CISM Practice Exam 59 — 20 Questions

Question 1

During a security incident, the incident response team needs to preserve volatile evidence. Which of the following should be collected first?

Accepted Answer

Contents of RAM.. The order of volatility dictates that the most volatile evidence, such as RAM contents, should be collected first because it is lost when the system is powered off or rebooted. Hard drives, logs, and backups are less volatile and can be collected later. This principle ensures that critical evidence is preserved for forensic analysis.

Answer

Files on the hard drive.

Answer

Network traffic logs.

Answer

Backup tapes.

Question 2

A multinational retailer's security operations center (SOC) identifies that an attacker has compromised a point-of-sale (POS) system in a European store and is moving laterally toward the payment card processing environment. The incident response manager needs to decide the FIRST action to limit business impact while preserving the ability to investigate. Which action should be taken FIRST?

Accepted Answer

Isolate the affected POS system from the network using the endpoint detection and response (EDR) tool while keeping it powered on.. Isolating the endpoint through EDR keeps the system powered on, which preserves volatile evidence while stopping the attacker's ability to move laterally or maintain command and control. This approach satisfies the CISM priority of limiting business impact without compromising the investigation. Notifying external parties or deleting files before containment can let the attack spread and destroy evidence needed for scoping and root cause analysis.

Answer

Notify the payment card brands and law enforcement before taking any technical action.

Answer

Immediately power off the compromised POS system and remove it from the network.

Answer

Delete the malware files from the POS system to stop the attack immediately.

Question 3

A healthcare organization's risk register shows a critical patient-records system with an annualized loss expectancy (ALE) of $2,400,000. A proposed control costs $300,000 per year and is estimated to reduce the ALE to $400,000. The CISO must present the strongest financial justification to the executive committee. Which of the following is the MOST appropriate metric to present?

Accepted Answer

A cost-benefit analysis showing a net benefit of $1,700,000 per year from the control.. Cost-benefit analysis translates the risk reduction into a monetary figure that decision-makers can weigh against the control's annual cost. Here the control lowers expected annual loss by $2,000,000 while costing $300,000, producing a $1,700,000 net benefit. This quantitative justification is far more persuasive to an executive committee than residual risk, asset value, or qualitative ratings alone.

Answer

The residual risk of $400,000 after the control is implemented.

Answer

The control's annualized cost of $300,000 compared with the total asset value of the patient-records system.

Answer

The likelihood and impact ratings of the threat before and after the control.

Question 4

A global retailer is establishing an information security governance framework. The CISO must ensure that the framework addresses both internal and external requirements. Which THREE of the following are essential components of an effective information security governance framework? (Choose three.)

Accepted Answer

A defined risk appetite statement approved by senior management.. An effective governance framework must include strategic elements: a risk appetite statement approved by senior management, clearly assigned roles and responsibilities, and a compliance monitoring process. These components provide direction, accountability, and assurance. Operational tools like asset inventories and incident dashboards are important but do not constitute governance; they support execution under the framework.

Answer

A real-time security incident dashboard for the security operations center.

Answer

A detailed inventory of all hardware assets with firmware versions.

Question 5

A CISO is reviewing the organization's risk management process. The board has asked how the CISO ensures that security risks are managed within the organization's risk appetite. Which activity BEST demonstrates this?

Accepted Answer

Defining risk appetite and tolerance levels, and monitoring key risk indicators against them.. The correct answer is defining risk appetite and tolerance levels and monitoring key risk indicators against them. In CISM, risk appetite is set by the board and communicated to management. The CISO ensures that security risks are managed within that appetite by establishing tolerance thresholds and monitoring KRIs. This provides continuous assurance that risks are within acceptable limits and that treatment decisions are aligned with business objectives.

Answer

Purchasing cyber insurance to transfer residual risks that exceed the organization's tolerance.

Answer

Implementing a risk register that lists all identified risks and their owners.

Answer

Conducting an annual risk assessment and presenting the results to the board.

Question 6

An organization is developing its incident response plan. The CISO wants to ensure that the plan includes provisions for communicating with external parties during and after an incident. Which of the following should be the PRIMARY consideration when defining external communication procedures?

Accepted Answer

Aligning communication procedures with legal, regulatory, and contractual requirements.. External communication procedures must first ensure compliance with legal, regulatory, and contractual requirements. These obligations dictate who to notify, when, and what information to share. CISM emphasizes that incident response is not just technical but also legal and business-oriented. While legal approval, a single point of contact, and social media are elements, they are secondary to the primary need to meet compliance obligations and protect the organization.

Answer

Ensuring that all external communications are approved by the legal department.

Answer

Using social media to quickly inform the public about the incident.

Answer

Establishing a single point of contact for all external communications.

Question 7

A newly appointed CISO is establishing the information security governance framework for a multinational financial services firm. The board wants assurance that security activities align with business objectives and regulatory obligations. Which action should the CISO take FIRST to establish effective governance?

