CISM Hard Questions — 25 Difficult Questions

Question 1

A healthcare organization is developing an information security strategy. The board has mandated that the strategy must support innovation while protecting patient data. Which governance approach BEST balances these priorities?

Accepted Answer

Establish a risk appetite framework that defines acceptable risk levels for innovation initiatives.. A risk appetite framework (Option B) is the correct governance approach because it explicitly defines the level of risk the organization is willing to accept in pursuit of innovation, allowing the board to balance patient data protection with strategic growth. This framework provides a decision-making boundary for security controls, ensuring that innovation initiatives are not stifled by overly restrictive measures while still maintaining compliance with healthcare regulations like HIPAA and HITECH.

Answer

Implement strict access controls and encryption for all data.

Answer

Adopt a 'security by design' approach for all new projects.

Answer

Create a separate innovation sandbox with limited data access.

Question 2

A financial services firm has a mature information security program but is struggling to demonstrate the value of security investments to the board. Which metric would BEST communicate the effectiveness of the security program in business terms?

Accepted Answer

Reduction in average cost per security incident over the past year.. The reduction in average cost per security incident directly translates security program outcomes into financial terms that resonate with the board. This metric demonstrates the program's effectiveness by quantifying the monetary value of improved prevention, detection, and response capabilities, aligning with the CISM focus on governance and business alignment.

Answer

Number of security alerts triaged per day.

Answer

Time to patch critical vulnerabilities.

Answer

Percentage of systems with endpoint protection installed.

Question 3

You are the CISO of a mid-sized e-commerce company with 500 employees. The company recently suffered a data breach where an attacker exfiltrated customer credit card data from the production database. The investigation revealed that the breach originated from a compromised developer workstation. The developer had been granted direct access to the production database for troubleshooting purposes, a practice that had been in place for years. The security governance framework currently lacks a formal process for managing privileged access. The board has asked for immediate improvements to prevent recurrence. Which course of action BEST addresses the governance gap?

Accepted Answer

Implement a privileged access management (PAM) solution with just-in-time access and session recording.. The core governance gap is the lack of a formal process for managing privileged access. Implementing a Privileged Access Management (PAM) solution with just-in-time (JIT) access and session recording directly addresses this by enforcing time-bound, auditable, and approved access to the production database, eliminating standing privileges. This aligns with the principle of least privilege and provides a governance mechanism to control, monitor, and revoke elevated access, which is the root cause of the breach.

Answer

Segment the network to isolate production databases from developer workstations.

Answer

Conduct security awareness training for all developers on password security.

Answer

Deploy endpoint protection and patch management for all workstations.

Question 4

A company is considering outsourcing its security operations center (SOC). Which governance consideration is MOST critical before finalizing the decision?

Accepted Answer

The ability to maintain oversight and accountability for security outcomes.. Option D is correct because governance requires that the organization retains ultimate responsibility for security outcomes, even when functions are outsourced. Without the ability to maintain oversight and accountability, the company cannot ensure that its security posture aligns with business risk tolerance and regulatory compliance requirements. This is a fundamental principle of information security governance, as the board and senior management cannot delegate accountability.

Answer

The vendor's service level agreements (SLAs) for incident response times.

Answer

The vendor's technical expertise and certifications.

Answer

The cost savings compared to in-house operations.

Question 5

During an incident investigation, the security team discovers that an attacker exfiltrated sensitive customer data via encrypted DNS tunneling over a period of three months. The data loss was only noticed after a routine audit. Which of the following weaknesses MOST likely allowed the attacker to remain undetected for so long?

Accepted Answer

Inadequate monitoring of DNS traffic for anomalies. The correct answer is A because DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.

Answer

Weak password policies

Answer

Unpatched web server software

Answer

Lack of data-at-rest encryption

Question 6

An organization uses a SIEM to correlate security events. The SIEM generates an alert for a possible brute-force attack against an admin account. The incident response team reviews the alert and finds that the account is a service account with a known password. What should the team do NEXT?

Accepted Answer

Change the password for the service account. The correct next step is to change the password for the service account because the alert indicates a possible brute-force attack, and a known password represents a compromised credential. Even if the account is a service account, the password must be rotated to prevent unauthorized access. This aligns with the incident response principle of containing the threat by invalidating the compromised authentication factor.

