CISM Information Security Program Practice Test 3 — 15 Questions

Question 1

An organization's information security program recently experienced a ransomware attack that encrypted critical data. Which of the following program components should be improved first to prevent recurrence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a robust backup and recovery process with offline copies.. While all options are valid security measures, the immediate priority after a ransomware attack that has already encrypted critical data is to ensure data resilience. A robust backup and recovery process with offline copies (e.g., immutable snapshots or air-gapped tape backups) directly addresses the core impact of ransomware by enabling restoration without paying the ransom. Without recoverable backups, even the best incident response plan or training cannot undo the encryption.

Answer

Develop an incident response plan specific to ransomware.

Answer

Conduct additional security awareness training on phishing.

Answer

Enhance network segmentation to isolate critical systems.

Question 2

Which TWO of the following are essential components of an information security program charter?

Accepted Answer

Roles, responsibilities, and authority of the program team.. The charter must define the roles, responsibilities, and authority of the program team to establish clear governance and accountability. Without this, the program lacks the organizational mandate to enforce policies and allocate resources effectively.

Answer

List of approved security technologies.

Answer

Detailed annual budget allocation.

Answer

List of approved third-party vendors.

Question 3

You are the CISO of a large healthcare organization that has recently experienced a data breach due to an insider who exfiltrated patient data over several months. The breach was discovered by an external partner. The organization's information security program includes data loss prevention (DLP) tools, but they were not configured to monitor outbound data from the compromised system. Additionally, user activity monitoring (UAM) was only applied to privileged users, not to regular staff. The board demands a comprehensive improvement plan that will prevent similar incidents. However, there are concerns about employee privacy and budget constraints. The organization has a strong culture of trust and minimal monitoring. Which of the following should be the first priority in the revised program?

Accepted Answer

Expand user activity monitoring to all employees with a clear policy on privacy and acceptable use.. Expanding user activity monitoring (UAM) to all employees with a clear privacy and acceptable-use policy directly addresses the root cause: the insider was a regular staff member whose activity was not monitored. UAM provides the visibility needed to detect anomalous behavior such as bulk data access or off-hours exfiltration, which DLP alone cannot catch if the data path isn't instrumented. Pairing the technical control with a documented policy also addresses the privacy and trust concerns raised by the board, making it the foundational first step before tuning DLP or adding training.

Answer

Implement stricter access controls and review user permissions quarterly.

Answer

Deploy a new DLP solution with advanced analytics and block all external data transfers.

Answer

Conduct additional security awareness training focused on insider threats.

Question 4

You are the director of information security at a multinational corporation that operates in many countries with conflicting data privacy laws. The company's information security program includes a data classification policy and a data retention schedule, but there is no consistent method for handling cross-border data flows. Recently, a regulator in Country A fined the company for transferring personal data to Country B, which does not provide adequate protection. The legal department recommends implementing a binding corporate rules (BCR) approach, but the IT department says it would be too complex to implement across all systems. You must update the program to ensure compliance while minimizing operational impact. The board wants a solution that can be implemented within one year with reasonable cost. What should you do?

Accepted Answer

Conduct a data mapping exercise and implement a data classification tagging system to automate controls on sensitive data flows.. A data mapping exercise identifies where personal data resides, how it flows across borders, and which data is subject to conflicting regulations; tagging data by classification then enables automated controls (e.g., blocking or encrypting sensitive transfers) at the system level. This approach is pragmatic, scalable, and can be implemented within a year at reasonable cost, unlike BCRs which require lengthy regulatory approvals and complex legal frameworks across all entities. It also directly addresses the root cause — lack of visibility and consistent handling of cross-border flows — while minimizing operational disruption.

Answer

Implement binding corporate rules (BCR) across all entities as recommended by legal.

Answer

Rely on standard contractual clauses (SCCs) for all cross-border data flows.

Answer

Stop all cross-border data transfers until compliant mechanisms are fully implemented.

Question 5

During an audit of the information security program, the auditor identifies that several critical systems are not included in the incident response plan. Which of the following are the MOST appropriate actions for the security manager to take? (Select TWO.)

