CISM Practice Exam 58 — 20 Questions

Question 1

A newly appointed CISO at a healthcare provider must establish an information security governance structure. Which action should be performed FIRST?

Accepted Answer

Define the security strategy and obtain executive approval for the governance framework and charter.. Governance is about direction, accountability, and decision rights. A newly appointed security leader must first secure executive approval of a strategy and governance charter so the programme has authority and alignment. Technical assessments, tools, and insurance are treatments applied once governance establishes priorities, risk appetite, and responsibilities, and performing them first inverts the correct sequence.

Answer

Commission a penetration test of the electronic health record system.

Answer

Purchase cyber insurance to transfer residual risk to a third party.

Answer

Deploy an endpoint detection and response tool across all clinical workstations.

Question 2

A financial services firm has activated its crisis management team (CMT) for a significant data breach. The CISO, who is a member of the CMT, is asked to present the technical details of the incident. However, the CMT's primary focus should be on which of the following?

Accepted Answer

Making strategic decisions regarding business continuity and stakeholder communication.. The CMT's primary role during a major incident is to make strategic decisions that affect the entire organization, such as business continuity, resource allocation, and stakeholder communication. While technical input is valuable, the CMT must focus on the broader impact and ensure that the response aligns with business objectives. This separation of strategic and tactical responsibilities is a key CISM principle.

Answer

Coordinating the technical recovery of affected systems.

Answer

Conducting a forensic analysis to determine the root cause.

Answer

Directly managing the incident response team's daily activities.

Question 3

A multinational retailer is building a new information security programme. The CISO wants to ensure the programme's strategy remains aligned with business objectives as the company expands into new markets. Which action should the CISO take FIRST to establish this alignment?

Accepted Answer

Define a security governance framework that links security objectives to business goals and assigns accountability.. Governance is the mechanism that ties information security to business strategy by defining objectives, roles, accountability, and decision rights. Without it, security investments and activities lack a consistent rationale and may not support expansion into new markets. The other choices are technical or assessment activities that should be prioritized and scoped by the governance framework, not used to create alignment in the first place.

Answer

Purchase a security information and event management (SIEM) platform to centralize monitoring.

Answer

Deploy a next-generation firewall across all retail locations to protect point-of-sale systems.

Answer

Conduct a penetration test of the e-commerce platform to identify vulnerabilities.

Question 4

A CISO is defining the scope of the information security program. The organization has multiple locations and uses cloud services extensively. Which factor is MOST important to consider when defining the program's scope?

Accepted Answer

The business processes and information assets that support the organization's mission. The most important factor is the business processes and information assets that support the organization's mission. This ensures the security program is aligned with business objectives and covers all critical assets, whether on-premises or in the cloud. By defining scope based on mission-critical processes, the CISO can prioritize risks and allocate resources effectively, ensuring comprehensive protection.

Answer

The geographic locations of the organization's offices

Answer

The number of employees at each location

Answer

The specific cloud service providers used by the organization

Question 5

An organization is developing its incident response plan and wants to ensure that it has the necessary authority and communication channels in place before an incident occurs. Which TWO of the following should be established to enable effective incident response? (Choose two.)

Accepted Answer

A predefined incident response team with clearly defined roles and responsibilities.. Effective incident response requires a predefined team with clear roles and a robust communication plan. These elements ensure that during an incident, responsibilities are understood and information flows to the right stakeholders in a timely manner. Together, they provide the authority and coordination needed to execute the response plan, aligning with CISM's emphasis on preparation and governance.

Answer

A list of all employees' personal social media accounts for monitoring.

Answer

A policy requiring all incidents to be resolved within one hour of detection.

Answer

A backup of all incident response team members' personal devices.

Question 6

A CISO is developing a set of key performance indicators (KPIs) for the information security program to report to the board. Which of the following are appropriate KPIs for measuring the effectiveness of the security program? (Choose two.)

