CISM Multiple Select — 40 Questions

Question 1

After a data breach involving customer PII, the incident response team is conducting a root cause analysis. Which THREE factors should be examined according to CISM best practices? (Select THREE.)

Accepted Answer

The management or governance failure that allowed the process failure.. According to CISM best practices, root cause analysis after a data breach should focus on systemic and organizational factors rather than individuals or financial impacts. Option A is correct because governance failures—such as inadequate security policies, missing oversight, or lack of executive accountability—are root causes that enable process and control breakdowns. Option D is correct because identifying the specific technical vulnerability (e.g., an unpatched CVE, misconfigured firewall rule, or weak authentication mechanism) explains how the breach was technically possible. Option E is correct because the process failure (e.g., absent patch management, ineffective change control, or missing vulnerability scanning) is the underlying reason the vulnerability was allowed to persist. Option B is not a root cause factor; cost is a business impact metric used for post-incident evaluation, not causal analysis. Option C is incorrect because blaming a specific employee who clicked a phishing email addresses a symptom, not the systemic root cause, and CISM emphasizes examining control failures rather than individual blame.

Answer

The cost of the breach to the organization.

Answer

The specific employee who clicked the phishing email.

Question 2

An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)

Accepted Answer

Notify the relevant data protection authority within the required timeframe.. Data breach notification laws (e.g., GDPR Article 33, CCPA) require organizations to notify the relevant data protection authority within a specified timeframe (e.g., 72 hours under GDPR) once the breach is confirmed. This is a mandatory legal obligation in incident response to avoid penalties and demonstrate regulatory compliance.

Answer

Immediately issue a press release without consulting legal.

Answer

Ignore the incident if no customers have complained.

Answer

Delete all system logs to prevent further exposure.

Question 3

Which THREE are components of the Plan phase in a security program lifecycle (e.g., ISO 27001 PDCA)?

Accepted Answer

Risk assessment. Risk assessment is a core component of the Plan phase in the ISO 27001 PDCA (Plan-Do-Check-Act) security program lifecycle. During this phase, the organization identifies, analyzes, and evaluates information security risks to establish the context, scope, and risk treatment criteria that will guide the selection of controls and objectives. Without a formal risk assessment, the subsequent phases lack a risk-based foundation, making the program reactive rather than proactive.

Answer

Monitoring and review

Answer

Implementation of controls

Question 4

An organization is updating its incident response plan. Which TWO components should be included to ensure effective evidence handling? (Select TWO.)

Accepted Answer

Evidence handling procedures. Evidence handling procedures (B) are essential because they define the step-by-step methods for identifying, collecting, preserving, and documenting digital evidence so it remains admissible and unaltered, covering actions like write-blocking drives and hashing files. Chain of custody forms (E) are equally required because they create the documented, unbroken record of who handled each piece of evidence, when, and for what purpose, which is critical for proving integrity in legal or disciplinary proceedings. Together, B and E directly address the core of evidence handling in an incident response plan. The other options, while useful in a broader IR plan, do not specifically ensure evidence handling: A (incident notification template) supports communication, C (law enforcement contacts) supports escalation, and D (list of acceptable forensic tools) supports tooling choices but does not itself govern evidence integrity or custody.

Answer

A template for incident notifications

Answer

Contact information for law enforcement

Answer

A list of acceptable forensic tools

Question 5

Which TWO of the following are appropriate criteria for escalating an incident to the crisis management team (CMT)? (Select TWO.)

Accepted Answer

The incident could cause severe reputational damage. Option A is correct because an incident with the potential to cause severe reputational damage meets the threshold for CMT escalation, since crisis management is invoked when business reputation and stakeholder trust are at stake, not merely for technical containment. Option D is correct because potential for major financial loss or regulatory penalties is a classic CMT escalation trigger, as such consequences require executive-level decision-making, legal counsel, and communications coordination beyond the incident response team's scope. Options B, C, and E are not appropriate standalone criteria: novel malware, third-party origin, and multi-vendor coordination are operational or technical factors that the incident response team can typically handle through normal procedures, and they do not by themselves imply the enterprise-wide business impact that defines a crisis warranting CMT involvement.

