CISM Practice Exam 57 — 20 Questions

Question 1

Which TWO actions are key components of the 'Containment' phase in incident response?

Accepted Answer

Implementing temporary workarounds to stop damage. Containment is the immediate priority in incident response to stop the spread of damage and prevent further compromise. Implementing temporary workarounds—such as isolating affected systems, blocking malicious IPs via firewall rules, or disabling compromised accounts—directly halts the incident's impact without waiting for full eradication or recovery. Option E is also correct because deploying patches or configuration changes can serve as a containment measure by closing the vulnerability that allowed the attack, thereby preventing the attacker from re-entering or continuing the exploit.

Answer

Restoring systems from backups

Answer

Eradicating malware from infected systems

Answer

Writing a final incident report

Question 2

An organization's incident response plan includes a step to 'contain the incident.' Which of the following actions is an example of containment?

Accepted Answer

Disconnecting an infected workstation from the network. Disconnecting an infected workstation from the network is a classic containment action because it immediately isolates the compromised system, preventing the spread of malware or unauthorized lateral movement to other hosts. Containment focuses on limiting the scope and impact of an incident, not on remediation or investigation. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is performed before eradication and recovery.

Answer

Restoring data from backup

Answer

Analyzing log files to determine the attack vector

Answer

Removing malware from the system

Question 3

A technology startup has grown rapidly and its risk management practices are informal. The CEO has a very high risk appetite and frequently overrides risk management recommendations to accelerate product launches. After a serious data breach involving customer payment information, the board of directors demands a formal risk management program. The risk manager is tasked with changing the risk culture. The startup has limited resources but must meet contractual obligations to protect customer data. What is the most effective first step?

Accepted Answer

Develop and communicate a revised risk appetite statement approved by the board. Developing and communicating a revised risk appetite statement approved by the board directly addresses the need to formalize risk management and change the risk culture. It provides clear guidance for decision-making, aligns with the board's demands, and respects the startup's limited resources by focusing on policy first. Other options are premature: deploying technical controls without policy support may be ineffective, outsourcing does not change internal culture, and terminating the CEO is an HR action that does not establish a risk program.

Answer

Outsource all information security operations to a managed service provider

Answer

Immediately deploy a suite of technical security controls

Answer

Recommend the termination of the CEO for previous risk decisions

Question 4

An organization has implemented a data classification policy but notices that employees often mark documents as 'internal use only' even when they contain personally identifiable information (PII). Which of the following is the most effective corrective action for the information security program?

Accepted Answer

Deploy a data loss prevention (DLP) system that automatically classifies documents based on content inspection.. Deploying a data loss prevention (DLP) system that automatically classifies documents based on content inspection directly addresses the root cause of misclassification by removing reliance on user judgment. Option A (policy revision) alone does not enforce compliance. Option B (audits and reprimands) is punitive and may not change behavior. Option C (training) can help but is less effective than automation for consistent classification.

Answer

Revise the data classification policy to simplify categories.

Answer

Conduct random audits and reprimand employees who misclassify data.

Answer

Increase the frequency of data classification training for all employees.

Question 5

Based on the exhibit, what is the first action the incident response team should take?

Accepted Answer

Review the web server logs on 192.168.1.10 for evidence of exploitation.. The first action in incident response is to validate the alert by examining the web server logs on 192.168.1.10. This confirms whether the IDS alert corresponds to actual exploitation, such as a SQL injection attempt or directory traversal, before taking containment or eradication steps. Reviewing logs provides forensic evidence and ensures the response is based on confirmed facts, not assumptions.

Answer

Confirm the IDS alert is not a false positive.

Answer

Block the source IP 10.5.5.5 on the firewall.

Answer

Disable the firewall rule 'Allow-Internal-Web'.

Question 6

An incident response team discovers that an employee's workstation is infected with malware. The workstation contains sensitive customer data. Which of the following is the MOST appropriate containment strategy?

Accepted Answer

Disconnect the workstation from the network.. Disconnecting the workstation from the network (Option C) is the most appropriate containment strategy because it immediately stops the malware from communicating with command-and-control servers, prevents lateral movement to other systems, and preserves the volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes isolation over destruction or data exfiltration risk.

Answer

Shut down the workstation immediately.

Answer

Perform a full system wipe and reinstall the OS.

Answer

Copy all files to a secure server and then disconnect.

Question 7

During a risk assessment, a CISM identifies that the organization's data backup process has a single point of failure. The backup server is located in the same data center as the primary server. Which risk response is most appropriate?

Accepted Answer

Mitigate by moving the backup server to a geographically separate location.. Moving the backup server to a geographically separate location directly eliminates the single point of failure by ensuring that a localized disaster (e.g., fire, flood, power outage) at the primary data center does not simultaneously destroy both the primary and backup data. This is a classic risk mitigation strategy that reduces the likelihood and impact of data loss, aligning with the principle of geographic redundancy for disaster recovery.

Answer

Transfer the risk by purchasing business interruption insurance.

Answer

Avoid the risk by discontinuing the backup process.

Answer

Accept the risk because the cost of mitigation is high.