Answer

Notify the service owner

Answer

Disable the service account

Answer

Investigate the source IP addresses

Question 7

After a security incident, the incident response team identifies that the root cause was a phishing email that bypassed the email filter. The email contained a malicious macro that executed PowerShell commands. Which control would be MOST effective in preventing similar incidents in the future?

Accepted Answer

Disable macros in documents originating from external sources. Disabling macros in documents from external sources directly addresses the attack vector: the malicious macro that executed PowerShell commands. This control prevents the macro from running, regardless of the email filter's failure, by blocking the execution environment at the endpoint level. It is a preventive technical control that stops the attack before it can proceed.

Answer

Implement network segmentation for sensitive systems

Answer

Deploy additional antivirus software on endpoints

Answer

Conduct security awareness training for all employees

Question 8

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Accepted Answer

Business impact analysis (BIA) results.. A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Answer

Security awareness training for all employees.

Answer

Vulnerability scanning schedules.

Question 9

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 10

An organization's security team detects an unusual spike in outbound traffic from a database server to an external IP address during a routine security scan. The database server contains sensitive customer data. Which of the following is the MOST appropriate initial response?

Accepted Answer

Isolate the database server from the network to stop the traffic.. Isolating the database server is the most appropriate initial response because it immediately halts the suspected data exfiltration, containing the incident and preventing further loss of sensitive customer data. In incident management, the priority is to stop the active threat before performing any investigative or notification steps, as per the NIST SP 800-61 incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery). Delaying containment to review logs or run scans allows the exfiltration to continue, increasing the potential damage.

Answer

Notify the data protection officer and legal team.

Answer

Review firewall logs to confirm data exfiltration.

Answer

Run a full antivirus scan on the database server.

Question 11

Refer to the exhibit. A security analyst reviews the firewall configuration and identifies a potential risk. What is the most likely risk?

Accepted Answer

Risk of data exfiltration via DNS tunneling.. The exhibit shows a firewall rule that permits DNS traffic (UDP/TCP port 53) from the internal network to any external destination. This configuration allows internal hosts to perform DNS queries to external servers, which can be exploited for DNS tunneling—a technique where data is encapsulated within DNS queries and responses to bypass security controls and exfiltrate sensitive information. Since DNS traffic is typically allowed through firewalls, this creates a covert channel for data exfiltration, making option D the most likely risk.

Answer

Risk of unauthorized external access to internal services.

Answer

Risk of denial-of-service attacks from internal hosts.

Answer

Risk of IP spoofing attacks from the inside network.

Question 12

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

Accepted Answer

Accept the risk because the control is not cost-justified.. The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.

Answer

Accept the risk because ALE after control is only $2,500.

Answer

Implement the control because it reduces ALE to $2,500.

Answer

Implement the control because ALE is $10,000, and control cost is only $12,000.

Question 13

Refer to the exhibit. An analyst observes the network traffic between three internal hosts and a web server. Which of the following is the MOST likely interpretation of this traffic?

Accepted Answer

Multiple users are accessing the web server normally.. The exhibit shows multiple internal hosts (10.0.0.1, 10.0.0.2, 10.0.0.3) each establishing a normal TCP three-way handshake with the web server (192.168.1.100) on port 80, with varying source ports and no abnormal flags or packet rates. This pattern indicates legitimate concurrent user access, as each host completes the handshake and exchanges data without flooding or scanning behavior.

Answer

A SYN flood attack is in progress.

Answer

A single host is using multiple IP addresses to scan the server.

Answer

A distributed denial-of-service (DDoS) attack is occurring.

Question 14

Refer to the exhibit. A security analyst reviews the ACL on the organization's border router. Based on the exhibit, which of the following is the MOST significant governance concern?

Accepted Answer

The ACL does not include filtering for outbound traffic, which may allow spoofed internal IPs to exit the network.. Option B is correct because the ACL shown only filters inbound traffic on the border router's external interface. Without an outbound ACL (or an inbound ACL on the internal interface), spoofed packets with internal source IP addresses can exit the network, enabling IP spoofing attacks that bypass anti-spoofing best practices (RFC 2827, BCP 38). This is a governance concern as it violates the principle of preventing source address spoofing, which is a fundamental security control for network perimeter defense.