Answer

The incident involves a new type of malware not seen before

Answer

The incident originated from a third-party supplier

Answer

The incident requires coordination with multiple external vendors

Question 6

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Accepted Answer

A steering committee that includes senior management and business unit leaders.. A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Answer

An incident response plan that defines roles and procedures.

Answer

A vulnerability scanning schedule and remediation SLAs.

Answer

A firewall policy that specifies allowed and denied traffic.

Question 7

Which THREE of the following are components of a security operations center (SOC)?

Accepted Answer

Response. A SOC is built around the core functions of detection, response, and continuous security monitoring, so options B, C, and E are correct. Detection (E) covers identifying malicious activity through tools such as SIEM correlation rules, IDS/IPS alerts, and endpoint telemetry, which is a primary SOC responsibility. Response (B) covers incident handling activities like triage, containment, eradication, and recovery, which SOC analysts perform once an incident is detected. Security monitoring (C) is the ongoing 24x7 collection and analysis of logs and alerts from firewalls, endpoints, and network devices that feeds detection and response. Vulnerability scanning (A) is typically a vulnerability management function, and security awareness training (D) is a human-risk/GRC program, so neither is a core SOC component.

Answer

Vulnerability scanning

Answer

Security awareness training

Question 8

A security manager is measuring the security culture of the organization. Which three metrics are most appropriate?

Accepted Answer

Phishing simulation click rate. Phishing simulation click rate (A) is a direct behavioral metric that reveals how susceptible employees are to real-world social-engineering attacks, making it a strong indicator of security awareness culture. Training completion rate (B) measures how consistently the workforce engages with required security education, which reflects the organization's commitment to building security knowledge. Percentage of incidents due to human error (E) quantifies how often employee mistakes contribute to breaches, directly exposing cultural weaknesses in day-to-day security behavior. Security budget as percentage of IT budget (C) is a financial resource metric, not a measure of employee attitudes or behavior, so it does not reflect security culture. Number of security policies published (D) is a documentation output metric and says nothing about whether employees understand or follow those policies.

Answer

Security budget as percentage of IT budget

Answer

Number of security policies published

Question 9

Which TWO of the following are indicators of a potential security incident?

Accepted Answer

Multiple unexpected system reboots.. Option B is correct because multiple unexpected system reboots can indicate malicious activity such as a rootkit, bootkit, or attacker-triggered crash/restart to cover tracks or disrupt availability, and repeated reboots are a classic anomaly in incident detection. Option E is correct because unusual outbound network traffic from a server often signals command-and-control (C2) communication, data exfiltration, or malware beaconing, making it a strong indicator of compromise. Option A is not correct because low disk space is typically a capacity/performance issue, not a security incident indicator. Option C is not correct because a vendor releasing a new software version is a normal patch/update event, not an incident. Option D is not correct because a successful login by an authorized user is expected behavior and only becomes suspicious with additional context such as impossible travel or unusual time.

Answer

Low disk space on a file server.

Answer

A new version of a critical software released.

Answer

A successful login by an authorized user.

Question 10

Which THREE of the following are key components of an incident response plan? (Select THREE)

Accepted Answer

Communication and escalation matrix. Option C, the communication and escalation matrix, is a core component because it defines who must be notified, in what order, and through which channels (e.g., phone, email, secure messaging) during an incident, ensuring timely escalation to management, legal, and other stakeholders. Option D, incident response procedures, is essential because it provides the documented, repeatable steps for detecting, containing, eradicating, recovering from, and reviewing incidents, typically aligned with frameworks such as NIST SP 800-61. Option E, roles and responsibilities of team members, is required to establish clear ownership and accountability across the incident response team, such as incident commander, communications lead, and forensic analysts, preventing gaps or duplicated effort during an incident. Option A does not belong because a full list of all employees' contact information is not a key component of an incident response plan; only relevant escalation contacts and on-call personnel are needed. Option B does not belong because an annual budget for incident response tools is a financial or management consideration, not a structural component of the incident response plan itself.

