CISM Practice Exam 60 — 20 Questions

Question 1

A retail company has a documented risk appetite stating that it will accept no more than a moderate level of risk to customer payment data. A recent assessment shows the payment environment carries a high residual risk after existing controls. What should the information security manager do FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Escalate the residual risk to senior management as a risk above the approved appetite.. Risk appetite defines the amount of risk leadership is willing to accept in pursuit of objectives. When residual risk exceeds that boundary, the information security manager's first obligation is to escalate the exception to senior management, who own the decision to remediate, accept, or adjust strategy. Acting unilaterally or rewriting the appetite statement would bypass proper governance.

Answer

Document the residual risk in the risk register and continue monitoring it on the normal reporting cycle.

Answer

Revise the risk appetite statement so the current residual risk falls within acceptable limits.

Answer

Immediately implement additional controls and then report the change in risk level.

Question 2

A financial services company is updating its information security policies to reflect a new regulation. The CISO must ensure the policies are effectively communicated and enforced. Which action is MOST important to achieve this?

Accepted Answer

Obtain executive management approval and communicate the policies with mandatory training and acknowledgment.. The correct answer is to obtain executive approval and communicate with mandatory training and acknowledgment. In CISM, policy governance requires that policies are authorized at the highest level and then effectively communicated. Training ensures employees understand their responsibilities, and acknowledgment provides evidence of compliance. This approach ensures the policies are enforced and can be audited, which is essential for regulatory compliance.

Answer

Include the policies in the employee handbook and require new hires to sign them during onboarding.

Answer

Ask department managers to verbally brief their teams on the policy changes during staff meetings.

Answer

Publish the updated policies on the corporate intranet and send an email announcement to all staff.

Question 3

A healthcare provider's security programme has grown organically, and the CISO now wants to formalize how security requirements are integrated into every new IT project. Which activity should the CISO implement to achieve this?

Accepted Answer

Require a security risk assessment as a gate in the system development life cycle (SDLC).. Integrating security into the SDLC through a formal risk assessment gate ensures that security requirements are considered at the right time, with accountability and documentation. It transforms security from an afterthought into a standard project step, enabling consistent risk-based decisions. The other activities are valuable but do not create the structured, repeatable integration the CISO is seeking.

Answer

Deploy a vulnerability scanner across the development environment.

Answer

Create a security awareness campaign for project managers.

Answer

Perform an annual penetration test on all production systems.

Question 4

A newly appointed CISO at a healthcare provider is establishing the information security programme's governance structure. Executive management asks who should ultimately approve the organisation's information security policy. Who is MOST appropriate to approve it?

Accepted Answer

Executive management, because the policy sets enterprise-wide security expectations and demonstrates top-level commitment.. The top-level information security policy sets expectations for the entire organisation and expresses management's risk appetite, so it must be approved by executive management. This provides the authority for enforcement and demonstrates visible commitment. The CISO drafts and maintains it, IT implements it, and internal audit independently assesses compliance against it.

Answer

The CISO, because they own the information security programme and are accountable for its policies.

Answer

The internal audit function, because it independently verifies that policy requirements are being met.

Answer

The IT operations manager, because they implement most of the technical controls described in the policy.

Question 5

An information security manager is reviewing a risk register entry for a customer-facing web application. The entry lists a vulnerability that could allow unauthorized access to customer records. The application owner has proposed applying a vendor patch that has been available for 30 days. Which of the following risk treatment categories does applying the patch represent?

Accepted Answer

Risk mitigation. Risk mitigation involves applying controls that reduce the likelihood or impact of a risk while allowing the underlying business activity to continue. Patching a known vulnerability lowers the probability of exploitation, so it falls squarely into the mitigation category rather than avoidance, transfer, or acceptance, each of which describes a fundamentally different treatment approach.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 6

A global manufacturer is building a risk register for its operational technology (OT) environment. The CISO wants to ensure the register captures risk at the appropriate level and supports prioritization. Which TWO of the following practices BEST support an effective OT risk register? (Choose two.)