Accepted Answer

Percentage of critical vulnerabilities remediated within defined timeframes.. The correct answers are mean time to detect (MTTD) and percentage of critical vulnerabilities remediated within defined timeframes. Both are performance-oriented metrics that measure the speed and effectiveness of key security processes, providing insight into how well the program reduces risk. They are actionable and can be trended over time to show improvement or deterioration.

Answer

Number of security policies approved by management.

Answer

Annual security budget as a percentage of IT budget.

Answer

Total number of security tools deployed.

Question 7

A retail company's risk register shows that its point-of-sale terminals run an unsupported operating system. The CIO proposes replacing the terminals over 18 months, but the CISO believes the exposure is unacceptable in the interim. The CEO asks the CISO to recommend a course of action that balances business continuity with risk reduction. Which of the following is the MOST appropriate recommendation?

Accepted Answer

Implement compensating controls such as network segmentation and enhanced monitoring while the replacement proceeds.. When permanent remediation will take time, compensating controls allow the organization to reduce risk to a tolerable level while maintaining business operations. Network segmentation and enhanced monitoring address the unsupported platform's exposure without interrupting sales, and they give the CISO a defensible interim posture that can be revisited as the replacement program progresses.

Answer

Transfer the risk to the terminal vendor through the existing support contract.

Answer

Accept the risk because the CIO has committed to an 18-month replacement schedule.

Answer

Immediately disconnect all point-of-sale terminals until they are replaced.

Question 8

An organization's information security program has a documented risk management process. During a review, the CISO finds that risk assessments are performed annually but do not account for changes in the threat landscape or business environment. Which of the following is the BEST recommendation to improve the program?

Accepted Answer

Implement a continuous risk assessment process integrated with change management.. Implementing a continuous risk assessment process integrated with change management is the best recommendation because it ensures that risk assessments are performed whenever significant changes occur, not just annually. This dynamic approach keeps the risk register current and enables the organization to respond to emerging threats and business changes effectively, improving overall risk management.

Answer

Outsource risk assessments to a third-party specialist.

Answer

Increase the frequency of risk assessments to quarterly.

Answer

Adopt a risk assessment framework such as OCTAVE or FAIR.

Question 9

A security manager is defining the organization's information security strategy in alignment with business objectives. The organization operates in a highly regulated industry with strict data protection requirements. Which of the following should be the FIRST step in this process?

Accepted Answer

Conduct a comprehensive risk assessment to identify and prioritize risks.. The first step in developing an information security strategy is to understand the organization's risk profile through a comprehensive risk assessment. This ensures that the strategy is aligned with business objectives and regulatory requirements. Other activities, such as training and technology deployment, should be based on identified risks and strategic priorities.

Answer

Purchase and deploy a next-generation firewall.

Answer

Develop a business continuity plan (BCP).

Answer

Implement a security awareness training program for all employees.

Question 10

An organization's security operations center (SOC) confirms that a production database server is actively exfiltrating customer records to an external IP address. The SOC manager must decide whether to immediately isolate the server from the network. Which factor should PRIMARILY guide this decision?

Accepted Answer

The potential business impact of taking the server offline versus the value of preserving evidence of the exfiltration channel.. Containment during active exfiltration requires balancing the harm of continued data loss against the harm of disrupting production services and destroying volatile evidence. CISM frames incident response decisions around business impact and evidence integrity, so the decision to isolate must be grounded in that trade-off rather than in threat intelligence reputation, authentication telemetry, or insurance considerations.

Answer

The number of failed login attempts recorded on the database server in the preceding 24 hours.

Answer

Whether the database server is covered by the organization's cyber insurance policy.

Answer

Whether the external IP address has been previously reported to a threat intelligence sharing platform.

Question 11

A CISO is reviewing the organization's information security program and wants to improve its maturity. Which of the following are characteristics of a mature information security program? (Choose two.)

