CISM Practice Questions

Question 1

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

Accepted Answer

Accept the risk because the control is not cost-justified.. The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.

Answer

Accept the risk because ALE after control is only $2,500.

Answer

Implement the control because it reduces ALE to $2,500.

Answer

Implement the control because ALE is $10,000, and control cost is only $12,000.

Question 2

A financial institution uses CIS Controls v8 and must prioritize implementation. The organization has limited resources and high exposure to ransomware. Which implementation group should be addressed FIRST?

Accepted Answer

Implementation Group 1 (IG1). CIS Controls v8 Implementation Group 1 (IG1) represents the foundational cyber hygiene controls that every organization — especially those with limited resources and high ransomware exposure — should implement first. IG1 controls are designed to be achievable with minimal expertise and cover the most impactful safeguards like inventory, patching, and access control. Prioritizing IG1 ensures the organization closes the most exploitable gaps before moving to IG2 and IG3.

Answer

All groups simultaneously

Answer

Implementation Group 3 (IG3)

Answer

Implementation Group 2 (IG2)

Question 3

A technology startup has grown rapidly and its risk management practices are informal. The CEO has a very high risk appetite and frequently overrides risk management recommendations to accelerate product launches. After a serious data breach involving customer payment information, the board of directors demands a formal risk management program. The risk manager is tasked with changing the risk culture. The startup has limited resources but must meet contractual obligations to protect customer data. What is the most effective first step?

Accepted Answer

Develop and communicate a revised risk appetite statement approved by the board. Developing and communicating a revised risk appetite statement approved by the board directly addresses the need to formalize risk management and change the risk culture. It provides clear guidance for decision-making, aligns with the board's demands, and respects the startup's limited resources by focusing on policy first. Other options are premature: deploying technical controls without policy support may be ineffective, outsourcing does not change internal culture, and terminating the CEO is an HR action that does not establish a risk program.

Answer

Outsource all information security operations to a managed service provider

Answer

Immediately deploy a suite of technical security controls

Answer

Recommend the termination of the CEO for previous risk decisions

Question 4

An organization has a mature security program with documented policies and standards. However, during a recent audit, it was found that several business units are not following the mandated data classification standard. What is the MOST likely root cause?

Accepted Answer

Lack of enforcement mechanisms. A mature security program with documented policies and standards indicates that the classification rules are already defined. The audit finding that business units are not following the mandated standard points to a failure in enforcement mechanisms—such as automated Data Loss Prevention (DLP) rules, access control policies, or mandatory labeling in SharePoint—rather than a lack of awareness or outdated policy. Without enforcement (e.g., Group Policy Objects blocking unclassified data uploads or SIEM alerts for missing classification tags), even well-trained staff may bypass the standard.

Answer

Inadequate security awareness training

Answer

Outdated data classification policy

Answer

Insufficient budget for security tools

Question 5

A financial services firm has a mature information security program but is struggling to demonstrate the value of security investments to the board. Which metric would BEST communicate the effectiveness of the security program in business terms?

Accepted Answer

Reduction in average cost per security incident over the past year.. The reduction in average cost per security incident directly translates security program outcomes into financial terms that resonate with the board. This metric demonstrates the program's effectiveness by quantifying the monetary value of improved prevention, detection, and response capabilities, aligning with the CISM focus on governance and business alignment.

Answer

Number of security alerts triaged per day.

Answer

Time to patch critical vulnerabilities.

Answer

Percentage of systems with endpoint protection installed.

Question 6

A CISO is developing a multi-year security roadmap. Which of the following should be the PRIMARY driver for prioritizing initiatives?

Accepted Answer

Alignment with business strategy and risk appetite. The primary driver for prioritizing security initiatives in a multi-year roadmap should be alignment with business strategy and risk appetite. This ensures that security investments support business objectives and address the most significant risks to the organization. Other factors like ease of implementation or cost are secondary considerations that should be evaluated within the context of strategic alignment.

Answer

Ease of implementation

Answer

Availability of new technology

Answer

Cost of the initiative

Question 7

A large financial institution is maturing its information security program and wants to move from a reactive to a proactive posture. Which of the following initiatives would best support this transition?

Accepted Answer

Establish a threat intelligence unit that analyzes adversary tactics and shares indicators across the organization.. Establishing a threat intelligence unit directly supports a proactive posture by enabling the organization to anticipate and prepare for emerging threats based on adversary tactics, techniques, and procedures (TTPs). Unlike reactive measures, this initiative shifts focus from responding to incidents to preventing them by sharing actionable indicators across the enterprise, aligning with the CISM goal of maturing the security program toward proactive risk management.

Answer

Deploy an automated compliance monitoring tool.

Answer

Implement a bug bounty program to uncover vulnerabilities.

Answer

Increase the number of security operations center (SOC) analysts.

Question 8

After a data breach involving customer PII, the incident response team is conducting a root cause analysis. Which THREE factors should be examined according to CISM best practices? (Select THREE.)