Accepted Answer

Define and obtain board approval for an information security charter that articulates the mandate, authority, and scope of the security function.. Effective information security governance begins with a board-approved charter that defines the security function's mandate, authority, and scope. This artifact legitimises subsequent strategy, policy, metrics, and control investment, and ensures alignment with business objectives and regulatory obligations. Technical deployments, testing, and policy updates are downstream activities that should reflect the governance framework rather than precede it.

Answer

Conduct a full penetration test of the external attack surface and report findings to the board.

Answer

Immediately update all security policies to reflect ISO/IEC 27001 requirements and distribute them to staff.

Answer

Deploy an enterprise SIEM and begin centralising log collection from critical systems.

Question 8

A company's incident response plan defines roles for the incident response team, but during a recent tabletop exercise it became clear that no one had authority to make binding decisions about shutting down production systems. Which of the following should be established to resolve this gap?

Accepted Answer

A documented decision-making authority and escalation path approved by executive management.. Incident response authority is a governance matter that must be defined before a crisis. Documenting who may authorize disruptive actions, and how disagreements escalate, gives responders clear decision rights approved at the executive level. Without it, even well-detected incidents stall while teams wait for permission, and the organization loses the time that containment depends on.

Answer

A service level agreement with the managed security service provider guaranteeing faster response.

Answer

An increase in the security operations centre's monitoring coverage and alert thresholds.

Answer

A more detailed technical runbook describing how to shut down each production system.

Question 9

A multinational organisation suffers a breach affecting customers in several jurisdictions. The incident response manager must coordinate notification obligations while the investigation is still ongoing and facts are incomplete. Which of the following is the MOST appropriate approach?

Accepted Answer

Engage legal counsel to map jurisdictional notification requirements and issue notices as facts are confirmed, meeting each deadline. Cross-border breaches trigger overlapping notification regimes with different thresholds, recipients, and deadlines. Legal counsel must map those obligations, and notices should be issued progressively as facts are confirmed so each jurisdiction's deadline is met without publishing inaccurate information. This balances compliance with the reality of an incomplete investigation.

Answer

Delegate all notification decisions to the public relations team to ensure consistent messaging across markets

Answer

Notify every customer in all markets immediately, regardless of whether their data was affected

Answer

Wait until the investigation is fully complete so that a single, comprehensive notification can be issued to all affected parties

Question 10

An organization's security steering committee is reviewing the information security policy framework. The committee wants to ensure that the framework includes a document that defines the organization's overall security direction and is approved by senior management. Which document should the committee expect to find?

Accepted Answer

Information security policy. The information security policy is the foundational governance document that articulates the organization's security direction, objectives, and management commitment. It is approved by senior management and mandates the creation of supporting standards, procedures, and guidelines. This aligns with CISM's emphasis on policy as the top-level driver of the security program.

Answer

Information security standard

Answer

Information security procedure

Answer

Information security guideline

Question 11

A retail company suffers a breach involving payment card data. The incident response manager must decide whether to engage external forensic investigators and outside counsel. Which of the following is the PRIMARY reason to bring in external expertise at this point?

Accepted Answer

External investigators provide independent expertise and objective findings that support legal and regulatory obligations.. Complex breaches exceed typical internal capacity and require independence, specialized forensics, and legal structuring. External investigators deliver objective findings that stand up to regulator, insurer, and court scrutiny, while outside counsel can direct the work under privilege. This combination supports both accurate root-cause determination and the organization's legal and contractual obligations.

Answer

External investigators will assume legal liability for the breach and shield the company from regulatory penalties.

Answer

External investigators are required by the payment card industry to be used for all card data breaches.

Answer

External investigators allow the internal security team to avoid documenting the incident in the ticketing system.

Question 12

A security manager is reviewing the organization's security governance framework. The board of directors has asked for assurance that security risks are being managed effectively. Which of the following is the MOST important element to include in the governance framework?

Accepted Answer

A clear definition of security roles and responsibilities.. Effective security governance requires clear definition of roles and responsibilities to establish accountability and oversight. This enables the board to have assurance that security risks are managed. Other elements like tools, diagrams, and testing schedules are operational and do not fulfill governance needs.

Answer

A list of all security tools deployed in the environment.

Answer

A detailed technical security architecture diagram.

Answer

A schedule for penetration testing.

Question 13

A CISO is developing a set of information security policies for a healthcare organization. The organization must comply with HIPAA and internal privacy requirements. Which of the following should be the PRIMARY consideration when drafting the security policy framework?

Accepted Answer

Alignment with the organization's mission, goals, and regulatory obligations.. Security policies must first align with the organization's mission, goals, and regulatory obligations to ensure they support business objectives and comply with laws like HIPAA. Cost, technical feasibility, and IT preferences are secondary considerations that influence implementation but should not dictate policy content. This alignment ensures policies are relevant, enforceable, and legally sound.

Answer

The preferences of the IT department regarding policy structure and wording.

Answer

The technical feasibility of enforcing each policy with existing tools.

Answer

The cost of implementing each policy control across the organization.