Accepted Answer

Risk management processes are integrated into business decision-making.. The two characteristics are: security metrics aligned with business objectives and reported to executive management, and risk management processes integrated into business decision-making. These indicate that security is governed at the highest level, aligned with business strategy, and embedded in organizational processes, which are key aspects of maturity.

Answer

The security team operates independently without interaction with other business units.

Answer

Security awareness training is conducted annually for all employees.

Answer

Security controls are implemented based solely on regulatory requirements.

Question 12

A security analyst receives an alert from the SIEM indicating that a user account has been added to the domain administrators group outside of the change management window. The analyst confirms the change was not authorized. According to CISM incident management principles, what should the analyst do FIRST?

Accepted Answer

Escalate the alert to the incident response team according to the documented incident classification and escalation procedures.. The analyst should escalate the unauthorized privileged account change through the documented incident classification and escalation procedures. This ensures the incident receives appropriate resources and is handled consistently, while preserving evidence and avoiding premature or unilateral actions. Reversing the change, contacting the user, or simply monitoring can compromise the investigation or allow the attacker to expand access.

Answer

Document the alert in the ticketing system and continue monitoring for additional related events before escalating.

Answer

Remove the account from the domain administrators group to immediately reverse the unauthorized change.

Answer

Contact the user whose account was added to the domain administrators group to ask if they made the change.

Question 13

A security manager learns that a production database containing customer records was copied to an unauthorized external drive by a contractor. The incident response team has contained the contractor's access. According to CISM best practices, which action should the security manager take NEXT?

Accepted Answer

Notify the legal department and initiate the evidence preservation and chain-of-custody process.. When an incident may involve criminal conduct or regulatory breach notification, the security manager's immediate priority is to engage legal counsel and preserve evidence. This ensures the organization can support law enforcement, defend against liability, and meet notification requirements. Containment has already occurred, so the next step is protecting the integrity of the investigation rather than taking destructive or premature personnel actions.

Answer

Terminate the contractor's employment contract and demand return of the external drive.

Answer

Send a company-wide email informing all employees about the contractor's misconduct.

Answer

Immediately delete the contractor's user account and all associated files to prevent further data loss.

Question 14

A security analyst is identifying assets to include in a risk assessment for a new e-commerce platform. The platform will process credit card payments and store customer personal information. Which of the following should be considered the MOST critical asset to protect?

Accepted Answer

The customer database containing personal and payment card information.. The customer database is the most critical asset because it holds sensitive personal and payment card information. Its compromise would result in the most significant impact to the organization, including regulatory fines, financial loss, and reputational harm. While other components like servers, firewalls, and load balancers are important for operations and security, they support the protection of the data. Risk assessments should prioritize assets based on the potential impact of their loss.

Answer

The load balancer distributing traffic to the web servers.

Answer

The network firewall protecting the e-commerce environment.

Answer

The web server hosting the e-commerce application.

Question 15

A healthcare insurer's third-party risk manager learns that a critical claims-processing vendor has been acquired by a foreign parent company subject to different data protection laws. The vendor contract contains no change-of-control clause. What should the risk manager do FIRST?

Accepted Answer

Perform a risk assessment of the change in ownership and its impact on data protection obligations.. A change of control at a critical vendor is a risk event that must be reassessed before any treatment decision. Because the contract lacks a change-of-control clause, the organization cannot rely on contractual levers and must understand the new legal, privacy, and operational exposure. Assessing first supports an informed choice among renegotiation, added controls, or managed exit, and preserves evidence of due diligence.

Answer

Immediately terminate the vendor contract and migrate claims processing in-house.

Answer

Report the acquisition to the regulator and await instructions before taking any action.

Answer

Accept the change because the vendor's service-level agreement remains unchanged.

Question 16

An information security manager is reviewing a risk register that contains a risk with a risk score of 20 (likelihood 5, impact 4). The risk owner proposes to accept the risk because the cost of mitigation exceeds the potential loss. Which of the following should the security manager do NEXT?