Accepted Answer

Record each risk with an owner, inherent and residual ratings, and the linked business process or asset.. An effective risk register captures ownership, inherent and residual ratings, and business linkage, and it maps risks to the obligations they could affect. These practices enable prioritization and accountability. Aggregating findings, using only financial impact, or excluding controlled risks all reduce the register's usefulness for managing OT exposure where safety and availability are critical.

Answer

Rate every OT risk using only the maximum potential financial loss to keep scoring consistent.

Answer

Exclude risks that already have compensating controls from the register to reduce noise.

Answer

Aggregate all OT findings into a single enterprise risk to simplify board reporting.

Question 7

A global financial services firm is aligning its information security program with the COBIT framework. The board wants assurance that IT risks are governed effectively. Which COBIT component is MOST directly responsible for ensuring that IT risk management activities are aligned with enterprise risk management?

Accepted Answer

EDM03 Ensured Risk Optimization. EDM03 is part of the governance domain in COBIT and specifically ensures that IT risk management is integrated with enterprise risk management, including setting risk appetite and tolerance. This directly addresses the board's need for assurance that IT risks are governed effectively and aligned with overall enterprise risk.

Answer

MEA03 Managed Compliance with External Requirements

Answer

DSS05 Managed Security Services

Answer

APO12 Managed Risk

Question 8

A healthcare organization is evaluating a new telehealth platform that will process protected health information. The security manager has completed a risk assessment and identified several risks. The CISO asks which of the following is the MOST important factor when determining whether to accept, mitigate, transfer, or avoid a risk?

Accepted Answer

The organization's risk appetite and tolerance. Risk treatment must be driven by the organization's risk appetite and tolerance, because these express how much risk leadership is willing to accept while pursuing objectives. Technical severity, control cost, and risk counts inform the analysis, but they do not determine acceptability. The chosen treatment should bring residual risk within tolerance and remain consistent with regulatory and business obligations.

Answer

The number of similar risks already identified in the risk register

Answer

The cost of the control compared to the asset's book value

Answer

The technical severity rating from the vulnerability scanner

Question 9

A financial services firm has activated its incident response team for a suspected insider data theft. The legal department advises that the matter may become a criminal case. The security manager must decide how to handle the forensic images and analyst notes. Which action BEST supports both the investigation and potential legal proceedings?

Accepted Answer

Maintain a documented chain of custody with hash values and restricted access to the evidence repository. When an incident may become a criminal or civil legal matter, evidence must be handled so that it remains admissible and defensible. Chain of custody documentation, cryptographic hashing, and strict access controls are the core requirements. These practices demonstrate that evidence has not been altered and that only authorized personnel handled it. Other options either contaminate evidence, expose it to unauthorized parties, or destroy potentially discoverable material.

Answer

Delete analyst working notes after the final report is issued to reduce discoverable material

Answer

Store all evidence on the same file server used for routine IT backups to ensure redundancy

Answer

Allow the suspect's manager to review the forensic images to confirm whether the data was sensitive

Question 10

A hospital's information security manager is assessing a radiology system that stores patient images on a vendor-managed cloud. The vendor reports a 99.9% uptime SLA and annual SOC 2 Type II reports, but the hospital's radiology staff continue to store local copies on unencrypted workstations for convenience. Which of the following is the MOST appropriate risk treatment for the risk introduced by the local copies?

Accepted Answer

Mitigate the risk by enforcing full-disk encryption, access controls, and a policy prohibiting unauthorized local copies.. The risk arises from hospital-controlled endpoints, so the effective treatment is mitigation through encryption, access control, and policy enforcement. Transfer and acceptance do not address the internal behavior, and avoidance of the vendor relationship is misdirected because the vendor is not the source of the exposure. Risk treatment should be matched to the party that actually controls the risk.

Answer

Transfer the risk to the cloud vendor by amending the SLA to include the local workstations.

Answer

Accept the risk because the cloud vendor holds SOC 2 Type II attestation.

Answer

Avoid the risk by terminating the contract with the cloud vendor and returning to on-premises storage.

