CISM Practice Exam 61 — 20 Questions

Question 1

A retail organisation's security steering committee is prioritising remediation of findings from a recent risk assessment. The CISO must recommend which risk to address FIRST, given limited resources. Which factor should PRIMARILY drive the prioritisation decision?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The risk whose exposure most exceeds the organisation's defined risk appetite and tolerance.. Prioritisation should reflect the gap between current exposure and the board-approved risk appetite and tolerance. That gap defines which risks the organisation has formally committed to treat, and it integrates likelihood, impact, and business context rather than relying on a single dimension such as loss magnitude, audit attention, or technical severity. Aligning remediation with risk appetite keeps security investment defensible to executive stakeholders.

Answer

The risk with the largest potential financial loss in the register.

Answer

The risk that the external auditor flagged in the most recent report.

Answer

The risk with the highest technical severity score from the vulnerability scanner.

Question 2

A global retailer is expanding into new markets and must comply with varying data protection laws. The CISO is revising the information security strategy to ensure it remains aligned with the changing business environment. Which approach BEST ensures ongoing alignment between the security strategy and business objectives?

Accepted Answer

Integrate security strategy reviews into the enterprise strategic planning cycle and adjust based on business changes.. Integrating security strategy reviews into the enterprise strategic planning cycle ensures that security is continuously aligned with business objectives, especially as the retailer enters new markets with different regulations. This approach makes alignment a proactive, recurring process rather than a one-off or reactive activity. It enables the CISO to adjust security initiatives in response to business changes, which is critical for effective governance and risk management.

Answer

Delegate strategy updates to the security operations team based on emerging threats.

Answer

Conduct an annual penetration test and use the results to update the security strategy.

Answer

Adopt a widely recognized security framework and mandate compliance with its controls.

Question 3

A CISO is presenting the information security program's annual report to the board. The board is concerned about the rising cost of cyber insurance and wants to understand how the program can help reduce premiums. Which of the following actions would MOST directly influence the cost of cyber insurance?

Accepted Answer

Implementing and documenting a formal risk management process with regular assessments.. The correct answer is implementing and documenting a formal risk management process with regular assessments. Insurers evaluate the maturity and effectiveness of an organization's risk management to determine premiums. A documented process with regular assessments provides tangible evidence of risk reduction, which is a key factor in negotiating lower premiums.

Answer

Outsourcing security monitoring to a managed security service provider (MSSP).

Answer

Increasing the number of security awareness training sessions per year.

Answer

Purchasing additional security tools to enhance the defense-in-depth strategy.

Question 4

An organization has experienced a security incident involving unauthorized access to a system containing customer data. The incident response team has contained the incident. According to CISM best practices, which of the following should be performed NEXT?

Accepted Answer

Eradicate the root cause of the incident.. After containment, the incident response team should proceed to eradication to remove the root cause of the incident. This ensures that the threat is eliminated before recovery. Recovery, lessons learned, and customer notification are subsequent steps. CISM emphasizes a structured incident response process, and eradication is the logical next phase after containment to prevent the incident from recurring.

Answer

Notify affected customers about the data breach.

Answer

Recover the affected systems to normal operations.

Answer

Conduct a lessons learned session.

Question 5

A CISO is developing a set of key risk indicators (KRIs) to monitor information security governance effectiveness. The CISO wants to ensure that the KRIs are actionable and aligned with business objectives. Which two characteristics are MOST important for effective KRIs? (Choose two.)

Accepted Answer

They are measurable and quantifiable.. Effective KRIs are measurable and quantifiable, enabling objective tracking, and are directly tied to business objectives and risk appetite, ensuring relevance to strategic goals. These characteristics allow the CISO to monitor governance effectiveness and make informed decisions that align security with business needs.

Answer

They are updated on an annual basis to reduce reporting overhead.

Answer

They are based solely on industry benchmarks.

Answer

They are kept confidential and shared only with the security team.

Question 6

A newly appointed CISO is reviewing the organization's information security policy framework. The board asks which document should define the organization's overall security objectives and assign responsibilities at the highest level. Which document is MOST appropriate for this purpose?

Accepted Answer

Information security policy. The information security policy is the foundational governance document, approved at the highest level, that articulates objectives and assigns responsibilities. Standards, procedures, and guidelines derive from and support the policy, forming a hierarchy. Without a clear policy, lower-level documents lack authority and strategic alignment.

Answer

Information security procedures

Answer

Information security standards

Answer

Information security guidelines

Question 7

A global manufacturing company has a decentralized information security program. Each region has its own security team and budget. The CISO is concerned about inconsistent security practices and wants to improve the program's maturity. Which of the following is the MOST effective approach to achieve consistency across regions while respecting local autonomy?

Accepted Answer

Implement a global security governance framework with common standards and local implementation flexibility.. The correct answer is implementing a global security governance framework with common standards and local implementation flexibility. This approach achieves consistency in core security objectives while allowing regions to adapt to local regulations and business needs. It fosters collaboration and compliance, and is a hallmark of mature, decentralized security programs.

Answer

Centralize all security decision-making and budgets at the global headquarters.

