CISM Practice Test 7 — 10 Questions

Question 1

A newly appointed CISO wants to establish an information security governance committee. What is the PRIMARY purpose of this committee?

Accepted Answer

To ensure security strategy aligns with business objectives and provide oversight.. The primary purpose of an information security governance committee is to ensure that the security strategy aligns with business objectives and to provide oversight. This committee does not execute day-to-day operations or implement controls; instead, it sets direction, reviews risk posture, and ensures that security investments support organizational goals, as defined in frameworks like COBIT and ISO 38500.

Answer

To manage day-to-day security operations.

Answer

To implement security controls across the organization.

Answer

To approve technical security solutions.

Question 2

An organization uses the ISO 31000 risk management framework. During the risk evaluation phase, it determines that a certain risk has a low likelihood but very high impact. The organization's risk appetite is moderate. Which of the following is the MOST appropriate risk treatment decision?

Accepted Answer

Mitigate the risk by implementing controls to reduce impact. ISO 31000's risk evaluation phase requires aligning treatment decisions with the organization's risk appetite. With a moderate risk appetite, a low-likelihood but very-high-impact risk cannot simply be accepted (as it exceeds appetite), nor is avoidance necessary since the likelihood is low. Mitigation through controls that reduce the impact is the most balanced approach, bringing the residual risk within the moderate appetite threshold.

Answer

Accept the risk due to low likelihood

Answer

Avoid the risk by discontinuing the activity that generates it

Answer

Transfer the risk through insurance

Question 3

An organization is implementing a security controls framework and must decide on prioritization. According to defense-in-depth principles, which approach should be taken first?

Accepted Answer

Prioritize critical controls that address the most significant risks. Defense-in-depth starts with critical controls that protect against the most likely threats, often following frameworks like CIS Critical Controls, which prioritize foundational controls.

Answer

Select all controls from NIST SP 800-53 without prioritization

Answer

Deploy business-enabling controls that support operations

Answer

Implement compensating controls to address gaps in existing controls

Question 4

Which of the following is the PRIMARY role of the board of directors in information security governance?

Accepted Answer

Providing strategic direction and oversight of the security program.. The board of directors holds the ultimate fiduciary responsibility for the organization, including its information security posture. Their primary role is to provide strategic direction and oversight, ensuring that the security program aligns with business objectives, risk appetite, and regulatory requirements. This includes approving the overall security strategy, reviewing key risk indicators, and holding management accountable for security performance, not executing tactical tasks.

Answer

Managing the day-to-day security operations.

Answer

Implementing security controls and technologies.

Answer

Developing detailed security policies and procedures.

Question 5

An information security manager is developing a security program for a multinational organization. Which of the following should be considered when defining the program scope? (Select THREE)

Accepted Answer

Business objectives and strategy. Business objectives and strategy (A) are foundational because the security program must align with and support the organization's mission, risk appetite, and strategic goals. Without this alignment, security controls may conflict with business operations or fail to prioritize critical assets, leading to wasted resources or increased risk exposure.

Answer

Current technology architecture

Question 6

Refer to the exhibit. An analyst observes the network traffic between three internal hosts and a web server. Which of the following is the MOST likely interpretation of this traffic?

Accepted Answer

Multiple users are accessing the web server normally.. The exhibit shows multiple internal hosts (10.0.0.1, 10.0.0.2, 10.0.0.3) each establishing a normal TCP three-way handshake with the web server (192.168.1.100) on port 80, with varying source ports and no abnormal flags or packet rates. This pattern indicates legitimate concurrent user access, as each host completes the handshake and exchanges data without flooding or scanning behavior.

Answer

A SYN flood attack is in progress.

Answer

A single host is using multiple IP addresses to scan the server.

Answer

A distributed denial-of-service (DDoS) attack is occurring.

Question 7

Which of the following are key components of an information security program's strategic plan? (Select two.)

Accepted Answer

Security program vision and objectives. The strategic plan for an information security program defines the long-term direction and governance framework. The security program vision and objectives (B) establish the overarching goals and alignment with business strategy, while the roadmap for security initiatives (D) provides the phased implementation plan to achieve those objectives. These are foundational components of strategic planning, not operational or tactical elements.

Answer

Annual budget allocation

Answer

Incident response procedures

Question 8

During a risk assessment, the risk team identifies that a key vendor has access to sensitive data. The vendor's security posture is unclear. Which of the following is the BEST course of action?

Accepted Answer

Conduct a third-party risk assessment. When a vendor's security posture is unclear and they have access to sensitive data, the best course of action is to conduct a third-party risk assessment. This assessment evaluates the vendor's security controls, compliance with standards (e.g., ISO 27001, SOC 2), and contractual obligations before making any decisions. It provides the necessary evidence to determine if the risk is acceptable or requires mitigation, rather than acting on assumptions.

Answer

Ignore the risk because the vendor is known

Answer

Terminate the vendor relationship immediately

Answer

Request the vendor's latest security certification

Question 9

An information security program is being developed for a multinational organization. Which of the following is the PRIMARY driver for aligning the security program with business objectives?

Accepted Answer

Achieving the organization's strategic goals. The primary driver for aligning the security program with business objectives is to ensure that security initiatives directly support and enable the organization's strategic goals. Without this alignment, security becomes a cost center rather than a business enabler, and resources may be misallocated to activities that do not advance the enterprise's mission. CISM emphasizes that security governance must be integrated with business strategy to justify investment and demonstrate value to stakeholders.

Answer

Compliance with industry regulations

Answer

Reducing information security costs

Answer

Implementing the latest security technologies

Question 10

Which THREE are valid sources for threat intelligence that can be used during incident response? (Choose three.)

Accepted Answer

Industry information sharing groups. Industry information sharing groups (Option B) are a valid source of threat intelligence because they provide curated, actionable data on emerging threats, indicators of compromise (IOCs), and attack patterns from peer organizations. This intelligence is directly applicable during incident response to identify known adversary tactics, techniques, and procedures (TTPs) and to correlate findings with ongoing incidents.

Answer

Social media posts from employees

Answer

Internal network traffic logs