CISM Timed Practice Test 3 — 10 Questions

Question 1

An organization is implementing a security controls framework and must decide on prioritization. According to defense-in-depth principles, which approach should be taken first?

Accepted Answer

Prioritize critical controls that address the most significant risks. Defense-in-depth starts with critical controls that protect against the most likely threats, often following frameworks like CIS Critical Controls, which prioritize foundational controls.

Answer

Select all controls from NIST SP 800-53 without prioritization

Answer

Deploy business-enabling controls that support operations

Answer

Implement compensating controls to address gaps in existing controls

Question 2

What is the PRIMARY purpose of a security champions program?

Accepted Answer

To embed security advocates in non-security teams to promote security best practices. The primary purpose of a security champions program is to embed security advocates within non-security teams (e.g., development, operations) to promote security best practices (A). Champions are team members with an interest in security who receive additional training and act as liaisons between the security team and their functional teams, scaling security awareness and enabling earlier risk identification without adding headcount.

Answer

To enforce security policies through peer pressure

Answer

To conduct security audits of other teams

Answer

To replace the security team in development projects

Question 3

What is the recommended timeframe for holding a lessons learned meeting after an incident has been resolved?

Accepted Answer

Within 2 weeks. A lessons learned meeting is most effective when held within 2 weeks of incident resolution, while details are still fresh in participants' memories but after immediate recovery pressures have subsided. This window allows time to gather facts, review logs, and prepare meaningful discussion points without losing critical context. CISM best practice emphasizes timely but not rushed post-incident reviews to capture actionable improvements.

Answer

Within 1 month

Answer

Within 3 months

Answer

Within 24 hours

Question 4

During an incident investigation, the team discovers that a compromised account was used to exfiltrate data. Which of the following should the team do NEXT?

Accepted Answer

Determine the scope of the breach by analyzing accessed resources.. The immediate priority after discovering a compromised account is to determine the scope of the breach by analyzing which resources the account accessed. This involves reviewing authentication logs, file access records, and data transfer logs to identify the extent of data exfiltration and potential lateral movement. Without this analysis, the team cannot contain the incident effectively or understand what data was compromised, which is a fundamental step in incident response per NIST SP 800-61.

Answer

Reset the password and re-enable the account immediately.

Answer

Notify the affected users and customers.

Answer

Delete the compromised account from the system.

Question 5

After containing a security incident, the team conducts a root cause analysis. They find the breach originated from a compromised third-party vendor account. What is the most effective long-term mitigation?

Accepted Answer

Implement vendor access reviews and enforce MFA. Implementing vendor access reviews and enforcing MFA addresses the root cause of unauthorized access.

Answer

Increase logging on vendor accounts

Answer

Change all passwords manually

Answer

Terminate the vendor relationship

Question 6

An organization's governance framework requires regular reporting to the board. Which reporting frequency and format is MOST effective for a board with limited security expertise?

Accepted Answer

Quarterly report summarizing key risk indicators and business impact. A quarterly report summarizing key risk indicators (KRIs) and business impact is most effective for a board with limited security expertise because it aligns with the board's strategic oversight role, focusing on risk exposure and business outcomes rather than technical details. This frequency balances timeliness with the board's typical meeting cadence, ensuring actionable insights without overwhelming non-technical members.

Answer

Monthly dashboard of technical control effectiveness metrics

Answer

Annual presentation of the overall security risk register

Answer

Weekly technical briefings on incidents and vulnerabilities

Question 7

An information security manager is asked to justify an increase in the security budget. Which approach BEST demonstrates the value of the security program?

Accepted Answer

Calculating the ROI by estimating breach avoidance and compliance cost savings. Presenting the return on investment (ROI) by quantifying avoided breach costs and compliance savings provides a business case for budget increases.

Answer

Comparing the proposed budget to industry benchmarks

Answer

Highlighting the number of security tools currently in use

Answer

Listing all security certifications held by the team

Question 8

After a security incident, the incident response team prepares a report detailing the root cause, impact, and lessons learned. Who is the PRIMARY audience for this report?

Accepted Answer

Senior management and the board of directors. The primary audience for a post-incident report detailing root cause, impact, and lessons learned is senior management and the board of directors. They require this information to make strategic decisions about risk acceptance, resource allocation for remediation, and to fulfill fiduciary duties regarding cybersecurity governance. The report provides the business context and financial impact necessary for executive-level oversight, not the technical details needed by operational teams.

Answer

The affected users

Answer

The IT support team

Answer

External auditors

Question 9

A small business is developing its first information security program. Which approach is most effective?

Accepted Answer

Conduct a risk assessment to identify key assets and threats.. Conducting a risk assessment (Option C) is the foundational step in building an information security program because it identifies the specific assets, threats, vulnerabilities, and impacts unique to the small business. Without this context, any controls or frameworks applied would be misaligned with the actual risk profile, leading to wasted resources and potential security gaps. The CISM framework emphasizes that risk assessment drives the selection of cost-effective, prioritized controls tailored to the organization's needs.

Answer

Hire an external security consultant to design the entire program.

Answer

Adopt a comprehensive framework like ISO 27001 immediately.

Answer

Purchase and deploy a next-generation firewall.

Question 10

Which of the following is the PRIMARY goal of incident containment?

Accepted Answer

To prevent further damage and limit the scope of the incident.. The primary goal of incident containment is to stop the incident from spreading and to limit the scope of damage. This is the immediate priority because, without containment, the attacker may continue to compromise additional systems, exfiltrate data, or escalate privileges. Options A, B, and C are important subsequent steps but are secondary to the urgent need to halt the incident's progression.

Answer

To gather evidence for prosecution.

Answer

To recover systems to normal operation.

Answer

To identify the root cause.