CISM Practice Exam 58 — 20 Questions

Question 1

A security manager is tasked with building a business case for a new security program. Which metric is most persuasive to senior management?

Accepted Answer

Estimated financial exposure from unmitigated risks.. Senior management is primarily concerned with financial impact and risk exposure. Estimated financial exposure from unmitigated risks directly translates technical vulnerabilities into monetary terms, enabling informed budget decisions. This aligns with the CISM focus on aligning security programs with business objectives.

Answer

Number of security incidents detected per month.

Answer

Percentage of systems patched within 30 days.

Answer

Hours spent on security training.

Question 2

An organization is implementing CIS Controls v8. Which THREE of the following are implementation groups (IGs) defined in the CIS Controls?

Accepted Answer

IG1: Basic cyber hygiene for small organizations.. CIS Controls v8 defines three implementation groups: IG1 (basic cyber hygiene), IG2 (intermediate), and IG3 (advanced) based on organization size and risk.

Answer

IG4: Cloud-specific controls for cloud-first organizations.

Answer

IG0: Minimal controls for non-critical systems.

Question 3

Refer to the exhibit. An organization uses these firewall rules. After a breach, the IR team finds that the attacker gained access via SSH from an external IP. Which rule is most likely misconfigured?

Accepted Answer

SSH is allowed from any source instead of only internal. The firewall rule allowing SSH from any source (0.0.0.0/0) is misconfigured because it permits external attackers to attempt brute-force or credential-based access via TCP port 22. The principle of least privilege dictates that SSH should be restricted to specific internal IP ranges or management jump hosts, not exposed to the internet. The IR team's finding that the attacker gained access via SSH from an external IP directly confirms this rule as the root cause.

Answer

MySQL should be blocked entirely

Answer

RDP should not be allowed

Answer

HTTPS should be inspected

Question 4

A company is developing a business case for a new security tool. Which metric best demonstrates the value of the investment?

Accepted Answer

Security investment vs. loss avoidance. Comparing security investment to potential loss avoidance quantifies ROI in business terms.

Answer

Number of security incidents

Answer

Percentage of budget spent on security

Answer

Time to implement the tool

Question 5

A company's security steering committee includes representatives from Human Resources, Legal, and Risk Management, but not from Business Operations. What is the most likely consequence of this membership gap?

Accepted Answer

Security policies may not align with operational processes. Without Business Operations representation, the security steering committee lacks direct insight into how security policies will interact with day-to-day operational workflows. This gap often results in policies that are technically sound but impractical to implement, causing misalignment with existing processes and potential operational friction.

Answer

Data breaches will occur more frequently

Answer

Security spending will increase unexpectedly

Answer

The company will face regulatory fines

Question 6

Match each cryptographic term to its description.

Accepted Answer

Symmetric Encryption: Uses a single shared key for both encryption and decryption. The correct matches are: Symmetric Encryption uses a shared key, Asymmetric Encryption uses a key pair, and Hash Function produces a one-way digest. Distractors confuse the purpose of digital signatures and the nature of PKI.

Answer

Digital Signature: Ensures confidentiality of data

Answer

Public Key Infrastructure (PKI): Uses a single shared key for both encryption and decryption

Question 7

Refer to the exhibit. An organization is implementing access controls for a new data repository that will store financial reports classified as Category C. Which of the following is the MOST appropriate control to include?

Accepted Answer

Require encryption of data in transit. Requiring encryption of data in transit (e.g., TLS 1.3, IPsec) is the most appropriate control because Category C financial reports are sensitive and must be protected from interception during transmission over networks. This aligns with the principle of protecting data confidentiality and integrity at the network layer, which is a fundamental security control for any data repository handling classified information.

Answer

Implement role-based access control (RBAC)

Answer

Enforce dual control for access

Answer

Conduct quarterly access reviews

Question 8

Which THREE of the following are key indicators of a mature information security governance process? (Select exactly three.)

