CISM Multiple Select — 20 Questions

Question 1

An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)

Accepted Answer

Notify the relevant data protection authority within the required timeframe.. Data breach notification laws (e.g., GDPR Article 33, CCPA) require organizations to notify the relevant data protection authority within a specified timeframe (e.g., 72 hours under GDPR) once the breach is confirmed. This is a mandatory legal obligation in incident response to avoid penalties and demonstrate regulatory compliance.

Answer

Immediately issue a press release without consulting legal.

Answer

Ignore the incident if no customers have complained.

Answer

Delete all system logs to prevent further exposure.

Question 2

Which THREE of the following are typical roles in an incident response team?

Accepted Answer

Security analyst. The IR team includes security analysts, forensic investigators, and legal counsel; the CMT includes executives like CEO; HR is not a standard IR role.

Answer

Human resources manager

Answer

Chief executive officer (CEO)

Question 3

Which TWO of the following are incident categories in an incident management programme?

Accepted Answer

Insider threat. Ransomware and insider threat are defined incident categories; phishing is a technique, not a category; vulnerability is a condition; theft is too broad.

Answer

Theft

Answer

Vulnerability

Answer

Phishing

Question 4

An organization is implementing an identity and access management (IAM) program. Which THREE of the following are key components of a mature IAM program?

Accepted Answer

Role-based access control (RBAC) aligned with job functions.. Mature IAM includes lifecycle management (provisioning/de-provisioning), role-based access control (RBAC), and periodic access reviews to ensure least privilege.

Answer

Biometric authentication for all users.

Answer

Single sign-on (SSO) for all cloud applications.

Question 5

An organization is designing a policy exception management process. Which THREE elements are critical for this process to be effective?

Accepted Answer

Approval by the CISO or designated authority. Effective exception management requires formal documentation, time limits, and review by appropriate authority to prevent misuse.

Answer

Automatic approval if no response within 24 hours

Answer

Ability for any employee to request an exception

Question 6

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Accepted Answer

Business impact analysis (BIA) results.. A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Answer

Security awareness training for all employees.

Answer

Vulnerability scanning schedules.

Question 7

Which THREE of the following are challenges in implementing information security governance in a decentralized organization?

Accepted Answer

Redundant security controls and tools. In a decentralized organization, each business unit often selects its own security tools and controls, leading to redundant security controls and tools across the enterprise. This redundancy increases costs, creates management complexity, and can introduce gaps in coverage due to inconsistent integration. The lack of centralized oversight means that duplicate solutions for the same function (e.g., multiple endpoint protection platforms) are common, making unified monitoring and maintenance difficult.

Answer

Unified risk reporting

Answer

Centralized incident response

Question 8

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 9

Which THREE of the following are appropriate members of a crisis management team (CMT) for a major cybersecurity incident? (Select three.)

Accepted Answer

General Counsel (GC). The General Counsel (GC) is a critical member of the CMT because a major cybersecurity incident (e.g., a data breach involving PII) triggers legal obligations under regulations like GDPR, HIPAA, or SOX. The GC provides real-time advice on legal hold, breach notification timelines, and attorney-client privilege, ensuring the organization's response does not create additional liability or waive legal protections.

Answer

Security analyst

Answer

Forensic investigator

Question 10

Which THREE of the following are common challenges in incident response? (Select exactly 3)

Accepted Answer

Poor coordination between teams. Poor coordination between teams (Option B) is a common challenge in incident response because security incidents often require collaboration across IT, legal, PR, and management. Without clear communication channels and predefined roles, response efforts become fragmented, leading to delays in containment and recovery. This is a well-documented issue in frameworks like NIST SP 800-61, which emphasizes the need for a coordinated incident response plan.

Answer

Over-reliance on cloud services

Answer

Difficulty in identifying the root cause

Question 11

Which TWO actions are essential during the detection and analysis phase of incident response?

Accepted Answer

Determine the scope of the incident. Determining the scope of the incident (C) is essential during the detection and analysis phase because it defines the boundaries of the compromise—identifying which systems, data, and users are affected. This step is critical for prioritizing response actions and preventing the incident from spreading further. Without scope determination, subsequent containment and eradication efforts may be misdirected or incomplete.

Answer

Notify law enforcement

Answer

Disconnect affected systems

Answer

Rebuild systems

Question 12

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Accepted Answer

A steering committee that includes senior management and business unit leaders.. A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Answer

An incident response plan that defines roles and procedures.

Answer

A vulnerability scanning schedule and remediation SLAs.

Answer

A firewall policy that specifies allowed and denied traffic.

Question 13

A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)

Accepted Answer

Employee role and job function. Employee role, past click rates, and current threat landscape help tailor simulations for effectiveness and relevance.

Answer

Employee's years of service

Answer

Number of security incidents in the past year

Question 14

An information security manager is developing a security program for a multinational organization. Which of the following should be considered when defining the program scope? (Select THREE)

Accepted Answer

Business objectives and strategy. Business objectives and strategy (A) are foundational because the security program must align with and support the organization's mission, risk appetite, and strategic goals. Without this alignment, security controls may conflict with business operations or fail to prioritize critical assets, leading to wasted resources or increased risk exposure.

Answer

Current technology architecture

Question 15

Which of the following are key components of an information security program's strategic plan? (Select two.)

Accepted Answer

Security program vision and objectives. The strategic plan for an information security program defines the long-term direction and governance framework. The security program vision and objectives (B) establish the overarching goals and alignment with business strategy, while the roadmap for security initiatives (D) provides the phased implementation plan to achieve those objectives. These are foundational components of strategic planning, not operational or tactical elements.

Answer

Annual budget allocation

Answer

Incident response procedures

Question 16

Which THREE are valid sources for threat intelligence that can be used during incident response? (Choose three.)

Accepted Answer

Industry information sharing groups. Industry information sharing groups (Option B) are a valid source of threat intelligence because they provide curated, actionable data on emerging threats, indicators of compromise (IOCs), and attack patterns from peer organizations. This intelligence is directly applicable during incident response to identify known adversary tactics, techniques, and procedures (TTPs) and to correlate findings with ongoing incidents.

Answer

Social media posts from employees

Answer

Internal network traffic logs

Question 17

Which THREE of the following are common challenges when implementing a risk management program in an organization? (Choose three.)

Accepted Answer

Lack of senior management support. Lack of senior management support (A) is a common challenge because risk management programs require executive sponsorship to enforce policies, allocate budget, and drive cross-departmental compliance. Without C-level backing, risk assessments and remediation efforts often stall due to insufficient authority and resources.

Answer

Too many controls implemented too quickly

Answer

Overly detailed risk appetite

Question 18

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 19

A security manager is measuring the security culture of the organization. Which three metrics are most appropriate?

Accepted Answer

Phishing simulation click rate. These metrics directly reflect employee behavior and the effectiveness of the security culture program.

Answer

Security budget as percentage of IT budget

Answer

Number of security policies published

Question 20

An organization is updating its security governance framework. Which three elements are essential for ensuring board-level oversight?

Accepted Answer

Board-level risk committee review of security posture. These three elements ensure the board can fulfill its oversight role effectively.

Answer

Security awareness training for board members

Answer

CISO reporting directly to the CEO