Answer

Mandate that all regions follow a single global security policy without exceptions.

Answer

Allow each region to develop its own security program independently to foster innovation.

Question 8

A financial services firm is updating its information security strategy and needs to align it with the organization's overall business goals. The CISO has been asked to ensure that the security strategy directly supports the achievement of business objectives. Which of the following should be the PRIMARY consideration when aligning the security strategy with business goals?

Accepted Answer

Understanding the organization's risk appetite and how security can enable business objectives.. The correct answer is to understand the organization's risk appetite and how security can enable business objectives. Strategic alignment means security supports and enables business goals, which requires knowing what the business wants to achieve and how much risk it is willing to accept. This approach ensures security is a business enabler, not a blocker, and facilitates executive buy-in and resource allocation.

Answer

Ensuring that security controls are implemented using the latest technology available.

Answer

Outsourcing security operations to a managed security service provider (MSSP).

Answer

Deploying a comprehensive set of security controls based on industry best practices.

Question 9

During an annual programme review, the CISO must demonstrate that the security strategy remains aligned with the organization's objectives. Which input is MOST important to validate that alignment?

Accepted Answer

The organization's current business strategy and objectives. Strategic alignment means the security programme's priorities, investments, and risk decisions support the organization's business strategy. The business strategy is therefore the authoritative input against which the plan is validated. Technical scan data, procurement records, and budget variance are useful programme inputs, but each measures execution or exposure rather than whether security is pointed in the same direction as the business.

Answer

The latest vulnerability scan results from the production environment

Answer

The vendor list from the most recent procurement cycle

Answer

The previous year's security budget versus actual expenditure

Question 10

An organization is developing its information security program and wants to ensure that security roles and responsibilities are clearly defined and communicated across the enterprise. Which of the following should be established FIRST to achieve this?

Accepted Answer

A formal security governance structure with defined roles and responsibilities.. Establishing a formal security governance structure is the foundational step for defining and communicating security roles and responsibilities. It clarifies accountability, authority, and reporting lines, which are prerequisites for effective policy development, risk management, and awareness training. Other options are important but depend on governance being in place first. Therefore, governance should be established initially.

Answer

A security awareness training program for all employees.

Answer

An incident response plan that specifies team members and their duties.

Answer

A comprehensive risk assessment to identify critical assets and threats.

Question 11

A software company's security programme has been in place for two years. The CISO wants to determine whether the programme is achieving its intended outcomes and where improvements are needed. Which approach BEST supports this objective?

Accepted Answer

Conduct a formal programme review using defined metrics, control assessments, and stakeholder feedback.. Evaluating programme effectiveness requires a structured review that examines multiple dimensions: performance metrics, control effectiveness, risk posture, and stakeholder perspectives. This holistic approach reveals whether objectives are being met and highlights improvement areas. Technical testing or single-source feedback provides only partial insight and cannot support comprehensive programme evaluation.

Answer

Review the latest vulnerability scan reports and track remediation rates.

Answer

Run a full-scope penetration test against all external-facing applications.

Answer

Survey employees about their perceptions of the security team's responsiveness.

Question 12

A financial services firm has completed a risk assessment and identified that its customer-facing web application has a high risk of SQL injection. The CISO must ensure the risk is treated appropriately. Which of the following should be the FIRST action?

Accepted Answer

Present the risk to the business owner and obtain a decision on risk treatment.. The correct answer is to present the risk to the business owner and obtain a decision on risk treatment. In CISM, risk management is a business responsibility, and the CISO facilitates the process. The business owner must decide whether to mitigate, transfer, avoid, or accept the risk, ensuring alignment with organizational risk appetite and objectives.

Answer

Implement a web application firewall (WAF) in front of the application.

Answer

Immediately patch the application to remove the SQL injection vulnerability.

Answer

Transfer the risk by purchasing cyber insurance.

Question 13

A security manager is reviewing the organization's information security strategy and notices that it focuses heavily on technology controls but lacks integration with business processes. Which action should the manager take to improve alignment with business objectives?

Accepted Answer

Conduct a gap analysis to identify where security processes are not integrated with business processes. Conducting a gap analysis is the most appropriate action because it systematically identifies where security is not integrated with business processes. This understanding enables the manager to develop targeted initiatives to embed security into business operations, ensuring that security supports and enables business objectives. The gap analysis should be collaborative, involving business stakeholders to accurately capture requirements and priorities.

Answer

Increase the budget for security technology to cover more advanced tools

Answer

Hire additional security staff to monitor and respond to incidents more effectively

Answer

Implement a new security awareness program to educate employees about security policies

Question 14

A newly appointed CISO is reviewing the existing information security program. The program has many documented policies and procedures, but the CISO notices that they have not been updated in over three years. What should the CISO do FIRST?

Accepted Answer

Conduct a gap analysis to determine which policies are outdated and need revision.. The correct answer is to conduct a gap analysis first. This step identifies which policies are outdated or missing, allowing the CISO to prioritize updates based on risk and business impact. It ensures that subsequent efforts are targeted and justified, rather than a blanket rewrite that could waste resources and still miss critical issues.

