CISM Practice Test 8 — 10 Questions

Question 1

A financial institution is hit by a Distributed Denial of Service (DDoS) attack that is overwhelming their internet-facing services. The incident response team activates the plan, but the attack continues to escalate. The CEO is under pressure and asks the incident response manager whether they should pay the ransom demand (the attackers also sent an extortion note demanding payment to stop the attack). The manager must advise the CEO on the best course of action.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Engage a DDoS scrubbing service to filter malicious traffic. Using DDoS scrubbing services (cloud-based or on-premise) is the recommended technical defense. Paying the ransom encourages future attacks and does not guarantee the attack will stop. Rate limiting may affect legitimate traffic. Shutting down external access is too drastic and impacts business.

Answer

Implement rate limiting on the firewall

Answer

Shut down all external-facing services

Answer

Pay the ransom to stop the attack immediately

Question 2

A small marketing firm with 50 employees experiences a ransomware attack. The IT administrator quickly isolates the infected workstations by disconnecting them from the network. The company has a backup strategy that performs nightly backups to an on-premises NAS device. The administrator restores the affected systems from the most recent backup, but some files remain encrypted. The users report that the backups from the last two days show corruption as well. The firm does not have a formal incident response plan. The owner is anxious to get back to work and asks the administrator what to do next. What should the administrator do?

Accepted Answer

Restore from an older backup taken before the infection. Restoring from an older backup (before the ransomware infection occurred) is the most likely way to get clean data. Paying the ransom is not recommended as it encourages attackers and there is no guarantee. Contacting law enforcement is a good step but not the immediate technical solution. Running an antivirus scan is insufficient for decryption.

Answer

Contact law enforcement immediately

Answer

Pay the ransom to get the decryption key

Answer

Run a full antivirus scan on the restored systems

Question 3

Which THREE of the following are common challenges when implementing a risk management program in an organization? (Choose three.)

Accepted Answer

Lack of senior management support. Lack of senior management support (A) is a common challenge because risk management programs require executive sponsorship to enforce policies, allocate budget, and drive cross-departmental compliance. Without C-level backing, risk assessments and remediation efforts often stall due to insufficient authority and resources.

Answer

Too many controls implemented too quickly

Answer

Overly detailed risk appetite

Question 4

A manufacturing company has an incident response plan that includes a communication plan. However, during a recent ransomware incident, the team realized that the external legal counsel was not listed in the plan. The incident requires consultation with legal due to potential regulatory implications. The incident response manager needs to address this gap quickly. What should the manager do?

Accepted Answer

Add the legal counsel to the incident response plan immediately. The manager should add legal counsel to the communication plan immediately to ensure they are included in future incidents. Ignoring them or delaying notification could worsen regulatory consequences. Using internal legal might not be sufficient for external counsel needs.

Answer

Notify legal counsel after the incident is resolved

Answer

Use only internal legal department instead of external counsel

Answer

Ignore legal counsel involvement for this incident

Question 5

During third-party risk assessment, a vendor is found to have access to sensitive customer data. The vendor's own supply chain includes a critical fourth-party component. What is the BEST way to address this nth-party risk?

Accepted Answer

Request the vendor to assess and pass through security requirements to its suppliers. Requiring the vendor to manage its sub-suppliers through contractual flow-down ensures the organization's risk requirements extend throughout the supply chain.

Answer

Ignore the fourth party as it is outside the organization's scope

Answer

Conduct a direct assessment of the fourth party

Answer

Terminate the contract with the vendor

Question 6

An organization's security program includes metrics to measure performance. Which metric BEST indicates the effectiveness of the vulnerability management process?

Accepted Answer

Mean time to remediate (MTTR) vulnerabilities. Mean time to remediate (MTTR) directly measures how quickly the organization closes the window of exposure after a vulnerability is identified. A lower MTTR indicates a more effective vulnerability management process because it reduces the risk window, whereas raw counts of vulnerabilities or patches do not reflect the timeliness or completeness of remediation.