Accepted Answer

Update the incident response plan to include all critical systems. The incident response plan must be a living document that covers all critical systems to ensure a coordinated and effective response during a security incident. Excluding critical systems from the plan creates a blind spot that could lead to delayed containment, increased damage, or non-compliance with regulatory requirements. Updating the plan to include these systems is a direct corrective action that aligns with the CISM principle of maintaining an up-to-date incident response capability.

Answer

Implement compensating controls on the excluded systems

Answer

Document the finding and accept the risk

Answer

Immediately remove the excluded systems from production

Question 6

An information security manager reviews the suspicious activity log shown in the exhibit. The payroll file is supposed to be encrypted and only accessible internally. What is the MOST likely cause for the failed download?

Accepted Answer

The user lacked permission to decrypt the file. The status 'Encryption key not found' indicates that the user does not have the necessary decryption key, likely due to lack of permission. Option A is wrong because certificate expiry would show a different error. Option B is wrong because if the file were not encrypted, it would download successfully. Option D is wrong because if the external IP were blocked, the download would not initiate.

Answer

The user's encryption certificate has expired

Answer

The file was not encrypted before being uploaded

Answer

The external IP is blocked by the firewall

Question 7

A CISO is reviewing the information security program's performance metrics. The board has requested assurance that the program is effectively managing risks and aligning with business goals. Which two of the following are the MOST appropriate key performance indicators (KPIs) for the security program? (Choose two.)

Accepted Answer

Percentage of critical systems covered by vulnerability scans.. The most appropriate KPIs are those that directly measure the program's effectiveness in managing risks and aligning with business goals. Percentage of critical systems covered by vulnerability scans and mean time to remediate critical vulnerabilities are both actionable, outcome-oriented metrics that reflect the program's ability to identify and address risks efficiently, providing the board with meaningful assurance.

Answer

Percentage of employees who completed security awareness training.

Answer

Total number of security policies documented.

Answer

Number of security incidents reported by employees.

Question 8

A global healthcare organization has a mature information security program. The CISO is reviewing the program's performance metrics and notices that the number of security incidents is increasing, but the mean time to detect (MTTD) and mean time to respond (MTTR) have remained stable. The CISO wants to improve the program's ability to identify and respond to emerging threats. Which of the following should be the CISO's PRIMARY focus?

Accepted Answer

Implementing security orchestration, automation, and response (SOAR) to streamline incident handling and reduce response times.. Implementing SOAR directly targets the stagnation in MTTD and MTTR by automating and orchestrating incident response workflows. This allows the security team to handle a growing volume of incidents more efficiently without a proportional increase in time. While other options have merit, they do not address the core issue of improving detection and response efficiency as directly as SOAR does.

Answer

Enhancing threat intelligence capabilities to proactively identify new threat actors and tactics.

Answer

Increasing the size of the security operations center (SOC) team to handle the growing incident volume.

Answer

Conducting a comprehensive risk assessment to identify new vulnerabilities in the environment.

Question 9

An organization's information security program recently experienced a ransomware attack that encrypted critical data. Which of the following program components should be improved first to prevent recurrence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a risk assessment to identify gaps and prioritize remediation.. Conducting a risk assessment first (Option C) is the correct initial step because it systematically identifies where controls are failing or missing across business units, quantifies the associated risks, and prioritizes remediation based on business impact. Without this foundational analysis, any subsequent actions—such as automation, policy updates, or new controls—would lack direction and could waste resources on low-priority areas. This aligns with the CISM program lifecycle, where risk assessment drives all other program improvements.

Answer

Automate security compliance monitoring across all business units.

Answer

Update the information security policy to mandate compliance.

Answer

Implement additional security controls across all business units.

Question 10

A multinational corporation is designing its information security program and must decide how to balance security with business agility. The company operates in highly regulated industries with varying legal requirements. Which of the following approaches BEST aligns with industry best practices for such an environment?

Accepted Answer

Develop a risk-based framework that allows for tailored controls based on local risk assessments.. A risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.

Answer

Implement the strictest regulatory requirements globally to ensure compliance everywhere.

Answer

Adopt a baseline of controls that meet the lowest common denominator of all regulations.

Answer

Allow each business unit to define its own security controls based on local requirements.