Question 8

Which of the following are key components of an information security risk management program? (Select TWO)

Accepted Answer

Risk assessment. Risk assessment is a core component of an information security risk management program because it systematically identifies, analyzes, and evaluates risks to information assets. It provides the foundational understanding of threats, vulnerabilities, and impacts necessary for informed decision-making. Without a formal risk assessment, the program lacks the data needed to prioritize and justify security investments.

Answer

Vulnerability scanning

Answer

Incident response

Question 9

After a ransomware incident, the incident response team contains the spread and begins eradication. The team discovers that the ransomware encrypted files on a file server and also deleted shadow copies. Which of the following should the team do NEXT to support recovery?

Accepted Answer

Create a forensic image of the file server and affected endpoints.. After containment and eradication, the priority is to preserve evidence for root cause analysis and potential legal action. Creating a forensic image of the file server and affected endpoints captures the ransomware artifacts, encryption keys, and system state before any recovery actions that could overwrite critical data. This aligns with the CISM incident management phase of 'lessons learned' and ensures the team can determine the attack vector and prevent recurrence.

Answer

Restore the encrypted files from the most recent backup.

Answer

Attempt to decrypt the files using available decryption tools.

Answer

Notify law enforcement immediately.

Question 10

During an incident investigation, the security team discovers that an attacker exfiltrated sensitive customer data via encrypted DNS tunneling over a period of three months. The data loss was only noticed after a routine audit. Which of the following weaknesses MOST likely allowed the attacker to remain undetected for so long?

Accepted Answer

Inadequate monitoring of DNS traffic for anomalies. DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.

Answer

Weak password policies

Answer

Unpatched web server software

Answer

Lack of data-at-rest encryption

Question 11

Which metric is most indicative of security program effectiveness?

Accepted Answer

Time to patch critical vulnerabilities. Time to patch critical vulnerabilities directly reflects the organization's ability to reduce exposure to known exploits, which is a key outcome of an effective security program. Unlike input metrics (budget, tools) or lagging indicators (incident count), this metric measures the speed of a critical risk-reduction process, aligning with CISM's focus on program governance and risk management.

Answer

Security budget spent

Answer

Number of security tools deployed

Answer

Number of security incidents

Question 12

TechStart, a cloud-based startup, has rapidly grown from 50 to 500 employees. It lacks a formal security governance structure. The CEO asks the CISO to develop one. The CISO finds that the company's culture values speed over compliance. The board expects a governance framework within three months. What is the most practical approach?

Accepted Answer

Start with a lean governance model, focusing on critical assets and compliance requirements. The most practical approach because it balances the need for governance with the company's culture of speed. Starting with a lean governance model allows the organization to quickly establish controls for critical assets and meet compliance requirements without overwhelming the team. Option A is too heavy; a full COBIT implementation would be disruptive and counter to the culture. Option B is risky as it postpones governance, potentially leading to non-compliance. Option D focuses only on technical controls, ignoring the broader governance framework needed.

Answer

Implement a full COBIT framework immediately

Answer

Defer governance until after the next product launch

Answer

Focus solely on technical controls like firewalls and IAM

Question 13

A company is developing a risk treatment plan for a set of identified risks. One risk involves a third-party vendor that hosts critical data. The risk owner recommends accepting the risk. Which of the following conditions would BEST support this decision?

Accepted Answer

The cost to mitigate is higher than the potential financial loss from a breach. Risk acceptance is justified when the cost of mitigation exceeds the potential financial loss from a breach. This aligns with the cost-benefit analysis principle in risk management: if the cost to implement controls (e.g., migrating to a more secure vendor or adding encryption) is higher than the expected loss (e.g., $50,000 in breach costs vs. $100,000 in mitigation), accepting the residual risk is economically rational. The decision must still ensure the risk is within the organization's risk appetite.

Answer

The organization has no compensating controls in place

Answer

The risk is within the organization's risk appetite but the business impact is high

Answer

The vendor has a history of security incidents

Question 14

You are the CISO of a mid-sized financial services firm that processes credit card transactions. The company has recently expanded its operations to include a mobile payment application that stores payment credentials in the cloud. The current information security program was designed primarily for the on-premises environment and has not been updated to address cloud-specific risks. The internal audit team has identified that the cloud service provider (CSP) does not have an independent third-party audit report (e.g., SOC 2) available for review. Additionally, the mobile app development team has been deploying code without formal security review, citing the need for rapid releases to compete in the market. The CEO has expressed concern about the potential for a data breach and has asked you to recommend immediate actions to strengthen the security program while minimizing business disruption. Which of the following should you recommend as the FIRST course of action?

Accepted Answer

Conduct a detailed security assessment of the cloud service provider's controls and contractually require an annual SOC 2 Type II report.. The correct first course of action because the absence of an independent third-party audit report (e.g., SOC 2 Type II) means the organization has no verified assurance that the cloud service provider (CSP) has adequate security controls in place. As CISO, you must immediately assess the CSP's security posture and contractually mandate a SOC 2 Type II report to gain visibility into the effectiveness of the CSP's controls over time, which is foundational before implementing any compensating technical controls. This aligns with the CISM domain of Information Security Program governance, where vendor risk management and due diligence are critical first steps when expanding into cloud environments.