Answer

List of all employees' contact information

Answer

Annual budget for incident response tools

Question 11

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 12

An information security manager is building a risk register for a newly formed risk management program. Which TWO of the following elements are essential components of each documented risk entry? (Choose two.)

Accepted Answer

The likelihood and impact ratings used to determine the risk level.. A risk register entry must identify who owns the risk and how severe it is. The named owner provides accountability for treatment and reporting, while likelihood and impact ratings establish the risk level that drives prioritization. Supporting details such as product versions, access lists, and network diagrams live in other repositories and should be referenced rather than embedded in the register.

Answer

The complete network diagram of the data center hosting the asset.

Answer

The specific antivirus product version deployed on affected endpoints.

Answer

The names of every employee who has access to the affected system.

Question 13

Which TWO of the following are key components of a security operations center (SOC)? (Select TWO)

Accepted Answer

Incident response. Incident response (C) is a core SOC component because the SOC's mission includes detecting, containing, eradicating, and recovering from security incidents, typically following a defined IR lifecycle and using tools like SIEM alerts, ticketing, and forensic analysis. Security monitoring and detection (D) is also fundamental, as the SOC continuously collects and correlates telemetry (for example, logs and network flows via a SIEM) to identify suspicious activity and generate alerts that drive response. Vulnerability scanning (A) is a vulnerability management activity often performed by a separate team, even if its output may inform SOC prioritization. Identity and access management (B) is an access-control discipline typically owned by IAM/identity teams, not a defining SOC component. Application security testing (E) belongs to secure development/AppSec functions such as SAST, DAST, and SCA, rather than the SOC's monitoring-and-response core.

Answer

Vulnerability scanning

Answer

Identity and access management

Answer

Application security testing

Question 14

An incident response team is analyzing a phishing email that successfully compromised a user's credentials. Which TWO indicators of compromise (IOCs) should the team prioritize collecting? (Choose two.)

Accepted Answer

The IP address of the sending server.. Option B is correct because the IP address of the sending server is a network-based IOC that can be used to block or monitor the source of the phishing email and correlate it with other attacks. Option C is correct because the malicious URL or attachment hash provides a host- or file-based IOC that can be used to detect the payload, block it at email/web gateways, and search for other victims. Option A is not a prioritized IOC for this scenario because browser history is user activity data that may be noisy and is not directly tied to the phishing infrastructure. Option D is not an IOC because a personal phone number is not a technical artifact of the compromise. Option E is not an IOC because the company's public website is a legitimate asset, not an indicator of malicious activity.

Answer

The user's browser history.

Answer

The user's personal phone number.

Answer

The company's public website.

Question 15

A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)

Accepted Answer

Employee role and job function. Option B (Employee role and job function) is correct because employees in finance, HR, or executive roles face different phishing lures and risk levels, so simulations should be tailored to the specific threats and responsibilities of each role. Option C (Past phishing click rate trends) is correct because historical click-rate data reveals which users or departments are most susceptible, allowing frequency and difficulty to be adjusted upward or downward based on demonstrated performance. Option E (Current threat landscape and prevalent attack types) is correct because simulations must reflect real-world tactics such as credential harvesting, QR-code phishing, or business email compromise that are actively trending, ensuring training stays relevant. Option A (Employee's years of service) is not a reliable indicator of phishing susceptibility, since tenure does not correlate consistently with security awareness or behavior. Option D (Number of security incidents in the past year) is too broad and lagging an indicator; it does not directly inform the design of phishing simulation frequency or difficulty the way role, click trends, and threat landscape do.