Accepted Answer

The management or governance failure that allowed the process failure.. According to CISM best practices, root cause analysis after a data breach should focus on systemic and organizational factors rather than individuals or financial impacts. Option A is correct because governance failures—such as inadequate security policies, missing oversight, or lack of executive accountability—are root causes that enable process and control breakdowns. Option D is correct because identifying the specific technical vulnerability (e.g., an unpatched CVE, misconfigured firewall rule, or weak authentication mechanism) explains how the breach was technically possible. Option E is correct because the process failure (e.g., absent patch management, ineffective change control, or missing vulnerability scanning) is the underlying reason the vulnerability was allowed to persist. Option B is not a root cause factor; cost is a business impact metric used for post-incident evaluation, not causal analysis. Option C is incorrect because blaming a specific employee who clicked a phishing email addresses a symptom, not the systemic root cause, and CISM emphasizes examining control failures rather than individual blame.

Answer

The cost of the breach to the organization.

Answer

The specific employee who clicked the phishing email.

Question 9

An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)

Accepted Answer

Notify the relevant data protection authority within the required timeframe.. Data breach notification laws (e.g., GDPR Article 33, CCPA) require organizations to notify the relevant data protection authority within a specified timeframe (e.g., 72 hours under GDPR) once the breach is confirmed. This is a mandatory legal obligation in incident response to avoid penalties and demonstrate regulatory compliance.

Answer

Immediately issue a press release without consulting legal.

Answer

Ignore the incident if no customers have complained.

Answer

Delete all system logs to prevent further exposure.

Question 10

A multinational organization handles personal data of EU residents. Which regulatory requirement must the information security program address?

Accepted Answer

GDPR. GDPR applies to any organization processing personal data of EU residents, regardless of location.

Answer

SOX

Answer

PCI DSS

Answer

HIPAA

Question 11

Which of the following is the BEST approach for sharing threat intelligence indicators of compromise (IoCs) after an incident?

Accepted Answer

Share IoCs with industry peers via the relevant ISAC.. Sharing IoCs with an ISAC (Information Sharing and Analysis Center) helps the broader community defend against similar attacks, which is a key post-incident activity.

Answer

Report IoCs to law enforcement only.

Answer

Keep IoCs confidential to protect the organization's reputation.

Answer

Publish IoCs on the organization's public website.

Question 12

An organization has implemented a data classification policy but notices that employees often mark documents as 'internal use only' even when they contain personally identifiable information (PII). Which of the following is the most effective corrective action for the information security program?

Accepted Answer

Deploy a data loss prevention (DLP) system that automatically classifies documents based on content inspection.. Deploying a data loss prevention (DLP) system that automatically classifies documents based on content inspection directly addresses the root cause of misclassification by removing reliance on user judgment. Option A (policy revision) alone does not enforce compliance. Option B (audits and reprimands) is punitive and may not change behavior. Option C (training) can help but is less effective than automation for consistent classification.

Answer

Revise the data classification policy to simplify categories.

Answer

Conduct random audits and reprimand employees who misclassify data.

Answer

Increase the frequency of data classification training for all employees.

Question 13

A company is implementing a new security program. The CISO wants to ensure alignment with business objectives. Which approach is best?

Accepted Answer

Use the COBIT framework. The COBIT framework (Control Objectives for Information and Related Technologies) is specifically designed to bridge the gap between IT governance and business goals, providing a comprehensive set of controls and processes that align security program objectives with enterprise strategy. Unlike other options, COBIT directly addresses governance, risk management, and performance measurement in a way that ensures the security program supports business objectives rather than operating in isolation.

Answer

Implement technical controls

Answer

Develop policies based on industry standards

Answer

Perform a risk assessment

Question 14

Order the steps for establishing a security incident response team (IRT).

Accepted Answer

Define roles and responsibilities, then Recruit team members, then Develop incident response procedures, then Acquire necessary tools and resources, then Test and validate the IRT plan. Building an IRT starts with defining roles, then recruiting, developing procedures, acquiring tools, and testing.

Answer

Recruit team members, then Define roles and responsibilities, then Develop incident response procedures, then Acquire tools, then Test

Answer

Define roles, then Acquire tools, then Recruit, then Develop procedures, then Test

Answer

Develop procedures, then Define roles, then Recruit, then Acquire tools, then Test

Question 15

Arrange the steps for implementing a new firewall rule in an enterprise environment.

Accepted Answer

Identify requirement, Submit change request, Test in staging, Implement on production, Verify rule operation. Firewall changes require clear objectives, change control, testing, implementation, and verification.

Answer

Test in staging, Implement on production, Identify requirement, Submit change request, Verify rule operation

Answer

Submit change request, Identify requirement, Test in staging, Implement on production, Verify rule operation

Answer

Identify requirement, Test in staging, Implement on production, Submit change request, Verify rule operation

Certified Information Security Manager CISM practice test

Three ways to study

Study CISM by domain

Study CISM by topic

Information Security Governance practice questions

Incident Management practice questions

Information Security Programme practice questions

Information Security Program practice questions

Information Security Risk Management practice questions

CISM fundamentals practice questions

CISM scenario practice questions

CISM troubleshooting practice questions

Top CISM questions

Certified Information Security Manager CISM practice questions