CISM Timed Practice Test 5 — 10 Questions

Question 1

Refer to the exhibit. An analyst observes the network traffic between three internal hosts and a web server. Which of the following is the MOST likely interpretation of this traffic?

Accepted Answer

Multiple users are accessing the web server normally.. The exhibit shows multiple internal hosts (10.0.0.1, 10.0.0.2, 10.0.0.3) each establishing a normal TCP three-way handshake with the web server (192.168.1.100) on port 80, with varying source ports and no abnormal flags or packet rates. This pattern indicates legitimate concurrent user access, as each host completes the handshake and exchanges data without flooding or scanning behavior.

Answer

A SYN flood attack is in progress.

Answer

A single host is using multiple IP addresses to scan the server.

Answer

A distributed denial-of-service (DDoS) attack is occurring.

Question 2

Based on the exhibit, which of the following is the MOST likely attack vector?

Accepted Answer

Privilege escalation via a compromised account. The exhibit shows a user account with administrative privileges being used from an unusual geographic location at an anomalous time, followed by lateral movement to a domain controller. This pattern indicates that the initial access was gained through a compromised account, which was then leveraged for privilege escalation to move laterally and access sensitive systems. The attack vector is the misuse of valid credentials, not an injection or social engineering attack.

Answer

SQL injection attack

Answer

Phishing email with malicious attachment

Answer

Denial of service attack

Question 3

Refer to the exhibit. A security analyst reviews the ACL on the organization's border router. Based on the exhibit, which of the following is the MOST significant governance concern?

Accepted Answer

The ACL does not include filtering for outbound traffic, which may allow spoofed internal IPs to exit the network.. Option B is correct because the ACL shown only filters inbound traffic on the border router's external interface. Without an outbound ACL (or an inbound ACL on the internal interface), spoofed packets with internal source IP addresses can exit the network, enabling IP spoofing attacks that bypass anti-spoofing best practices (RFC 2827, BCP 38). This is a governance concern as it violates the principle of preventing source address spoofing, which is a fundamental security control for network perimeter defense.

Answer

The ACL is applied to the outbound interface, which is ineffective for blocking inbound attacks.

Answer

The ACL permits any traffic after denying specific IP ranges, creating a security gap.

Answer

The ACL permits all traffic from private IP addresses, which could allow internal IP spoofing.

Question 4

Refer to the exhibit. A system administrator reviews the log and notices repeated failed SSH attempts from the same IP address. What is the most appropriate risk response?

Accepted Answer

Implement account lockout after 3 failed attempts.. Option D is correct because implementing an account lockout policy after 3 failed attempts directly mitigates brute-force SSH attacks by preventing further authentication attempts from the same IP address. This is a standard risk response (risk reduction) that limits the attacker's ability to guess credentials without requiring changes to the SSH protocol or disabling remote access entirely.

Answer

Change the password policy to require 12-character passwords.

Answer

Increase logging verbosity to capture more details.

Answer

Disable SSH access and use console only.

Question 5

During a risk assessment, an organization identifies a critical vulnerability in a legacy system that cannot be patched. The system's availability is crucial for business operations. Which of the following risk treatment strategies is MOST appropriate?

Accepted Answer

Risk acceptance with formal sign-off by senior management. When a critical vulnerability cannot be patched and the system must remain available for business operations, risk acceptance is the most appropriate strategy because it formally acknowledges the residual risk after all feasible controls have been considered. Senior management sign-off is required because the risk exceeds the organization's risk appetite, and acceptance documents the decision to operate with the known vulnerability. This approach aligns with the CISM principle that risk acceptance is a valid treatment when the cost of other treatments exceeds the benefit or when no other treatment is feasible.

Answer

Risk mitigation by implementing compensating controls

Answer

Risk transfer through cyber insurance

Answer

Risk avoidance by decommissioning the system

Question 6

A multinational corporation is designing its information security program and must decide how to balance security with business agility. The company operates in highly regulated industries with varying legal requirements. Which of the following approaches BEST aligns with industry best practices for such an environment?

Accepted Answer

Develop a risk-based framework that allows for tailored controls based on local risk assessments.. Option C is correct because a risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.

Answer

Implement the strictest regulatory requirements globally to ensure compliance everywhere.

Answer

Adopt a baseline of controls that meet the lowest common denominator of all regulations.

Answer

Allow each business unit to define its own security controls based on local requirements.

Question 7

During a merger, two companies with different information security programs are being integrated. The combined entity must maintain compliance with PCI DSS and GDPR. The CISO is concerned about gaps in coverage due to differing maturity levels. Which of the following is the BEST approach to harmonize the programs?

Accepted Answer

Perform a gap analysis against the requirements and prioritize remediation.. Option D is correct because a gap analysis identifies where controls are missing or insufficient, allowing for a prioritized remediation plan. Option A is wrong because adopting the higher standard may be unnecessary and costly. Option B is wrong because merging without analysis could introduce risks. Option C is wrong because a new framework from scratch may not leverage existing investments.

Answer

Adopt the more stringent security program from the acquirer across the entire entity.

Answer

Merge the two programs by combining all controls from each.

Answer

Implement a completely new framework that meets both regulations.

Question 8

Which TWO of the following are key responsibilities of an information security governance committee?

Accepted Answer

Approve major changes to information security policies.. The information security governance committee is a high-level body responsible for strategic oversight. Approving major changes to information security policies (Option C) is a core governance function, ensuring that policy updates align with business objectives and regulatory requirements before implementation. This is distinct from operational tasks like vulnerability assessments or daily monitoring.

Answer

Perform vulnerability assessments on critical systems.

Answer

Set the organization's risk appetite.

Answer

Conduct daily monitoring of security events.

Question 9

A multinational corporation is designing its information security governance framework. The board has requested a single metric that best indicates the effectiveness of the security program. Which metric would BEST satisfy this request?

Accepted Answer

Percentage of security controls achieving their intended outcomes as validated by testing.. Option D is correct because it provides a direct measure of how well security controls are working. Option A is an operational metric, not strategic. Option B is a compliance metric but does not measure effectiveness. Option C is a technical metric that may not resonate with the board.

Answer

Percentage of systems compliant with security baseline.

Answer

Number of security incidents reported per month.

Answer

Mean time to detect (MTTD) security events.

Question 10

An information security manager is developing a security strategy for a financial institution. Which of the following should be the PRIMARY driver for selecting security controls?

Accepted Answer

Business requirements derived from risk assessment and compliance obligations.. Business requirements derived from risk assessment and compliance obligations are the primary driver because they directly align security controls with the institution's specific risk appetite, regulatory mandates (e.g., PCI DSS, SOX, GDPR), and operational needs. This ensures controls are cost-effective and prioritized based on actual exposure rather than reactive or budget-driven decisions.

Answer

The latest cybersecurity threats reported in the industry.

Answer

Past security incidents that caused significant financial loss.

Answer

The security budget allocated for the fiscal year.

CISM Timed Practice Test 5 — 10 Questions

Exhibit

CISM Timed Practice Test 5 — 10 Questions

Exhibit