Certified Information Security Manager CISM (CISM) — Questions 1–75

Employee role, past click rates, and current threat landscape help tailor simulations for effectiveness and relevance.

When residual risk exceeds the established risk tolerance, the organization must either implement additional controls to reduce the risk further or formally accept the residual risk through management approval. This aligns with the risk treatment decision-making process in ISO 31000 and the CISM framework, where risk acceptance is a management responsibility. Option C correctly identifies these two valid paths.

Having a pre-negotiated contract reduces the time to engage forensic experts, which is critical during an incident.

Without a formal security governance structure, the CISO must first understand the target company's current security posture through a comprehensive risk assessment. This step identifies vulnerabilities, threats, and gaps in controls, providing the baseline data needed to prioritize integration efforts and align with the acquirer's governance framework. Skipping this assessment risks implementing policies that are irrelevant or ineffective against the target's actual risks.

If an incident cannot be resolved within the MTD, it should transition to BC/DR activation. The decision authority (e.g., CISO or CMT) should declare a disaster.

Leading indicators predict future security performance, and phishing click rate is a proactive measure that can be improved before a breach occurs.

The CMT handles strategic decisions, communication, and resource allocation, while the IR team focuses on technical response.

Vendor tiering should be based on the risk they pose. Data access and service criticality directly affect organizational risk.

A tabletop exercise is a discussion-based exercise where team members walk through a scenario to identify strengths and gaps.

Playbooks (or runbooks) provide detailed procedures for specific incident types, while the IR plan is a broader document.

Reporting to the board or a senior executive not directly responsible for IT operations ensures independence and reduces conflicts of interest.

The scenario describes business units procuring cloud services without IT security involvement, which directly indicates the absence of a procurement security policy. Such a policy would mandate security review and approval before any cloud service acquisition, ensuring that security requirements are integrated into the procurement lifecycle. Without it, security is bypassed, leading to ungoverned shadow IT and potential compliance violations.

During an incident, the first communication to stakeholders should provide a summary of actions taken so far to establish transparency and demonstrate that the incident response team is actively managing the situation. This aligns with NIST SP 800-61r2 guidance, which prioritizes timely, high-level updates over detailed technical data to avoid overwhelming stakeholders and to maintain trust. Detailed technical analysis, timelines, and root cause determination typically require more investigation and are communicated in subsequent updates.

Security champions are advocates embedded in development teams to help integrate security into the development lifecycle, promoting secure development practices.

Level 5 (Optimizing) focuses on continuous improvement through quantitative measurement.

Activating cloud-based DDoS mitigation services is the correct first step because these services are designed to absorb and scrub volumetric attacks at the network edge, before traffic reaches the saturated internet link. This preserves legitimate traffic while filtering malicious packets, which is critical when the link itself is overwhelmed and on-premises devices cannot process the volume.

The email containing employee salaries was sent to all staff, which is a violation of the 'Confidential' handling requirement. Confidential data, such as salary information, must be restricted to authorized recipients only, and mass distribution to all staff exceeds that authorization. The exhibit likely classifies salary data as 'Confidential', not 'HighlyConfidential', making option B the correct minimum violated requirement.

Providing training helps users understand the necessity of MFA for security, addressing their concerns and gaining buy-in. Allowing exceptions (A) weakens security, delaying implementation (B) postpones protection, and revoking access (C) is too punitive as a first step.

The IR policy requires senior management approval to demonstrate organizational commitment and allocate necessary resources.

The exhibit shows a pattern of repeated SQL query-like strings in the network traffic, such as 'SELECT * FROM users WHERE id = 1 OR 1=1', which is a classic SQL injection payload. This indicates an attacker is attempting to manipulate the SQL query to bypass authentication or extract data, not a normal application load or performance issue. The sudden spike in similar requests with malicious syntax confirms an active SQL injection attempt.

The primary purpose of a pre-established forensic retainer agreement is to reduce the time to engage during an incident. By having a contract already in place, the organization can bypass procurement and legal review delays, enabling the forensics firm to begin work immediately when an incident occurs, which is critical for preserving volatile evidence and minimizing damage.

The CEO is correct because as the highest-ranking executive, they provide strategic direction, authorize critical decisions (e.g., public disclosure, resource allocation), and serve as the primary liaison to the board of directors during a major incident. The GC is correct because they manage legal risks, ensure compliance with breach notification laws (e.g., GDPR, CCPA), and oversee communications with regulators and law enforcement. The CFO is correct because they assess financial impacts, approve emergency budgets, and coordinate with insurance carriers for cyber liability claims.

