CISM Multiple Select — 10 Questions

Question 1

An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)

Accepted Answer

Notify the relevant data protection authority within the required timeframe.. Data breach notification laws (e.g., GDPR Article 33, CCPA) require organizations to notify the relevant data protection authority within a specified timeframe (e.g., 72 hours under GDPR) once the breach is confirmed. This is a mandatory legal obligation in incident response to avoid penalties and demonstrate regulatory compliance.

Answer

Immediately issue a press release without consulting legal.

Answer

Ignore the incident if no customers have complained.

Answer

Delete all system logs to prevent further exposure.

Question 2

Which THREE of the following are typical roles in an incident response team?

Accepted Answer

Security analyst. The IR team includes security analysts, forensic investigators, and legal counsel; the CMT includes executives like CEO; HR is not a standard IR role.

Answer

Human resources manager

Answer

Chief executive officer (CEO)

Question 3

Which TWO of the following are incident categories in an incident management programme?

Accepted Answer

Insider threat. Ransomware and insider threat are defined incident categories; phishing is a technique, not a category; vulnerability is a condition; theft is too broad.

Answer

Theft

Answer

Vulnerability

Answer

Phishing

Question 4

An organization is implementing an identity and access management (IAM) program. Which THREE of the following are key components of a mature IAM program?

Accepted Answer

Role-based access control (RBAC) aligned with job functions.. Mature IAM includes lifecycle management (provisioning/de-provisioning), role-based access control (RBAC), and periodic access reviews to ensure least privilege.

Answer

Biometric authentication for all users.

Answer

Single sign-on (SSO) for all cloud applications.

Question 5

An organization is designing a policy exception management process. Which THREE elements are critical for this process to be effective?

Accepted Answer

Approval by the CISO or designated authority. Effective exception management requires formal documentation, time limits, and review by appropriate authority to prevent misuse.

Answer

Automatic approval if no response within 24 hours

Answer

Ability for any employee to request an exception

Question 6

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Accepted Answer

Business impact analysis (BIA) results.. A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Answer

Security awareness training for all employees.

Answer

Vulnerability scanning schedules.

Question 7

Which THREE of the following are challenges in implementing information security governance in a decentralized organization?

Accepted Answer

Redundant security controls and tools. In a decentralized organization, each business unit often selects its own security tools and controls, leading to redundant security controls and tools across the enterprise. This redundancy increases costs, creates management complexity, and can introduce gaps in coverage due to inconsistent integration. The lack of centralized oversight means that duplicate solutions for the same function (e.g., multiple endpoint protection platforms) are common, making unified monitoring and maintenance difficult.

Answer

Unified risk reporting

Answer

Centralized incident response

Question 8

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 9

Which THREE of the following are appropriate members of a crisis management team (CMT) for a major cybersecurity incident? (Select three.)

Accepted Answer

General Counsel (GC). The General Counsel (GC) is a critical member of the CMT because a major cybersecurity incident (e.g., a data breach involving PII) triggers legal obligations under regulations like GDPR, HIPAA, or SOX. The GC provides real-time advice on legal hold, breach notification timelines, and attorney-client privilege, ensuring the organization's response does not create additional liability or waive legal protections.

Answer

Security analyst

Answer

Forensic investigator

Question 10

Which THREE of the following are common challenges in incident response? (Select exactly 3)

Accepted Answer

Poor coordination between teams. Poor coordination between teams (Option B) is a common challenge in incident response because security incidents often require collaboration across IT, legal, PR, and management. Without clear communication channels and predefined roles, response efforts become fragmented, leading to delays in containment and recovery. This is a well-documented issue in frameworks like NIST SP 800-61, which emphasizes the need for a coordinated incident response plan.

Answer

Over-reliance on cloud services

Answer

Difficulty in identifying the root cause