Question 11

An organization is developing a new information security program and wants to ensure it aligns with business objectives. Which of the following is the MOST critical first step?

Accepted Answer

Identify business strategy and risk appetite.. Identifying business strategy and risk appetite is the most critical first step because the information security program must be designed to support the organization's objectives and operate within the risk tolerance defined by leadership. Without this alignment, subsequent security controls and investments may conflict with business goals or fail to address the risks the organization is willing to accept. This ensures that security is a business enabler rather than a technical silo.

Answer

Develop a security awareness training program.

Answer

Design the security architecture based on industry frameworks.

Answer

Conduct a comprehensive risk assessment.

Question 12

During a merger, two companies with different information security programs are being integrated. The combined entity must maintain compliance with PCI DSS and GDPR. The CISO is concerned about gaps in coverage due to differing maturity levels. Which of the following is the BEST approach to harmonize the programs?

Accepted Answer

Perform a gap analysis against the requirements and prioritize remediation.. A gap analysis against the combined requirements of PCI DSS and GDPR identifies exactly where each legacy program falls short, allowing the CISO to prioritize remediation based on risk and regulatory obligation. This is the standard, defensible approach for harmonizing programs during M&A because it is evidence-based, accounts for differing maturity levels, and produces a prioritized roadmap rather than a blunt consolidation. It also respects that the two regulations have different scopes (PCI DSS for cardholder data, GDPR for personal data of EU residents).

Answer

Adopt the more stringent security program from the acquirer across the entire entity.

Answer

Merge the two programs by combining all controls from each.

Answer

Implement a completely new framework that meets both regulations.

Question 13

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Accepted Answer

A steering committee that includes senior management and business unit leaders.. A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Answer

An incident response plan that defines roles and procedures.

Answer

A vulnerability scanning schedule and remediation SLAs.

Answer

A firewall policy that specifies allowed and denied traffic.

Question 14

Refer to the exhibit. An analyst observes the network traffic between three internal hosts and a web server. Which of the following is the MOST likely interpretation of this traffic?

Accepted Answer

Multiple users are accessing the web server normally.. The exhibit shows multiple internal hosts (10.0.0.1, 10.0.0.2, 10.0.0.3) each establishing a normal TCP three-way handshake with the web server (192.168.1.100) on port 80, with varying source ports and no abnormal flags or packet rates. This pattern indicates legitimate concurrent user access, as each host completes the handshake and exchanges data without flooding or scanning behavior.

Answer

A SYN flood attack is in progress.

Answer

A single host is using multiple IP addresses to scan the server.

Answer

A distributed denial-of-service (DDoS) attack is occurring.

Question 15

You are the CISO of a mid-sized financial services firm that processes credit card transactions. The company has recently expanded its operations to include a mobile payment application that stores payment credentials in the cloud. The current information security program was designed primarily for the on-premises environment and has not been updated to address cloud-specific risks. The internal audit team has identified that the cloud service provider (CSP) does not have an independent third-party audit report (e.g., SOC 2) available for review. Additionally, the mobile app development team has been deploying code without formal security review, citing the need for rapid releases to compete in the market. The CEO has expressed concern about the potential for a data breach and has asked you to recommend immediate actions to strengthen the security program while minimizing business disruption. Which of the following should you recommend as the FIRST course of action?

Accepted Answer

Conduct a detailed security assessment of the cloud service provider's controls and contractually require an annual SOC 2 Type II report.. The correct first course of action because the absence of an independent third-party audit report (e.g., SOC 2 Type II) means the organization has no verified assurance that the cloud service provider (CSP) has adequate security controls in place. As CISO, you must immediately assess the CSP's security posture and contractually mandate a SOC 2 Type II report to gain visibility into the effectiveness of the CSP's controls over time, which is foundational before implementing any compensating technical controls. This aligns with the CISM domain of Information Security Program governance, where vendor risk management and due diligence are critical first steps when expanding into cloud environments.

Answer

Encrypt all data in transit and at rest using the organization's own encryption keys.

Answer

Implement compensating controls such as tokenization for all cardholder data stored in the cloud.

Answer

Require the mobile app development team to undergo formal security training and implement a peer review process for all code deployments.