

Report the number of security incidents detected per quarter.

Question 16

A financial services firm has completed a business impact analysis (BIA). The CISO must now ensure the information security programme's recovery priorities are consistent with the BIA results. Which action should the CISO take NEXT?

Accepted Answer

Update the disaster recovery plan to reflect the recovery time objectives (RTOs) and recovery point objectives (RPOs) identified in the BIA.. The BIA defines critical processes and their RTOs and RPOs. To make the security programme consistent with these findings, the CISO must ensure disaster recovery and related plans are updated so that systems and data can be restored within the required timeframes. This is a direct, necessary step before validating or transferring risk.

Answer

Conduct a penetration test of the disaster recovery site to validate its security posture.

Answer

Launch a security awareness programme focused on business continuity responsibilities.

Answer

Increase the cybersecurity insurance coverage to transfer residual risk identified in the BIA.

Question 17

During a major incident, the incident response manager must decide whether to declare a crisis and activate the crisis management team (CMT). Which factor is MOST important in making that decision?

Accepted Answer

The potential impact on critical business functions and the need for executive-level coordination.. CISM ties crisis declaration to significant business impact and the need for executive-level coordination. The CMT exists to provide strategic direction, resource prioritization, and stakeholder management during severe incidents. Alert volume, detection source, and shift staffing are operational details that do not by themselves determine whether a crisis should be declared.

Answer

The availability of the on-call incident responder during the current shift.

Answer

Whether the incident was detected by an external party rather than internal monitoring.

Answer

The number of alerts generated by the SIEM in the last hour.

Question 18

An organization's security steering committee includes representatives from business units, IT, legal, and risk management. The CISO must decide which function this committee should perform within the information security programme.

Accepted Answer

Approve the strategic direction of the security programme and prioritize security initiatives against business objectives.. A security steering committee is a governance body whose purpose is to align the security programme with business strategy, approve direction, and prioritize initiatives using cross-functional input. Its membership of business, IT, legal, and risk leaders fits strategic decision-making. Operational execution and independent audit are deliberately separated from this body to preserve both efficiency and objectivity.

Answer

Perform daily monitoring of security alerts and coordinate the response to detected incidents.

Answer

Conduct technical vulnerability assessments of critical systems and track remediation activities.

Answer

Independently audit the security programme's controls and report findings directly to external regulators.

Question 19

A global retailer's security programme has grown organically: each region maintains its own policies, risk register, and incident process. The board asks the CISO to align the programme with a recognized standard so performance can be compared across regions. Which action should the CISO take FIRST?

Accepted Answer

Perform a gap assessment of current regional practices against the chosen framework. Comparability across regions requires a common reference framework plus a factual baseline of where each region stands against it. A gap assessment delivers both, giving the CISO evidence to prioritize remediation, allocate budget, and report progress to the board. Mandating uniform policy, buying tooling, or auditing everything at once all presume knowledge the CISO does not yet have and skip the diagnostic step that makes the board's comparison meaningful.

Answer

Mandate that all regions immediately adopt the headquarters policy set unchanged

Answer

Procure an integrated GRC platform to consolidate all regional risk registers

Answer

Commission an external audit of every regional security control simultaneously

Question 20

A security analyst receives an alert indicating that a workstation is communicating with a known malicious command-and-control server. The analyst confirms the alert is a true positive. According to CISM best practices, which of the following should the analyst do FIRST?

Accepted Answer

Isolate the workstation from the network to prevent further communication.. When a true positive is confirmed, the immediate priority is containment to stop the threat from spreading or causing further harm. Isolating the workstation cuts off command-and-control communication while preserving the system for investigation. This follows the standard incident response sequence of identification, containment, eradication, and recovery, and supports both security and forensic objectives.

Answer

Shut down the workstation to stop the malware.

Answer

Notify the CEO and board of directors about the incident.

Answer

Run a full antivirus scan on the workstation.