Question 11

A global manufacturer is consolidating 14 regional security policies into a single enterprise information security policy set. Regional legal counsel warns that several jurisdictions impose requirements stricter than the current baseline. Which approach BEST balances consistency with legal obligations?

Accepted Answer

Establish a global baseline policy with documented regional exceptions that only add or strengthen requirements.. The right balance is a mandatory global baseline plus a governed exception process for regions whose laws are stricter. This delivers consistent minimum protection and comparable metrics across the enterprise while allowing lawful local strengthening. Wholesale adoption of the strictest rule, full regional autonomy, and culture-based variation each sacrifice either efficiency, legal compliance, or enterprise visibility.

Answer

Publish one global policy at the strictest regional requirement and retire all local variants.

Answer

Keep all 14 regional policies independent and let each regional security officer maintain their own set.

Answer

Allow each region to choose whichever policy set best fits its culture and report compliance only when audited.

Question 12

During a suspected insider data theft investigation, the incident response team discovers that the suspect's laptop is still powered on and logged in. Legal counsel advises that evidence must be preserved for potential litigation. Which of the following actions should the team take FIRST?

Accepted Answer

Capture volatile data such as memory and network connections, then isolate the system from the network.. Forensic best practice is to capture volatile data before isolating or powering down a live system. Memory, active network connections, and encryption keys can vanish on shutdown or network disconnection, and they may be crucial to proving insider theft. After volatile data is secured, isolating the system prevents remote tampering and further exfiltration while preserving the remaining evidence for legal use.

Answer

Immediately shut down the laptop to prevent the suspect from deleting evidence remotely.

Answer

Disconnect the laptop from the network immediately and begin imaging the hard drive.

Answer

Ask the suspect to remain logged in while the team interviews them about the alleged activity.

Question 13

A security manager is drafting the incident classification section of the incident response plan. Executives want a documented, repeatable way to rank incidents so that notification and escalation paths are triggered consistently. Which of the following should be the PRIMARY basis for assigning an incident severity level?

Accepted Answer

The assessed business impact and the criticality of the affected information assets.. Severity classification must translate technical events into business consequences so that escalation, notification, and resource allocation are consistent and defensible. Basing severity on business impact and asset criticality ensures identical event types can be triaged differently according to what is at stake, and it gives management a repeatable trigger for its involvement.

Answer

The number of security alerts generated by the detection tooling during the event.

Answer

The elapsed time between the first log entry and the moment the analyst opens the ticket.

Answer

The technical sophistication of the attacker's tools and malware used in the intrusion.

Question 14

An organization has just completed containment of a malware outbreak. The incident manager is preparing to transition the incident to the eradication and recovery phase. Which activity should occur FIRST during this transition?

Accepted Answer

Identify and remove the root cause and all remnants of the malware from affected systems. The incident response lifecycle moves from preparation to detection and analysis, containment, eradication, recovery, and post-incident activity. Once containment is achieved, the next phase is eradication, which removes the root cause and residual threat. Recovery, regulatory notification, and lessons learned come later. Performing eradication before recovery prevents reinfection and ensures that restored systems are not compromised again by the same vector.

Answer

Notify external regulators of the incident in accordance with legal requirements

Answer

Restore all affected systems from the most recent backups and return them to production

Answer

Conduct a lessons-learned meeting with all incident responders

Question 15

A global insurance provider has completed a risk assessment for a new policyholder web portal. The risk treatment plan includes purchasing cyber insurance to transfer a portion of the financial impact. Which of the following is the PRIMARY consideration when evaluating this treatment option?

Accepted Answer

The cost of the premium relative to the potential financial impact and risk appetite. Risk transfer via insurance is justified when the premium is reasonable relative to the potential loss and the residual risk after deductibles and limits remains within the organization's risk appetite. The other factors, such as speed, peer adoption, or hopes of full coverage, do not address the fundamental cost-benefit and risk tolerance alignment required for effective treatment selection.