Accepted Answer

Security risk appetite is defined and reported to the board. Defining and reporting security risk appetite to the board is a foundational governance activity that ensures executive oversight and alignment of risk tolerance with business strategy. In a mature governance process, the board must formally approve and periodically review the risk appetite statement, which directly influences resource allocation and control prioritization. This aligns with the ISACA CISM framework, which emphasizes that governance requires board-level engagement with risk appetite as a key performance indicator.

Answer

Mean time to patch critical vulnerabilities is under 48 hours

Answer

Number of security incidents decreased by 20% year-over-year

Question 9

A multinational organization is implementing a vendor risk management programme. Which THREE of the following should be included in the programme to effectively manage nth-party risk? (Select THREE.)

Accepted Answer

Include contractual clauses that require vendors to pass down security requirements to subcontractors. To manage nth-party risk, the programme should require vendors to disclose their subcontractors, include contractual clauses flowing down security requirements, and have the right to audit subcontractors. Assessing all suppliers' suppliers is impractical; focusing on high-risk vendors is more feasible.

Answer

Conduct annual security assessments of all subcontractors

Answer

Require vendors to obtain insurance for subcontractors

Question 10

Which TWO are key elements of a security awareness program designed to change employee behavior?

Accepted Answer

Role-based training tailored to specific job functions. Role-based training tailors content to job functions, and phishing simulations with remediation training reinforce learning.

Answer

Annual compliance training for all employees

Answer

Posters and newsletters about security topics

Question 11

A security manager is developing a security scorecard for the C-suite. Which combination of metrics would be MOST appropriate for a one-page dashboard?

Accepted Answer

Patch compliance percentage and mean time to detect incidents.. A one-page dashboard for the C-suite should include both leading and lagging indicators that provide a high-level view of security posture, such as patch compliance (leading) and mean time to detect (lagging).

Answer

Detailed vulnerability counts by severity and system owner.

Answer

Number of security awareness training sessions completed.

Answer

List of all third-party vendors and their risk ratings.

Question 12

An information security manager is preparing a report for the board on the state of information security governance. Which of the following elements is most important to include in the report?

Accepted Answer

Key risk indicators (KRIs) related to the organization's critical assets.. Key risk indicators (KRIs) provide a forward-looking, quantifiable measure of risk exposure tied directly to critical assets, which is essential for the board to understand the effectiveness of governance and risk management. Unlike operational or tactical data, KRIs enable informed strategic decisions about risk appetite and resource allocation, aligning with the CISM focus on governance over management.

Answer

The percentage of the security budget spent on different projects.

Answer

A log of all recent security incidents and their root causes.

Answer

A detailed list of all security tools and their functionalities.

Question 13

An organization's incident response team is handling a P2 insider threat incident involving unauthorized access to customer data. According to the incident classification, which of the following is the MOST appropriate notification and response timeframe?

Accepted Answer

Notification to management within 24 hours and response during business hours.. P2 incidents are high severity with significant impact, requiring management notification and response during business hours.

Answer

No notification required; handle during scheduled remediation.

Answer

Notification to the communications lead and response within 48 hours.

Answer

Immediate notification to the executive sponsor and 24/7 response.

Question 14

An organization is implementing a data security program. Which of the following is the most effective approach to protect sensitive data at rest?

Accepted Answer

Encrypting sensitive data stored in databases and file shares. Encryption is a fundamental control for protecting data at rest. While DLP and access controls are important, encryption provides direct confidentiality protection.

Answer

Implementing strict access control lists (ACLs)

Answer

Implementing data loss prevention (DLP) solutions

Answer

Conducting regular vulnerability scans on servers

Question 15

A multinational corporation is designing its information security governance framework. The board has requested a single metric that best indicates the effectiveness of the security program. Which metric would BEST satisfy this request?

Accepted Answer

Percentage of security controls achieving their intended outcomes as validated by testing.. The best metric because it directly measures whether security controls are functioning as designed, which is the ultimate indicator of security program effectiveness. Unlike input or activity metrics, this outcome-based metric validates that controls achieve their intended purpose, aligning with the board's need for a single, high-level effectiveness measure.

Answer

Percentage of systems compliant with security baseline.

Answer

Number of security incidents reported per month.

Answer

Mean time to detect (MTTD) security events.