Question 14

A security manager is developing key performance indicators (KPIs) for the information security program. Which of the following is the MOST important characteristic of an effective KPI?

Accepted Answer

It is aligned with business objectives.. The most critical characteristic of a KPI is alignment with business objectives, as this ensures that security performance is measured in terms of its contribution to organizational goals. This alignment helps justify security investments and demonstrates value to stakeholders. Other characteristics like measurability and benchmarking are secondary to strategic relevance.

Answer

It is easy to measure and report.

Answer

It is based on industry benchmarks.

Answer

It is reviewed annually by the board.

Question 15

A security manager is reviewing the organization's security governance framework. The board has requested a clear definition of who is accountable for aligning security strategy with business objectives. According to generally accepted governance principles, which role holds ultimate accountability for the information security program?

Accepted Answer

Board of Directors. Ultimate accountability for the information security program resides with the board of directors, which holds fiduciary duty to stakeholders. The board defines risk appetite and ensures security strategy supports business goals, while the CISO, CIO, and steering committees execute, advise, or coordinate. Distinguishing accountability from responsibility is central to effective governance.

Answer

Chief Information Officer (CIO)

Answer

Chief Information Security Officer (CISO)

Answer

IT Steering Committee

Question 16

A CISO is reviewing the information security program's performance measurement framework. The organization wants to ensure that the metrics used are effective in demonstrating the program's value to the business and driving continuous improvement. Which of the following are the MOST appropriate key performance indicators (KPIs) for the information security program? (Choose two.)

Accepted Answer

Percentage of critical systems covered by the vulnerability management program.. The most appropriate KPIs are those that measure the effectiveness of security controls and processes in reducing risk. The percentage of critical systems covered by vulnerability management and mean time to remediate critical vulnerabilities both directly reflect the program's ability to manage a key risk area. They are actionable, quantifiable, and demonstrate value to the business by showing risk reduction over time.

Answer

Number of security policies approved by the steering committee.

Answer

Total number of security incidents reported by employees.

Answer

Percentage of employees who completed security awareness training.

Question 17

An organization is developing its incident response capabilities and wants to ensure that it can effectively detect and respond to security incidents. Which TWO of the following are essential components of an incident response programme that should be established before an incident occurs? (Choose two.)

Accepted Answer

Incident response policy and procedures.. The essential components of an incident response programme include an incident response policy and procedures, which provide the framework and steps for handling incidents, and a communication plan, which ensures effective information sharing with stakeholders. These are directly related to the response process and are necessary for a coordinated and effective response.

Answer

A disaster recovery plan.

Answer

A list of all IT assets and their locations.

Answer

A vulnerability management programme.

Question 18

An organisation has just completed containment of a significant data breach. The incident response manager is preparing the post-incident review. Which of the following activities BEST ensures that lessons learned translate into lasting improvement of the incident response capability?

Accepted Answer

Assigning each corrective action to an accountable owner with a due date and tracking it to closure. The purpose of a post-incident review is to convert findings into verified improvements. Assigning each corrective action to a named owner with a deadline and tracking it to closure provides the accountability and visibility that turn recommendations into real capability gains, and it produces evidence that management acted on the lessons identified.

Answer

Circulating the final incident report to all staff so everyone is aware of what happened

Answer

Updating the risk register to reflect the incident and then archiving the incident documentation

Answer

Conducting a tabletop exercise on the same scenario within the following week

Question 19

A software-as-a-service provider must decide how to treat a newly identified risk: a critical vulnerability in an open-source library used by its customer-facing application. No patch is available from the maintainer, and exploitation in the wild has been observed at other firms. The vulnerability cannot be removed without breaking core functionality. Which risk treatment option is being applied if the company deploys a virtual patch at the web application firewall and tightens monitoring?

Accepted Answer

Risk mitigation. The organization is reducing the likelihood of exploitation through compensating technical controls while a permanent remedy is unavailable, which is the essence of risk mitigation. Avoidance would require removing the vulnerable function, transfer would require an insurer or contractual party to absorb the loss, and acceptance would mean taking no action. Virtual patching and monitoring modify the risk itself.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk acceptance

Question 20

A healthcare insurer has completed an annual risk assessment. The CISO must present the results to the board and recommend a treatment strategy for a risk involving a legacy claims-processing application. The board has stated that it will not accept any risk that could result in a regulatory fine exceeding $1 million. Which of the following is the MOST appropriate action for the CISO to take FIRST?

Accepted Answer

Compare the assessed risk exposure to the board's risk tolerance and present treatment options with residual risk estimates.. Because the board has articulated a specific risk tolerance threshold, the CISO must first evaluate the assessed risk against that threshold and then present treatment options with their residual risk implications. This ensures the recommendation is grounded in the organization's stated appetite and supports a defensible, business-aligned decision rather than an arbitrary technical fix.

Answer

Recommend immediate decommissioning of the legacy application.

Answer

Transfer the risk by purchasing additional cyber insurance coverage.

Answer

Accept the risk and document it in the risk register pending next year's assessment.