CISM Practice Test 9 — 10 Questions

Question 1

Which TWO of the following are key components of a security operations center (SOC)? (Select TWO)

Accepted Answer

Incident response. Incident response (C) is a core SOC component because the SOC's mission includes detecting, containing, eradicating, and recovering from security incidents, typically following a defined IR lifecycle and using tools like SIEM alerts, ticketing, and forensic analysis. Security monitoring and detection (D) is also fundamental, as the SOC continuously collects and correlates telemetry (for example, logs and network flows via a SIEM) to identify suspicious activity and generate alerts that drive response. Vulnerability scanning (A) is a vulnerability management activity often performed by a separate team, even if its output may inform SOC prioritization. Identity and access management (B) is an access-control discipline typically owned by IAM/identity teams, not a defining SOC component. Application security testing (E) belongs to secure development/AppSec functions such as SAST, DAST, and SCA, rather than the SOC's monitoring-and-response core.

Answer

Vulnerability scanning

Answer

Identity and access management

Answer

Application security testing

Question 2

Which of the following is the PRIMARY responsibility of the CISO in an organization?

Accepted Answer

Owning the information security strategy and programme. The CISO is a senior executive whose primary accountability is owning and directing the information security strategy and programme, aligning it with business objectives and reporting to the board or CEO. This strategic ownership distinguishes the role from operational or assurance functions. Managing infrastructure, auditing controls, and running day-to-day operations are execution responsibilities delegated to IT, audit, and security operations teams respectively.

Answer

Managing the IT infrastructure

Answer

Auditing security controls

Answer

Performing day-to-day security operations

Question 3

An organization's information security program has been in place for two years. During a recent audit, several findings indicated that security controls are not consistently applied across business units. The CISO has been asked to improve the program. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a risk assessment to identify gaps and prioritize remediation.. Conducting a risk assessment first (Option C) is the correct initial step because it systematically identifies where controls are failing or missing across business units, quantifies the associated risks, and prioritizes remediation based on business impact. Without this foundational analysis, any subsequent actions—such as automation, policy updates, or new controls—would lack direction and could waste resources on low-priority areas. This aligns with the CISM program lifecycle, where risk assessment drives all other program improvements.

Answer

Automate security compliance monitoring across all business units.

Answer

Update the information security policy to mandate compliance.

Answer

Implement additional security controls across all business units.

Question 4

Which of the following is the most important factor for ensuring the long-term success of an information security program?

Accepted Answer

Strong support from top management.. Strong support from top management is the most important factor because it ensures the information security program receives adequate budget, organizational authority, and strategic alignment with business objectives. Without executive sponsorship, even the best technical controls can be undermined by resource constraints, policy non-compliance, or lack of cross-departmental cooperation. The CISM framework emphasizes that governance and leadership commitment are foundational to sustaining a security program over time.

Answer

Deployment of advanced security technologies.

Answer

Comprehensive security awareness training.

Answer

Regular penetration testing.

Question 5

An incident response team is analyzing a phishing email that successfully compromised a user's credentials. Which TWO indicators of compromise (IOCs) should the team prioritize collecting? (Choose two.)

Accepted Answer

The IP address of the sending server.. Option B is correct because the IP address of the sending server is a network-based IOC that can be used to block or monitor the source of the phishing email and correlate it with other attacks. Option C is correct because the malicious URL or attachment hash provides a host- or file-based IOC that can be used to detect the payload, block it at email/web gateways, and search for other victims. Option A is not a prioritized IOC for this scenario because browser history is user activity data that may be noisy and is not directly tied to the phishing infrastructure. Option D is not an IOC because a personal phone number is not a technical artifact of the compromise. Option E is not an IOC because the company's public website is a legitimate asset, not an indicator of malicious activity.

Answer

The user's browser history.

Answer

The user's personal phone number.

Answer

The company's public website.

Question 6

As part of post-incident activities, an organization schedules a lessons learned meeting. When should this meeting ideally take place?

Accepted Answer

Within 2 weeks of incident resolution. Lessons learned meetings should occur within two weeks of incident resolution while details are fresh, to capture accurate feedback and improve the IR plan.

Answer

At the next quarterly board meeting

Answer

Immediately after the incident is detected

Answer

Only after all legal proceedings are concluded

Question 7

A security program lacks executive support. What is the best strategy to gain support?

Accepted Answer

Show risk quantification in business terms. C is correct because executive stakeholders prioritize business outcomes over technical details. By quantifying risks in financial terms (e.g., potential loss exposure, ROI of mitigation), the security manager aligns with the organization's strategic language, making the case for investment compelling and actionable. This approach directly addresses the root cause—lack of perceived business value—rather than relying on technical arguments or fear.

Answer

Hire a security consultant to advise

Answer

Implement quick-win security improvements

Answer

Threaten regulatory fines for non-compliance

Question 8

A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)

Accepted Answer

Employee role and job function. Option B (Employee role and job function) is correct because employees in finance, HR, or executive roles face different phishing lures and risk levels, so simulations should be tailored to the specific threats and responsibilities of each role. Option C (Past phishing click rate trends) is correct because historical click-rate data reveals which users or departments are most susceptible, allowing frequency and difficulty to be adjusted upward or downward based on demonstrated performance. Option E (Current threat landscape and prevalent attack types) is correct because simulations must reflect real-world tactics such as credential harvesting, QR-code phishing, or business email compromise that are actively trending, ensuring training stays relevant. Option A (Employee's years of service) is not a reliable indicator of phishing susceptibility, since tenure does not correlate consistently with security awareness or behavior. Option D (Number of security incidents in the past year) is too broad and lagging an indicator; it does not directly inform the design of phishing simulation frequency or difficulty the way role, click trends, and threat landscape do.

Answer

Employee's years of service

Answer

Number of security incidents in the past year

Question 9

Which of the following incident categories would typically require the involvement of the crisis management team?

Accepted Answer

A P1 critical-severity ransomware attack encrypting critical systems.. A P1 critical-severity ransomware attack encrypting critical systems requires immediate activation of the crisis management team because it poses an existential threat to business operations, often involving legal, PR, executive, and regulatory stakeholders. The crisis management team handles incidents that exceed the capacity of the incident response team, typically those with high business impact, widespread system compromise, or potential for significant financial/reputational damage.

Answer

A P2 high-severity DDoS attack that has been mitigated within a few hours.

Answer

A P3 medium-severity insider threat involving unauthorized access to a non-critical system.

Answer

A P4 low-severity phishing email reported by a user.

Question 10

A government agency is criticized for poor security governance after a data breach. An external review finds that security policies are not aligned with agency's mission. The director wants to implement a governance framework that ties security to strategic objectives. Which framework is most suitable?

Accepted Answer

COBIT 2019. COBIT 2019 is specifically designed as an IT governance framework that aligns IT (including security) with enterprise strategic objectives. It provides a comprehensive governance system with principles, enablers, and performance management to ensure that IT delivers value and mitigates risks in line with business goals. Unlike security-focused frameworks, COBIT emphasizes governance and management of enterprise IT, making it ideal for tying security to the agency's mission.

Answer

NIST Cybersecurity Framework

Answer

PCI DSS

Answer

ISO 27001