Accepted Answer

Validate the cost-benefit analysis and ensure the risk is accepted by the appropriate authority.. Before a risk can be accepted, the cost-benefit analysis must be validated, and acceptance must be authorized by the appropriate level of management based on the risk score. The security manager's role is to facilitate this process, ensuring that the decision is informed and within governance. Thus, validating the analysis and obtaining proper authorization is the correct next step.

Answer

Approve the risk acceptance and document it in the risk register.

Answer

Transfer the risk by purchasing cyber insurance.

Answer

Implement compensating controls to reduce the risk to an acceptable level.

Question 17

A healthcare insurer is completing its annual enterprise risk assessment. The CISO has compiled a list of 40 information security risks, each scored for likelihood and impact. The CIO asks which risks should be escalated to the board's risk committee for formal acceptance. What is the MOST appropriate criterion for selecting which risks to escalate?

Accepted Answer

Risks whose residual risk level exceeds the organization's defined risk appetite.. Board-level risk acceptance is triggered when residual risk exceeds the appetite and tolerance thresholds that executive management has established. Inherent scores, business criticality, and remediation delays are inputs to analysis but do not by themselves indicate that a decision above delegated authority is required. Routing only appetite-breaching residual risks keeps the committee focused on exposures that genuinely require formal acceptance.

Answer

Risks that the security team has been unable to remediate within the current fiscal year.

Answer

Risks that received the highest inherent risk scores before any controls were applied.

Answer

Risks associated with systems that support the organization's most revenue-generating business processes.

Question 18

A CISO has implemented a security program based on ISO/IEC 27001. During a management review, the CIO asks how the program contributes to business value. Which of the following metrics would BEST demonstrate the program's contribution to business value?

Accepted Answer

Reduction in the likelihood of material breaches affecting critical business processes.. The correct answer is the reduction in likelihood of material breaches affecting critical business processes. This metric translates security efforts into business terms by focusing on risk reduction for what matters most. It demonstrates that the program is not just implementing controls but actively protecting the organization's ability to achieve its objectives, which is the essence of business value.

Answer

Number of security incidents detected and resolved within service level agreements.

Answer

Total number of security controls implemented across the enterprise.

Answer

Percentage of employees who completed security awareness training.

Question 19

A security operations center (SOC) analyst receives an alert about a possible data exfiltration from a database server. The analyst must determine the incident severity to initiate the appropriate response. Which of the following factors is MOST important in determining the severity level?

Accepted Answer

The potential impact on business operations and regulatory compliance.. Incident severity should be determined by the potential impact on business operations, regulatory compliance, and reputation. CISM stresses that severity classification drives the response level and resource allocation. While data volume, source IP, and detection method are relevant details, they do not define severity. The most important factor is the business impact, as it determines the urgency and scale of the response.

Answer

The volume of data potentially exfiltrated.

Answer

The source IP address of the exfiltration attempt.

Answer

The method used to detect the exfiltration (e.g., SIEM alert vs. user report).

Question 20

An organisation is defining the criteria its incident response team will use to determine when an incident has been successfully contained and eradication can begin. Which TWO of the following are the MOST appropriate criteria for that decision? (Choose two.)

Accepted Answer

The attacker's command-and-control infrastructure has been sinkholed and no new beaconing is observed from monitored networks. Containment is complete when the adversary can no longer operate: every access path and persistence mechanism has been removed, and command-and-control has been disrupted so no implants can receive instructions. These are verifiable technical conditions. Business resumption, executive assurances, and forensic engagement are useful signals or actions but do not prove the threat has been neutralised.

Answer

The external forensic firm has been formally engaged and has begun its investigation

Answer

The chief information security officer has verbally confirmed to the board that the threat has been neutralised

Answer

The affected business unit has confirmed that normal transaction volumes have resumed