CISM Matching — 10 Questions

Question 1

Match each data classification level to its handling requirement.

Accepted Answer

Public: No special handling required. Data classification levels determine handling requirements: Public (no special handling), Internal (limited access), Confidential (authorized access only), Restricted (highest protection). Common confusions involve swapping handling requirements between levels.

Answer

Public: Access restricted to authorized personnel only

Answer

Internal: No special handling required

Question 2

Match each security framework to its primary purpose.

Accepted Answer

COBIT: A framework for IT governance and management.. COBIT is for IT governance, ISO 27001 for ISMS, and NIST CSF for cybersecurity risk management. The distractors swap definitions between COBIT and ISO 27001.

Answer

COBIT: A standard for information security management systems.

Answer

ISO 27001: A framework for IT governance and management.

Question 3

Match each CISM domain to its focus area.

Accepted Answer

Information Security Governance: Establishing and maintaining a framework to ensure information security strategies are aligned with business objectives.. The CISM domains are: Governance (strategy alignment), Risk Management (risk identification and management), Program Development (design and implementation), and Incident Management (detection and response). Common confusions include swapping program development with governance and incident management with risk management.

Answer

Information Security Governance: Designing and implementing security solutions.

Answer

Information Risk Management: Responding to security incidents.

Question 4

Match each business continuity term to its definition.

Accepted Answer

Business Continuity Plan: A documented set of procedures and information that helps an organization respond to a disruption and resume normal operations.. Correct matches: A-BCP, B-DRP, C-BIA. Common confusions: MTD is about downtime, RPO is about data loss.

Answer

Maximum Tolerable Downtime: The maximum amount of data loss, measured in time, that an organization can accept.

Answer

Recovery Point Objective: The maximum period of time that a system can be unavailable before causing significant harm to the business.

Question 5

Match each security role to its primary responsibility.

Accepted Answer

CISO: Responsible for overall security strategy and program management.. Correct matches: CISO → overall strategy, Security Manager → daily operations, Security Architect → design, Security Auditor → evaluation. Common confusions involve swapping these responsibilities.

Answer

CISO: Evaluates security controls and ensures compliance.

Answer

Security Manager: Designs security architecture.

Question 6

Match each risk management term to its definition.

Accepted Answer

Risk: Effect of uncertainty on objectives. Key risk management terms from CISM: Risk is the effect of uncertainty on objectives; controls are measures that modify risk; vulnerabilities are weaknesses that can be exploited; threats are potential causes of incidents. The distractor pairs swap risk with threat and control with vulnerability.

Answer

Risk: A potential cause of an unwanted incident

Answer

Control: Weakness in an asset or control

Question 7

Match each security metric to its description.

Accepted Answer

MTTD: Average time taken to identify a security incident after it occurs.. Security metrics are used to measure different aspects of incident response and risk management. MTTD measures detection speed, MTTR measures response speed, MTBF measures system reliability, and ALE measures financial risk. Common confusions include swapping MTTD and MTTR definitions.

Answer

MTTD: Average time taken to contain and remediate a security incident after detection.

Answer

MTTR: Average time between system failures.

Question 8

Match each security control type to its example.

Accepted Answer

Preventive: Firewall. The correct matches are: Preventive controls prevent incidents (e.g., firewall), Detective controls identify incidents (e.g., IDS), Corrective controls fix issues (e.g., backup/restore), and Deterrent controls discourage attacks (e.g., warning signs). Options E and F are common confusions where definitions are swapped.

Answer

Preventive: Backup and restore

Answer

Detective: Firewall

Question 9

Match each incident management phase to its activity.

Accepted Answer

Detection: Identifying signs of an incident.. The correct phases are: Detection (identifying signs), Response (immediate containment), Mitigation (controls to reduce impact), and Recovery (restoration). Common confusions include swapping Detection and Response activities, or Mitigation and Recovery activities.

Answer

Detection: Taking immediate containment actions.

Answer

Mitigation: Restoring normal operations.

Question 10

Match each cryptographic term to its description.

Accepted Answer

Symmetric Encryption: Uses a single shared key for both encryption and decryption. The correct matches are: Symmetric Encryption uses a shared key, Asymmetric Encryption uses a key pair, and Hash Function produces a one-way digest. Distractors confuse the purpose of digital signatures and the nature of PKI.

Answer

Digital Signature: Ensures confidentiality of data

Answer

Public Key Infrastructure (PKI): Uses a single shared key for both encryption and decryption