Answer

Encrypt all data in transit and at rest using the organization's own encryption keys.

Answer

Implement compensating controls such as tokenization for all cardholder data stored in the cloud.

Answer

Require the mobile app development team to undergo formal security training and implement a peer review process for all code deployments.

Question 15

Refer to the exhibit. An audit reveals that 20% of privileged accounts were approved by the same manager without secondary review. Which control deficiency is MOST relevant to this finding?

Accepted Answer

Segregation of duties. The finding that 20% of privileged accounts were approved by the same manager without secondary review directly violates the principle of segregation of duties (SoD). In privileged access management (PAM), SoD requires that the approval of privileged account access be performed by a different individual than the requester or the manager who supervises the requester, to prevent a single point of failure and reduce the risk of unauthorized access or fraud. Without a secondary review, a single manager could approve accounts for themselves or their subordinates without independent oversight, undermining the control objective of preventing conflicts of interest.

Answer

Access review frequency

Answer

Provisioning delay

Answer

Audit log retention

Question 16

A company's security program includes a policy that prohibits the use of personal devices for work. However, the CISO discovers that several executives are using personal tablets to access corporate email. What is the most appropriate action for the CISO to take?

Accepted Answer

Update the policy to allow personal devices under strict controls. The CISO must align security controls with business reality. Rather than enforcing an unworkable policy that executives are already circumventing, the CISO should update the policy to incorporate a mobile device management (MDM) solution that enforces device encryption, remote wipe, and conditional access via Azure AD or similar identity provider. This approach reduces risk by bringing personal devices under formal governance while maintaining executive productivity.

Answer

Block all personal devices from the network

Answer

Continue monitoring but take no action

Answer

Discipline the executives for policy violation

Question 17

You are the CISO of a mid-sized manufacturing company. The company has grown rapidly through acquisitions, and each subsidiary has its own information security program. There is no centralized governance, and recent security incidents have occurred due to inconsistent policies. The board has asked you to create a unified information security program that balances flexibility with control. Each subsidiary has unique operational processes and varying levels of security maturity. You have limited budget and cannot replace all local security teams. Which approach should you take?

Accepted Answer

Develop a minimum security standard (MSS) and a phased implementation roadmap based on risk.. Correct answer is B because developing a minimum security standard (MSS) and a phased implementation roadmap based on risk allows each subsidiary to implement controls based on their unique risk profiles while ensuring a common baseline. This approach balances flexibility with control, respects varying maturity levels, and avoids disruption. Option A (immediate enterprise-wide policy) ignores diverse operational processes and may cause resistance. Option C (centralize all security operations) is costly and impractical given the budget and local teams. Option D (adopt the most mature subsidiary's program) may not fit the context of less mature units.

Answer

Immediately mandate compliance with a new enterprise-wide security policy.

Answer

Centralize all security operations and disband local teams.

Answer

Adopt the most mature subsidiary's program as the enterprise standard.

Question 18

A company has recently adopted COBIT 2019 as its governance framework. The board is requesting a concise report on the effectiveness of the security program. Which reporting structure best aligns with COBIT's guidance?

Accepted Answer

Dashboard showing alignment of security goals with enterprise goals, using KRIs and KPIs. COBIT 2019 emphasizes the alignment of IT and security goals with enterprise goals through a cascading goals cascade. A dashboard that maps security goals to enterprise goals using Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) directly reflects this principle, providing a concise, strategic view of program effectiveness rather than operational details.

Answer

List of all security incidents and their impacts

Answer

Compliance status with all applicable regulations

Answer

Detailed technical vulnerabilities discovered during penetration tests

Question 19

A security analyst detects a potential data exfiltration from a critical server. According to incident response best practices, what is the first action the analyst should take?

Accepted Answer

Review firewall logs to confirm the exfiltration.. When a potential data exfiltration is detected but not confirmed, incident response best practices prioritize verification before containment. Immediate disconnection (Option A) could cause unnecessary disruption, alert the attacker, or destroy evidence. The first step is to review firewall logs (Option C) to determine if exfiltration is actually occurring, then proceed with containment and other actions accordingly.

Answer

Disconnect the server from the network immediately.

Answer

Notify the incident response manager.

Answer

Take a forensic image of the server.

Question 20

During a P1 (critical) security incident involving a ransomware attack that has encrypted critical servers, which role is primarily responsible for coordinating the overall response and ensuring timely communication to executive leadership?

Accepted Answer

Incident response manager. In a P1 ransomware incident, the incident response manager (IRM) is responsible for orchestrating the overall response, prioritizing containment over eradication, and ensuring that executive leadership receives timely, accurate status updates. Unlike technical roles, the IRM owns the incident command structure, coordinates cross-functional teams, and manages communication escalations to stakeholders, which is critical when encrypted servers demand immediate business continuity decisions.

Answer

Security analyst

Answer

Forensic investigator

Answer

Communications lead