Answer

The ACL is applied to the outbound interface, which is ineffective for blocking inbound attacks.

Answer

The ACL permits any traffic after denying specific IP ranges, creating a security gap.

Answer

The ACL permits all traffic from private IP addresses, which could allow internal IP spoofing.

Question 15

During a risk assessment, an organization identifies a critical vulnerability in a legacy system that cannot be patched. The system's availability is crucial for business operations. Which of the following risk treatment strategies is MOST appropriate?

Accepted Answer

Risk acceptance with formal sign-off by senior management. When a critical vulnerability cannot be patched and the system must remain available for business operations, risk acceptance is the most appropriate strategy because it formally acknowledges the residual risk after all feasible controls have been considered. Senior management sign-off is required because the risk exceeds the organization's risk appetite, and acceptance documents the decision to operate with the known vulnerability. This approach aligns with the CISM principle that risk acceptance is a valid treatment when the cost of other treatments exceeds the benefit or when no other treatment is feasible.

Answer

Risk mitigation by implementing compensating controls

Answer

Risk transfer through cyber insurance

Answer

Risk avoidance by decommissioning the system

Question 16

A multinational corporation is designing its information security program and must decide how to balance security with business agility. The company operates in highly regulated industries with varying legal requirements. Which of the following approaches BEST aligns with industry best practices for such an environment?

Accepted Answer

Develop a risk-based framework that allows for tailored controls based on local risk assessments.. Option C is correct because a risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.

Answer

Implement the strictest regulatory requirements globally to ensure compliance everywhere.

Answer

Adopt a baseline of controls that meet the lowest common denominator of all regulations.

Answer

Allow each business unit to define its own security controls based on local requirements.

Question 17

Which TWO of the following are key responsibilities of an information security governance committee?

Accepted Answer

Approve major changes to information security policies.. The information security governance committee is a high-level body responsible for strategic oversight. Approving major changes to information security policies (Option C) is a core governance function, ensuring that policy updates align with business objectives and regulatory requirements before implementation. This is distinct from operational tasks like vulnerability assessments or daily monitoring.

Answer

Perform vulnerability assessments on critical systems.

Answer

Set the organization's risk appetite.

Answer

Conduct daily monitoring of security events.

Question 18

A multinational corporation is designing its information security governance framework. The board has requested a single metric that best indicates the effectiveness of the security program. Which metric would BEST satisfy this request?

Accepted Answer

Percentage of security controls achieving their intended outcomes as validated by testing.. Option D is correct because it provides a direct measure of how well security controls are working. Option A is an operational metric, not strategic. Option B is a compliance metric but does not measure effectiveness. Option C is a technical metric that may not resonate with the board.

Answer

Percentage of systems compliant with security baseline.

Answer

Number of security incidents reported per month.

Answer

Mean time to detect (MTTD) security events.

Question 19

During an audit, it was found that the organization's information security policy is not being followed by business units. Which of the following is the MOST effective way for the information security manager to improve compliance?

Accepted Answer

Establish a policy review committee with business unit representatives to align policy with operational needs.. The most effective way to improve compliance is to align the policy with operational realities by involving business unit representatives in a policy review committee. When policies conflict with business processes, users will bypass them; adjusting the policy to be both secure and practical increases voluntary adherence. This addresses the root cause—policy misalignment—rather than treating symptoms like lack of awareness or enforcement.

Answer

Provide additional security awareness training focused on policy requirements.

Answer

Escalate non-compliance to senior management for disciplinary action.

Answer

Increase the frequency of automated policy compliance checks.

Question 20

After a major security incident, the incident response team completes the containment, eradication, and recovery phases. The CISO is now planning the post-incident activities. Which activity is MOST critical to ensure that lessons learned are effectively incorporated?

Accepted Answer

Conducting a post-incident review and updating policies.. Conducting a post-incident review and updating policies is the most critical post-incident activity because it ensures that the root cause, response gaps, and process deficiencies are formally documented and translated into actionable improvements. This directly supports the continuous improvement cycle required by NIST SP 800-61 and ISO 27035, preventing recurrence of similar incidents.

Answer

Publishing a public disclosure of the incident.

Answer

Terminating the incident response team's engagement.

Answer

Restoring all systems to full production status.