Implementing an account lockout policy after 3 failed attempts directly mitigates brute-force SSH attacks by preventing further authentication attempts from the same IP address. This is a standard risk response (risk reduction) that limits the attacker's ability to guess credentials without requiring changes to the SSH protocol or disabling remote access entirely.

Comparing the cost of the tool against the average cost of a data breach (e.g., $4.35M) provides a clear financial justification.

A SOC focuses on monitoring, detection, and response. Vulnerability management and identity management are separate functions.

Leading indicators predict future performance. Phishing click rate and knowledge assessment scores measure current behavior and knowledge, which can predict future incidents.

A comprehensive risk management process is a foundational component of a mature information security program because it ensures that security controls are aligned with business objectives through systematic identification, assessment, and treatment of risks. This process, often guided by frameworks like ISO 31000 or NIST SP 800-39, enables prioritization of resources based on risk appetite and tolerance, rather than relying on ad-hoc or reactive measures. Without this, the program lacks the structured governance needed to adapt to evolving threats and regulatory requirements.

When an incident cannot be resolved within MTD, it escalates to business continuity/disaster recovery activation to restore operations.

These three elements ensure the board can fulfill its oversight role effectively.

Lessons learned meetings should occur within two weeks of incident resolution while details are fresh, to capture accurate feedback and improve the IR plan.

A user accessing large volumes of data unrelated to their job function is a classic behavioral anomaly indicating potential data exfiltration. This pattern often precedes an insider threat incident, as the user may be collecting sensitive information for unauthorized purposes, such as selling it or using it for personal gain. Security information and event management (SIEM) systems typically flag such access based on deviations from baseline user behavior, triggering further investigation.

The 5 Whys technique is a simple root cause analysis method that iteratively asks 'why' to move from symptoms to root causes.

Regularly meeting with business unit leaders to understand needs and risks is the most important activity because it ensures the security program is directly aligned with business objectives, risk appetite, and operational priorities. This engagement allows the CISO to perform a business impact analysis (BIA) and integrate security controls that support strategic goals rather than operating in isolation. Without this alignment, even technically sound security measures may be rejected or underfunded by leadership.

A P1 critical-severity ransomware attack encrypting critical systems requires immediate activation of the crisis management team because it poses an existential threat to business operations, often involving legal, PR, executive, and regulatory stakeholders. The crisis management team handles incidents that exceed the capacity of the incident response team, typically those with high business impact, widespread system compromise, or potential for significant financial/reputational damage.

The IR manager leads the team, coordinates activities, and classifies incidents based on severity.

CIS Controls v8 are organized into Implementation Groups (IG1, IG2, IG3) and provide a prioritized, threat-informed set of controls.

After drafting, legal review ensures compliance with laws and regulations.

Establishing the risk assessment context (C) is the first step because it defines the scope, objectives, and criteria for the assessment, ensuring alignment with organizational goals and risk appetite. Without this foundational step, subsequent activities like asset identification or risk calculation lack direction and may produce irrelevant or misleading results. In the CISM framework, context setting precedes all technical analysis to ensure the assessment is meaningful and actionable.

The primary purpose of an Information Security Program is to align security efforts with business objectives and manage risk to an acceptable level. This ensures that security investments and activities directly support the organization's mission, rather than operating in isolation. A program focused solely on compliance or technical controls may fail to address the dynamic risk landscape and business needs.

CIS Controls v8 defines Implementation Group 1 (IG1) as the basic set of controls for small businesses with limited resources. IG1 is designed to be the minimum standard and should be implemented first.

When litigation is anticipated, a legal hold must be issued to prevent destruction of relevant evidence, and forensic copies should be made before remediation.

Continuous improvement (B) is a hallmark of higher maturity because it indicates the security program systematically evaluates and enhances its processes based on lessons learned, shifting from static compliance to adaptive risk management. In CISM terms, this aligns with the 'Optimizing' level (Level 5) in the Capability Maturity Model (CMM), where feedback loops drive iterative refinement of controls and policies.

Cultural resistance to security controls from business units is a common challenge because security teams must balance risk mitigation with operational efficiency. Business units often perceive controls like mandatory encryption or access restrictions as hindrances to productivity, leading to shadow IT or workarounds that undermine the program's effectiveness.

Requiring the vendor to manage its sub-suppliers through contractual flow-down ensures the organization's risk requirements extend throughout the supply chain.

