CISM Timed Practice Test 2 — 10 Questions

Question 1

During a DDoS attack, the incident response team determines that the attack cannot be mitigated within the maximum tolerable downtime (MTD). What should happen next?

Accepted Answer

Activate business continuity and disaster recovery plans. When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation.

Answer

Notify the board of directors

Answer

Continue current mitigation efforts

Answer

Declare a disaster immediately

Question 2

A risk manager is evaluating a control that reduces the likelihood of a threat from high to low. The cost of the control is $100,000 annually. The expected loss without the control is $500,000 per year. Which of the following should the risk manager recommend?

Accepted Answer

Implement the control. The control reduces the annualized loss expectancy (ALE) from $500,000 to a much lower value (since likelihood drops from high to low). The annual cost of the control is $100,000, which is significantly less than the $500,000 expected loss without it. Implementing the control provides a positive return on investment (ROI) and is the most cost-effective risk mitigation strategy.

Answer

Avoid the risk by discontinuing the process

Answer

Transfer the risk through insurance

Answer

Accept the risk

Question 3

Which control family from NIST SP 800-53 is MOST directly associated with ensuring that users have appropriate access rights?

Accepted Answer

Access Control (AC). The Access Control (AC) family specifically addresses user access management.

Answer

System and Communications Protection (SC)

Answer

Identification and Authentication (IA)

Answer

Personnel Security (PS)

Question 4

A large financial institution is updating its information security program to align with a new regulatory framework. The program currently has a decentralized governance model. Which of the following is the MOST significant risk of maintaining a decentralized model?

Accepted Answer

Inconsistent security levels across business units. Decentralized governance leads to inconsistent security levels across business units, which is a major regulatory and risk concern. Option A is possible but less critical. Option C may increase but is a consequence. Option D may be slower but inconsistent security is more fundamental.

Answer

Slower incident response

Answer

Higher cost of compliance

Answer

Duplication of controls

Question 5

The security team is designing a security awareness program. Which topic should be prioritized FIRST?

Accepted Answer

Phishing recognition and reporting. Phishing is a common initial attack vector, and training users to recognize it can immediately reduce risk. Option B is wrong password policies are important but often covered later. Option C is wrong incident reporting is critical but follows awareness of threats. Option D is wrong data classification is more advanced.

Answer

Password creation and management

Answer

Incident reporting procedures

Answer

Data classification and handling

Question 6

An organization has a mature security program with documented policies and standards. However, during a recent audit, it was found that several business units are not following the mandated data classification standard. What is the MOST likely root cause?

Accepted Answer

Lack of enforcement mechanisms. A mature security program with documented policies and standards indicates that the classification rules are already defined. The audit finding that business units are not following the mandated standard points to a failure in enforcement mechanisms—such as automated Data Loss Prevention (DLP) rules, access control policies, or mandatory labeling in SharePoint—rather than a lack of awareness or outdated policy. Without enforcement (e.g., Group Policy Objects blocking unclassified data uploads or SIEM alerts for missing classification tags), even well-trained staff may bypass the standard.

Answer

Inadequate security awareness training

Answer

Outdated data classification policy

Answer

Insufficient budget for security tools

Question 7

Which of the following is the primary purpose of an information security program?

Accepted Answer

Protect the confidentiality, integrity, and availability of information assets.. The primary purpose of an information security program is to safeguard the confidentiality, integrity, and availability (CIA) of information assets. This aligns with the core definition of information security as defined in standards like ISO/IEC 27001 and NIST SP 800-53, which frame security controls around protecting these three attributes. A program must be risk-based and business-aligned, not just a collection of tools or compliance checklists.

Answer

Implement firewalls and antivirus software.

Answer

Achieve compliance with regulations only.

Answer

Eliminate all security risks.

Question 8

An organization is implementing an identity and access management (IAM) program. Which THREE of the following are key components of a mature IAM program?

Accepted Answer

Role-based access control (RBAC) aligned with job functions.. Mature IAM includes lifecycle management (provisioning/de-provisioning), role-based access control (RBAC), and periodic access reviews to ensure least privilege.

Answer

Biometric authentication for all users.

Answer

Single sign-on (SSO) for all cloud applications.

Question 9

During a merger, the acquiring company's security program must integrate with the target company's program. What is the HIGHEST priority action?

Accepted Answer

Conduct a comprehensive risk assessment of the target. A comprehensive risk assessment of the target company's environment identifies integration risks and informs the integration plan. Option A is premature without understanding risks. Option C and D are tactical steps that should follow risk assessment.

Answer

Consolidate all security tools

Answer

Merge the security teams into one reporting structure

Answer

Standardize security policies immediately

Question 10

A multinational organization handles personal data of EU residents. Which regulatory requirement must the information security program address?

Accepted Answer

GDPR. GDPR applies to any organization processing personal data of EU residents, regardless of location.

Answer

SOX

Answer

PCI DSS

Answer

HIPAA