Answer

The number of other organizations that have purchased similar coverage

Answer

The insurer's ability to cover the full impact of a catastrophic breach

Answer

The speed at which the policy can be underwritten and bound

Question 16

A healthcare organization is conducting a risk assessment for its electronic health record (EHR) system. The security manager is identifying threats and vulnerabilities. Which TWO of the following are considered vulnerabilities rather than threats? (Choose two.)

Accepted Answer

Unpatched software on the EHR server.. Vulnerabilities are weaknesses or gaps in controls that can be exploited by threats. Unpatched software and weak password policies are examples of such weaknesses because they represent deficiencies in security controls. Threats, on the other hand, are actors or events that can exploit vulnerabilities, such as disgruntled employees, ransomware groups, or natural disasters. Correctly distinguishing between the two is essential for accurate risk assessment.

Answer

Natural disasters such as floods in the data center region.

Answer

A ransomware group targeting healthcare providers.

Answer

A disgruntled employee with administrative access.

Question 17

A CISO is updating the enterprise information security strategy. The organization's business strategy now emphasizes rapid expansion into cloud-based services and third-party partnerships. Which of the following should be the CISO's FIRST action to ensure the security strategy remains aligned with the business strategy?

Accepted Answer

Map the current security program objectives to the new business drivers and identify gaps.. The correct answer is to map current security program objectives to the new business drivers and identify gaps. This step ensures the security strategy is directly aligned with the organization's cloud expansion and partnership goals. It provides a factual basis for adjusting policies, budgets, and controls, and it demonstrates to stakeholders that security is a business enabler. Without this mapping, subsequent actions risk being disconnected from strategic intent.

Answer

Immediately update the security policy to include cloud and third-party requirements.

Answer

Present the current security budget to the board for approval.

Answer

Conduct a penetration test of the existing cloud environments.

Question 18

A global retailer is preparing to adopt a new cloud-based point-of-sale platform. The CISO must ensure the risk assessment approach is repeatable and comparable over time. Which of the following is the MOST important characteristic of the risk assessment methodology to achieve this?

Accepted Answer

It uses a consistent set of defined likelihood and impact criteria.. Repeatability and comparability depend on consistent measurement criteria. By defining what likelihood and impact mean and how they are rated, the organization ensures that different assessors evaluating the cloud POS platform or other systems will produce results that can be compared and trended. Documentation, governance approval and ERM alignment support the process but do not by themselves eliminate subjective variation in risk ratings.

Answer

It documents the risk assessment results in a centralized risk register.

Answer

It aligns with the organization’s overall enterprise risk management framework.

Answer

It is reviewed and approved annually by the board of directors.

Question 19

An organization's incident response team has contained a malware outbreak, but the attacker's initial access vector remains unknown. Which activity should be performed to reduce the likelihood of recurrence?

Accepted Answer

Perform a root cause analysis to identify and remediate the initial access vector.. When the initial access vector is unknown, the highest priority is a structured root cause analysis to determine how the attacker entered and to eliminate that pathway. This prevents recurrence and feeds lessons learned into control improvements, monitoring enhancements, and plan updates. Recovery, signature updates, and awareness communications are useful supporting activities, but none of them replaces identifying and closing the actual entry point.

Answer

Notify all employees about the incident and remind them of security policies.

Answer

Increase the frequency of antivirus signature updates on all endpoints.

Answer

Close the incident and restore affected systems from backups.

Question 20

A security manager is developing a business case for a new security program. The organization's executives are primarily focused on revenue growth and market expansion. Which approach is MOST effective for securing executive support and funding?

Accepted Answer

Demonstrate how security enables the achievement of business objectives and protects revenue streams. The most effective approach is to demonstrate how security enables business objectives and protects revenue streams. This aligns security with the executives' strategic priorities, positioning it as a value driver rather than a cost. By showing that security supports growth, innovation, and customer trust, the CISO can build a compelling business case that resonates with executive leadership and secures necessary funding.

Answer

Highlight the technical sophistication of the proposed security controls

Answer

Emphasize the potential cost savings from preventing security incidents

Answer

Present industry benchmarks showing the average cost of a data breach