CISM Practice Test 9 — 10 Questions

Question 1

During an incident investigation, the team discovers that an attacker used a valid user's credentials to access a sensitive database. The user's account had multi-factor authentication (MFA) enabled. How is this MOST likely possible?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user approved a fraudulent MFA prompt. MFA fatigue attacks (also known as push bombing) involve an attacker repeatedly sending MFA push notifications to the user until the user, annoyed or confused, approves one. This allows the attacker to bypass MFA without needing the token or password. Option A is less likely because MFA was enabled and properly configured; Option B is incorrect because MFA tokens are generated dynamically and cannot be guessed; Option D is possible but not the most likely given the description that a valid user's credentials were used and MFA was enabled, making user approval the weakest link.

Answer

MFA was not properly configured

Answer

The attacker guessed the MFA token

Answer

The attacker used a man-in-the-middle attack

Question 2

An information security manager is developing a program metric to measure the effectiveness of the security awareness training. Which metric is most appropriate?

Accepted Answer

Number of security incidents caused by human error.. The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

Answer

Percentage of employees who completed the training.

Answer

Average score on post-training tests.

Answer

Time taken to complete the training modules.

Question 3

An incident response team discovers that an attacker used stolen credentials to access a database. Which step is MOST critical during the eradication phase?

Accepted Answer

Reset all passwords and revoke certificates.. During the eradication phase, the primary goal is to remove all traces of the attacker's access and prevent immediate re-entry. Since the breach occurred via stolen credentials, resetting all passwords and revoking certificates ensures that the attacker can no longer authenticate using those compromised secrets, directly addressing the root cause of the initial access.

Answer

Implement multi-factor authentication.

Answer

Patch the database server.

Answer

Restore the database from backup.

Question 4

Match each risk assessment activity with the correct phase of the risk management lifecycle:

Activities:
1. Identify assets and threats
2. Determine risk level
3. Select controls to reduce risk
4. Monitor risk over time

Phases:
A. Risk Assessment
B. Risk Treatment
C. Risk Monitoring
D. Risk Communication (not used)

Answer

Identify assets and threats

Answer

Determine risk level

Answer

Select controls to reduce risk

Answer

Monitor risk over time

Question 5

After a merger, the combined organization has two different risk tolerance levels: one entity is risk-averse, the other is risk-taking. What is the best governance action?

Accepted Answer

Reassess risk appetite and approve a single unified statement. After a merger, maintaining two separate risk tolerance levels creates governance fragmentation and prevents a unified security posture. The correct action is to reassess the combined organization's risk appetite and approve a single unified statement, as this aligns with the CISM principle that risk governance must be cohesive across the entire enterprise. This ensures consistent risk management decisions, resource allocation, and policy enforcement, avoiding conflicts that could lead to security gaps or regulatory non-compliance.

Answer

Adopt the less restrictive risk tolerance

Answer

Maintain separate risk tolerance levels for each legacy entity

Answer

Adopt the more conservative risk tolerance across the board

Question 6

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 7

You are the information security manager for a mid-sized e-commerce company. The company operates a web application that handles credit card transactions and stores customer data in a backend database. The incident response team has just been alerted to a potential data breach: an intrusion detection system (IDS) flagged a SQL injection attack pattern on the web application's login page. The attack originated from an external IP address (5.5.5.5) and appears to have been successful, as the IDS also detected a large outbound data transfer from the database server to another external IP (6.6.6.6) shortly after. The database server is not segmented from the web server. The company has a legal obligation to report breaches involving cardholder data within 72 hours. The incident response plan is being activated. The team includes a forensic analyst, a network engineer, and a legal advisor. The web application is currently running and serving customers. The CEO wants to minimize business disruption. Which of the following actions should the incident response team take FIRST?

Accepted Answer

Isolate the database server from the network and block outbound traffic to the external IP.. The immediate priority is to contain the breach by isolating the compromised database server and blocking outbound traffic to the attacker's IP (6.6.6.6). This stops the exfiltration of cardholder data, preserves evidence on the isolated server, and minimizes business disruption by keeping the web application running. Shutting down servers (Option A) would cause unacceptable downtime, while patching (Option C) or imaging (Option D) without containment would allow continued data loss.

Answer

Shut down the web application and database server immediately to stop the breach.

Answer

Patch the SQL injection vulnerability in the web application and continue monitoring.

Answer

Take a full forensic image of all servers before taking any containment actions.

Question 8

An organization has recently experienced a data breach due to a misconfigured database. The root cause was a lack of proper change management. As part of the risk management process, what should the organization do NEXT after implementing corrective controls?

Accepted Answer

Perform a residual risk assessment. After implementing corrective controls, the next step in the risk management process is to perform a residual risk assessment. This evaluates the remaining risk after controls are applied, ensuring that the organization's risk appetite is not exceeded. Without this assessment, the organization cannot confirm whether the implemented controls are sufficient or if additional measures are needed.

Answer

Purchase additional cyber insurance to cover future breaches

Answer

Conduct security awareness training for all employees

Answer

Update the information security policy to mandate stricter controls

Question 9

An organization's security strategy includes a goal to achieve CMM Level 3. What capability does the organization need to demonstrate?

Accepted Answer

Standardized and documented security processes. Level 3 (Defined) requires standardized, documented processes across the organization.

Answer

Ad-hoc security processes

Answer

Quantitative measurement of process effectiveness

Answer

Continuous process optimization

Question 10

An organization uses ISO 27001 Annex A as its control framework. During a risk assessment, a control weakness is identified that could lead to a high-impact data breach. However, implementing the recommended control is cost-prohibitive. Which approach BEST addresses this situation?

Accepted Answer

Implement a compensating control that provides equivalent protection. Compensating controls provide an alternative means of mitigating risk when the primary control is not feasible.

Answer

Transfer the risk through cyber insurance

Answer

Reduce the risk rating to justify not implementing

Answer

Accept the risk without further action