Answer

Employee's years of service

Answer

Number of security incidents in the past year

Question 16

An organization is implementing a vendor tiering program for third-party risk management. Which TWO criteria should be used to classify vendors into high, medium, or low risk tiers? (Select TWO)

Accepted Answer

Type and sensitivity of data accessed. Option B is correct because the type and sensitivity of data a vendor accesses directly determines the potential impact of a breach — vendors handling regulated data such as PII, PHI, or PCI cardholder data warrant higher risk tiers than those with no data access. Option D is correct because the criticality of the service provided reflects how much business disruption would occur if the vendor failed, making it a core input to tiering under frameworks like NIST and ISO 31000. Options A, C, and E are not primary tiering criteria: contract length does not indicate inherent risk, annual revenue reflects vendor size rather than the risk it poses to the organization, and geographic location is at most a secondary or contextual factor rather than a defining classification criterion.

Answer

Length of contract

Answer

Vendor's annual revenue

Answer

Vendor's geographic location

Question 17

Which TWO of the following are essential components of an incident response (IR) plan? (Select TWO)

Accepted Answer

Communication templates. Communication templates (C) are an essential IR plan component because during an incident responders must notify stakeholders, legal, regulators, and customers quickly and consistently, and pre-approved templates prevent delays and wording errors under pressure. The IR team roster and contact list (E) is also essential because the plan must identify who is on the incident response team and how to reach them (including after-hours and escalation contacts) so the team can be assembled immediately. Detailed network architecture diagrams (B) and vendor risk assessment reports (A) are valuable supporting artifacts for preparation and investigation, but they are not core components of the IR plan itself. A ransomware playbook (D) is a useful specialized procedure, yet it is only one scenario-specific playbook rather than a foundational element required in every IR plan.

Answer

Vendor risk assessment reports

Answer

Detailed network architecture diagrams

Answer

Playbook for ransomware incidents

Question 18

An incident response team is creating playbooks for different incident types. Which TWO incident types should have a dedicated playbook? (Select TWO.)

Accepted Answer

Ransomware. A dedicated playbook is warranted for ransomware (A) because it requires a specific, time-critical sequence of containment, isolation of encrypted hosts, identification of the ransomware strain, and recovery from known-good backups to avoid paying the ransom. A dedicated playbook is also warranted for a data breach (C) because it triggers distinct legal, regulatory, and forensic obligations such as breach notification timelines, evidence preservation, and coordination with counsel and regulators. Password expiration (B) is a routine, scheduled identity-management task handled by normal operational procedures, not an incident response playbook. Software update failure (D) is a change/problem management issue resolved through rollback or patch remediation rather than incident response. Phishing simulation (E) is a proactive security-awareness exercise, not an actual incident, so it does not require an incident response playbook.

Answer

Password expiration

Answer

Software update failure

Answer

Phishing simulation

Question 19

Which TWO are common challenges in incident management?

Accepted Answer

Inadequate communication between teams. Option A (Inadequate communication between teams) is correct because incident management depends on rapid, accurate information flow across responders, service owners, and stakeholders; breakdowns in communication cause delayed escalations, duplicated effort, and prolonged mean time to resolution (MTTR). Option B (Lack of executive support) is correct because without executive sponsorship, incident management programs often lack the authority, funding, staffing, and cross-departmental cooperation needed to enforce processes, prioritize remediation, and drive continual improvement. Options C, D, and E are not common incident management challenges: having too many technical staff is not typically a recognized problem, over-reliance on automation is a general operational risk rather than a core incident management challenge, and excessive documentation is not a standard pain point since most organizations struggle with insufficient rather than excessive documentation.

Answer

Too many technical staff

Answer

Over-reliance on automation

Answer

Excessive documentation

Question 20

Which of the following are key components of a mature information security program? (Select 2)

Accepted Answer

Comprehensive risk management process. A comprehensive risk management process is a foundational component of a mature information security program because it ensures that security controls are aligned with business objectives through systematic identification, assessment, and treatment of risks. This process, often guided by frameworks like ISO 31000 or NIST SP 800-39, enables prioritization of resources based on risk appetite and tolerance, rather than relying on ad-hoc or reactive measures. Without this, the program lacks the structured governance needed to adapt to evolving threats and regulatory requirements.

Answer

Adoption of cloud security tools

Answer

Single point of failure for security decisions