Question 16

A company is implementing a risk management program and needs to define risk appetite. Which of the following is the MOST appropriate statement of risk appetite for a financial institution?

Accepted Answer

The organization will accept up to $5M in potential loss for operational risks. A risk appetite statement for a financial institution must be quantifiable and specific to operational risk, aligning with regulatory frameworks like Basel III which require explicit loss thresholds. Stating a maximum acceptable loss of $5M provides a clear, measurable boundary for risk-taking decisions, enabling the board and management to balance risk and reward effectively.

Answer

The organization will mitigate all risks to a low level

Answer

The organization will not invest in high-risk projects

Answer

The organization accepts no level of risk

Question 17

Which of the following are essential components of an information security program governance framework? (Select TWO.)

Accepted Answer

A security steering committee with executive representation.. A security steering committee with executive representation is essential because it provides strategic oversight, aligns security initiatives with business objectives, and ensures resource allocation and governance accountability. This committee typically includes C-level executives who approve security policies, review risk posture, and enforce compliance across the organization.

Answer

A formal risk appetite statement.

Answer

An incident response plan.

Question 18

You are the CISM for a mid-sized e-commerce company that processes credit card transactions. The company recently experienced a security incident where an attacker exploited a vulnerability in the web application to gain access to the customer database containing payment card information. The incident response team contained the breach, but the root cause analysis revealed that the vulnerability had been identified in a penetration test six months ago but was not remediated due to competing priorities. The company's risk management framework defines risk appetite as 'moderate' for information security risks. The board is concerned and has asked you to recommend improvements to prevent recurrence. The company has a limited budget and cannot implement all possible controls. Current environment: web application developed in-house, hosted on-premises, with a mix of virtual and physical servers. The security team consists of three people responsible for monitoring, incident response, and vulnerability management. The development team follows an agile methodology with bi-weekly sprints. The company has cyber liability insurance that covers breach response costs up to $2 million. Based on this scenario, what is the most effective course of action?

Accepted Answer

Implement a formal vulnerability management program with defined remediation SLAs based on risk severity.. A formal vulnerability management program with defined remediation SLAs directly addresses the root cause: the known vulnerability was not patched due to competing priorities. By tying remediation timelines to risk severity (e.g., critical vulnerabilities patched within 7 days, high within 30 days), the company operationalizes its 'moderate' risk appetite and ensures that penetration test findings are acted upon before they can be exploited. This is the most cost-effective approach given the limited budget, as it leverages existing staff and processes rather than requiring new hires or expensive rewrites.

Answer

Hire two additional security analysts to improve monitoring and incident response.

Answer

Increase cyber liability insurance coverage to $5 million to cover potential breach costs.

Answer

Rewrite the web application using a secure development framework to eliminate vulnerabilities.

Question 19

During an audit, it was found that the organization's information security policy is not being followed by business units. Which of the following is the MOST effective way for the information security manager to improve compliance?

Accepted Answer

Establish a policy review committee with business unit representatives to align policy with operational needs.. The most effective way to improve compliance is to align the policy with operational realities by involving business unit representatives in a policy review committee. When policies conflict with business processes, users will bypass them; adjusting the policy to be both secure and practical increases voluntary adherence. This addresses the root cause—policy misalignment—rather than treating symptoms like lack of awareness or enforcement.

Answer

Provide additional security awareness training focused on policy requirements.

Answer

Escalate non-compliance to senior management for disciplinary action.

Answer

Increase the frequency of automated policy compliance checks.

Question 20

Which of the following is the PRIMARY purpose of an information security risk assessment?

Accepted Answer

To identify and evaluate risks in terms of likelihood and impact. The primary purpose of an information security risk assessment is to identify and evaluate risks in terms of their likelihood and impact. This process enables an organization to prioritize risks and determine appropriate risk treatment options, such as mitigation, transfer, acceptance, or avoidance, based on a clear understanding of the risk landscape. Without this evaluation, any subsequent risk management decisions would lack a defensible basis.

Answer

To eliminate all identified risks

Answer

To comply with regulatory requirements

Answer

To assign blame for security incidents