Answer

Schedule a management review to approve the existing policies as they are.

Answer

Immediately rewrite all policies to reflect current best practices.

Answer

Delegate the policy update task to the security team without further direction.

Question 15

A security manager is developing a business case for a new security initiative. The organization's leadership is focused on cost reduction. Which of the following approaches is MOST likely to gain approval?

Accepted Answer

Quantify the potential financial impact of security incidents and demonstrate cost avoidance.. To gain approval from cost-focused leadership, the security manager should quantify the financial impact of risks and demonstrate cost avoidance. This aligns security with business goals and provides a clear return on investment. Other approaches, while valid, may not address the primary concern of cost reduction.

Answer

Emphasize that the initiative is required by industry best practices.

Answer

Highlight that the initiative will improve the organization's security posture.

Answer

Mention that the initiative will help with compliance with regulations.

Question 16

An organisation is reviewing its incident response capabilities after a near-miss. The CISO wants to ensure the team can effectively detect and respond to future incidents. Which TWO of the following are the MOST important capabilities to establish before an incident occurs? (Choose two.)

Accepted Answer

A documented incident response plan with defined roles, responsibilities, and escalation paths.. Effective incident response before an incident occurs depends on two foundational capabilities: a documented plan that defines roles, responsibilities, and escalation, and trained personnel with clear on-call accountability. These elements enable timely detection follow-through, containment, and coordinated recovery. Public relations retainers, forensic laboratories, and cyber insurance are supporting or risk-transfer measures that do not by themselves create response capability, and they cannot substitute for planning and skilled people when an incident actually occurs.

Answer

A full forensic laboratory with hardware write blockers and analysis workstations.

Answer

A cyber insurance policy covering incident response costs and regulatory fines.

Answer

A public relations firm on retainer to manage media inquiries during incidents.

Question 17

A financial services firm with a federated governance model is revising its information security strategy. The board has mandated that security investments must demonstrably support business objectives. The CISO is asked to define the MOST effective way to align security governance with business strategy. Which of the following should the CISO do FIRST?

Accepted Answer

Map information security objectives to the organization's strategic business goals and key performance indicators.. The board's mandate requires demonstrating that security investments support business objectives. Mapping security objectives to strategic business goals and KPIs creates a clear line of sight from security activities to business value, enabling prioritization and justification. This alignment step is foundational; technical assessments, awareness programs, and framework adoption are effective only after strategic alignment is established.

Answer

Conduct a comprehensive vulnerability assessment across all business units to identify technical gaps.

Answer

Implement a security awareness program tailored to each business unit's specific risks.

Answer

Adopt a recognized security framework such as ISO/IEC 27001 to standardize controls across the organization.

Question 18

A CISO is building the resource plan for the information security programme and must decide which activities belong to the programme's core management functions rather than to operational security delivery. (Choose two.)

Accepted Answer

Defining and maintaining the security strategy aligned with enterprise business objectives.. Core programme management functions involve setting direction and securing the means to execute: strategy definition and resource management such as budget and staffing. Operational activities including scanning, SOC monitoring, and firewall administration are delivery tasks that management oversees and funds but does not perform. Separating these layers keeps governance focused and accountability clear.

Answer

Monitoring security information and event management alerts in the security operations centre.

Answer

Administering firewall rule changes and maintaining network access control lists.

Answer

Performing vulnerability scans and tracking remediation of identified technical weaknesses.

Question 19

During a major ransomware incident, the chief information security officer (CISO) must decide whether to pay the ransom to restore encrypted clinical trial data at a pharmaceutical company. The attackers have threatened to publish the data if not paid within 48 hours. Which of the following is the MOST important factor for the CISO to consider when making this business decision?

Accepted Answer

Whether the organization has a validated, tested backup and recovery capability that can restore the data without paying.. A validated and tested backup and recovery capability is the most important factor because it determines whether the organization can restore operations without paying and without trusting the attacker. It directly supports business continuity and reduces the organization's dependence on criminal actors. Insurance, sample decryptors, and attacker reputation are secondary or unreliable considerations that do not resolve the core recovery and risk question.

Answer

Whether the attackers have provided a decryption tool that works on a sample file.

Answer

Whether the attackers have a reputation for honoring their promises in previous incidents.

Answer

Whether the organization has a cyber insurance policy that will reimburse the ransom payment.

Question 20

An organization has recently experienced a data breach that resulted in reputational damage and regulatory fines. The board has asked the CISO to improve the information security governance framework to prevent future incidents. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a post-incident review to identify root causes and lessons learned.. The first step after a breach is to conduct a post-incident review to identify root causes and lessons learned. This evidence-based approach ensures that subsequent improvements to the governance framework are targeted and effective. It helps the CISO understand whether the breach resulted from policy failures, control gaps, or other issues, enabling informed decisions about changes to governance, policies, and controls.

Answer

Implement a new security information and event management (SIEM) system.

Answer

Increase the security budget to hire more security staff.

Answer

Update the security policy to include stricter penalties for non-compliance.