Answer

Number of vulnerabilities identified

Answer

Number of patches deployed per month

Answer

Percentage of systems scanned weekly

Question 7

Which document should be reviewed and updated at least annually?

Accepted Answer

Incident response plan. The incident response plan must be reviewed and updated at least annually to ensure it remains effective against evolving threats and changes in the organization. Option B is correct. Vendor contracts (A), network topology diagrams (C), and user manuals (D) are typically reviewed on a different schedule or as needed, not necessarily annually.

Answer

Vendor contracts

Answer

Network topology diagram

Answer

User manuals

Question 8

An organization has experienced a DDoS attack that is overwhelming its internet-facing services. The incident response team has implemented mitigations, but services remain degraded. The maximum tolerable downtime (MTD) for the affected services is 4 hours, and 3 hours have passed. Which of the following should the incident manager do NEXT?

Accepted Answer

Escalate to the crisis management team to consider activating the disaster recovery plan.. If an incident cannot be resolved within the MTD, it should transition to BC/DR activation. The decision authority (e.g., CISO or CMT) should declare a disaster.

Answer

Continue current mitigation efforts and reassess after another hour.

Answer

Increase the capacity of the DDoS mitigation service.

Answer

Notify customers of a prolonged outage.

Question 9

You are the CISO of a mid-sized e-commerce company with 500 employees. The company recently suffered a data breach where an attacker exfiltrated customer credit card data from the production database. The investigation revealed that the breach originated from a compromised developer workstation. The developer had been granted direct access to the production database for troubleshooting purposes, a practice that had been in place for years. The security governance framework currently lacks a formal process for managing privileged access. The board has asked for immediate improvements to prevent recurrence. Which course of action BEST addresses the governance gap?

Accepted Answer

Implement a privileged access management (PAM) solution with just-in-time access and session recording.. The core governance gap is the lack of a formal process for managing privileged access. Implementing a Privileged Access Management (PAM) solution with just-in-time (JIT) access and session recording directly addresses this by enforcing time-bound, auditable, and approved access to the production database, eliminating standing privileges. This aligns with the principle of least privilege and provides a governance mechanism to control, monitor, and revoke elevated access, which is the root cause of the breach.

Answer

Segment the network to isolate production databases from developer workstations.

Answer

Conduct security awareness training for all developers on password security.

Answer

Deploy endpoint protection and patch management for all workstations.

Question 10

You are the incident response manager for a multinational corporation that processes sensitive financial data. The company has a mature security operations center (SOC) that monitors network traffic, endpoints, and cloud services. At 2:00 AM local time, the SOC alerts you to a critical incident: an internal server (IP 10.10.10.50) is communicating with an external IP address (198.51.100.23) known to be associated with a ransomware group. The server hosts a financial database that is replicated to a secondary site every 6 hours. The last successful replication was at 1:00 AM. The SOC has already isolated the server from the network by blocking its outbound traffic at the firewall. However, the server is still running. The initial investigation suggests that the communication started 30 minutes ago. The database contains customer PII and transactional data. Your incident response plan includes steps for containment, eradication, recovery, and post-incident review. The CEO is being notified and expects a recommendation on the best course of action. The company has a cyber insurance policy that requires timely notification and preservation of evidence. The legal department advises that any action that could destroy evidence must be carefully considered. Which of the following is the BEST course of action?

Accepted Answer

Take a forensic image of the server's memory and disk for analysis, then rebuild the server from a known good backup.. It balances forensic preservation (memory and disk imaging) with recovery from a known good backup, ensuring evidence is intact for legal and insurance requirements while restoring operations. The server is isolated, so imaging can be done safely without risk of further compromise, and the 1:00 AM backup (just one hour before the 2:00 AM communication started) is likely clean, minimizing data loss.

Answer

Reconnect the server to the network and attempt to negotiate with the attacker if ransomware is detected.

Answer

Immediately wipe the server and restore from the 1:00 AM backup to minimize downtime.

Answer

Leave the server isolated but running to monitor the attacker's actions and gather intelligence.