The exhibit shows a Key Risk Indicator (KRI) trending above the defined threshold but within the risk appetite, meaning the risk is not yet critical. The information security manager should implement the existing action plan to reduce the KRI value back to an acceptable level, as this is a proactive risk treatment measure aligned with the organization's risk management framework. This avoids unnecessary escalation or crisis declaration while addressing the risk in a controlled manner.

Business requirements derived from risk assessment and compliance obligations are the primary driver because they directly align security controls with the institution's specific risk appetite, regulatory mandates (e.g., PCI DSS, SOX, GDPR), and operational needs. This ensures controls are cost-effective and prioritized based on actual exposure rather than reactive or budget-driven decisions.

When MTD is exceeded, the incident escalates to business continuity/disaster recovery activation. The BC/DR decision authority should be notified to declare a disaster and activate recovery plans.

The core governance issue is the lack of a formal incident response plan and adequate monitoring. Establishing a SOC with 24/7 monitoring directly addresses the 90-day detection gap, while defining roles and responsibilities ensures accountability and oversight, which are key governance principles. This approach aligns with the CISM focus on establishing processes and oversight rather than just deploying technology.

Phishing simulation click rate directly measures user behavior change, a key indicator of awareness effectiveness.

This structure shows the CISO reporting to CIO (dotted line to board), with executive accountability assigned to CFO, typical of a tiered governance model.

The incident response team must first validate the maliciousness of the IP address using threat intelligence feeds before taking any irreversible action. Blocking an IP without confirmation could disrupt legitimate business operations or tip off an attacker, and the CISM framework emphasizes evidence-based decision-making during incident response.

Volatile data (e.g., memory contents, running processes, network connections) is lost when power is removed or the network interface is disabled. The CIRT leader must follow the order of volatility (RFC 3227) and capture this data first to preserve forensic evidence before containment actions that alter the system state.

The CISO is accountable for developing and maintaining the information security strategy and programme.

Encouraging reporting of near misses helps identify weaknesses and prevent future incidents.

Conducting a risk assessment is the foundational first step in developing an information security program because it identifies and prioritizes the specific threats, vulnerabilities, and business impacts that the program must address. Without a risk assessment, any subsequent policies, controls, or tools would be based on assumptions rather than the organization's actual risk profile, leading to misallocated resources and ineffective security. This aligns with the CISM framework, which emphasizes that risk management drives the entire security program lifecycle.

The bucket policy includes a Condition block with NotIpAddress for both read and write actions, denying access from IP addresses outside the 10.0.0.0/8 range. This restricts both read and write operations to users from the internal network, making Option B correct.

Security awareness training is an essential element of an information security program because it directly addresses the human factor, which is often the weakest link in security. A formal, ongoing training program ensures that employees understand policies, recognize threats like phishing, and follow secure behaviors, thereby reducing risk. Without it, technical controls alone cannot prevent social engineering or user errors, making it a foundational component of any security program.

An IR team with defined roles and a signed retainer with a forensics firm are critical preparatory elements. The IR plan is also prepared, but the question asks for components established before an incident.

The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, the ARO is 1/5 = 0.2 (one event every five years), and the SLE is $2,000,000. Thus, ALE = 0.2 × $2,000,000 = $400,000.

Vulnerability management includes scanning for vulnerabilities and remediation (patching).

The incident response team must first confirm that a breach actually occurred before taking any further action, including notification. Premature notification without confirmation can lead to false alarms, legal liability, and reputational damage. Confirmation involves verifying indicators of compromise (IoCs) through log analysis, forensic evidence, and chain-of-custody procedures.

When the CISO reports to the CIO, security objectives are subordinate to IT operational goals. The CIO's primary mandate is system availability, performance, and cost efficiency, which can lead to security controls being deprioritized or bypassed to meet IT project deadlines. This structural conflict is the primary risk because it directly undermines the independence required for effective security governance.

The scenario describes an account compromise where credentials are likely stolen and used to gain unauthorized access.

Risk identification is a core component of an information security risk management framework because it systematically catalogs assets, threats, and vulnerabilities that could affect the organization. Without identifying risks, subsequent steps like assessment and treatment cannot be performed. This aligns with the ISACA framework's emphasis on risk identification as the foundational step in the risk management lifecycle.

Vendor tiering is typically based on the sensitivity of data the vendor accesses and the criticality of the service they provide. These factors determine the risk level and required controls.

Enterprise policy sets the tone, followed by standards, then procedures, then guidelines.

Communication templates should include the incident description, affected parties, and guidance on actions to take. Technical details and attacker attribution are not typically included in templates.