Certified Information Security Manager CISM (CISM) — Questions 676–750

CIS Controls v8 defines Implementation Groups (IG1, IG2, IG3) that prioritize controls based on organizational maturity, starting with the most foundational and critical controls.

Security champions act as liaisons in development teams, promoting security practices and facilitating communication with the security team.

The IR plan should include pre-established contacts and procedures; contacting the ISP and mitigation service should follow the plan's escalation process.

Option C is correct because the first step in incident response is to validate the alert. The analyst must verify that the traffic is indeed anomalous and not legitimate (e.g., a large backup or software update) by examining logs and packet captures. Premature action without verification could disrupt business operations or destroy forensic evidence.

Preserving evidence includes creating forensic images and issuing legal holds to prevent spoliation. Disconnecting systems without imaging and rebooting can destroy evidence.

Option B is correct because the configuration indicates the standard playbook will be executed, the incident response team will be notified, and containment actions will be automatically applied. Priority override is false, so no override occurs.

Lessons learned meetings aim to identify what happened, what worked well, and what didn't, and to develop recommendations for improvement. Sharing IoCs with ISACs is a separate activity, not a meeting objective.

When a credential compromise is discovered, the immediate priority is containment to prevent further unauthorized access. Disabling compromised accounts and resetting passwords (Option B) stops the attacker from using the stolen credentials, aligning with the NIST SP 800-61 incident response lifecycle's containment phase. This action directly mitigates the active threat before any forensic analysis or notification occurs.

Option D is correct because a risk-based prioritization framework directly maps security initiatives to the organization's risk appetite, ensuring that investments target the most critical business risks. This aligns with the CISM principle that governance must link security activities to business objectives through risk management, not through arbitrary cost-cutting or blanket compliance.

The exhibit shows a successful SSH session from 10.0.0.50 immediately following a brute-force attempt from the same IP, and the session log indicates key-based authentication was used. A compromised SSH private key from the brute-force phase (likely harvested or cracked) allowed the attacker to authenticate without a password, making credential-based attack using a compromised SSH key the most likely vector.

A is correct because effective incident response requires structured communication procedures to coordinate with internal stakeholders (e.g., management, legal, PR) and external parties (e.g., law enforcement, regulators, customers). Without predefined communication channels, critical updates may be delayed or mishandled, increasing organizational risk.

The exhibit shows an access control list (ACL) that denies all traffic from any source to the 10.0.0.0/8 network. Since the ACL is applied inbound on the internet-facing interface, any traffic originating from the internet destined for the internal network 10.0.0.0/8 is implicitly denied by the explicit deny statement. Therefore, option B is correct: all traffic from the internet to the internal network is denied.

Unusual outbound network traffic is a key indicator of a data breach because it often signals data exfiltration, where an attacker is transferring stolen data to an external command-and-control (C2) server or a cloud storage endpoint. This traffic may involve unexpected protocols (e.g., DNS tunneling, HTTPS to unknown IPs) or large volumes of data leaving the network at odd hours, which can be detected by network traffic analysis tools like NetFlow or intrusion detection systems (IDS).

The CISO is responsible for developing and implementing the security program, reporting to executive leadership.

Option C is correct because after isolating affected systems, the next priority is to contain the incident by identifying and isolating any additional compromised systems to prevent further spread, and to notify law enforcement as required by legal and regulatory obligations. This aligns with the Incident Response (IR) process, specifically the Containment, Eradication, and Recovery phases, where containment must precede any recovery attempts to avoid re-infection.

The security architect designs the overall security structure, including policies, technologies, and controls. Other roles focus on operations, analysis, or governance.

Leading indicators are proactive and predictive. Phishing click rate (user behavior) and patch compliance (vulnerability management) are leading indicators.

Prioritizing critical controls first, especially those that address the most significant risks and are business-enabling, aligns with defense-in-depth and risk-based decision making.

A hybrid approach (Option B) is most effective because it leverages qualitative scales for initial, rapid risk identification and prioritization, while quantitative data (e.g., ALE, SLE, ARO) provides the monetary rigor needed for cost-benefit analysis and management decisions. This aligns with ISACA's guidance that risk assessment should be tailored to the decision context, not purely one method.

ISO 27005 is the correct methodology because it provides a risk management framework that explicitly balances quantitative and qualitative factors, aligns with regulatory requirements like GDPR and SOX, and offers a consistent, scalable approach for risk assessment across diverse business units. It integrates seamlessly with ISO 27001, ensuring compliance and standardization.

For a P1 incident, the IR plan dictates immediate containment to prevent further spread, followed by notification to the executive sponsor and activation of the crisis management team.

The primary reason for a pre-established forensic retainer agreement is to reduce the time needed to bring forensic experts on board during an incident. In incident management, every minute of delay can allow an attacker to exfiltrate data or destroy evidence; a retainer bypasses the procurement and contracting process, enabling immediate deployment of the forensic team to preserve volatile memory and capture network artifacts.

Option C is correct because an effective information security governance framework must include a process for aligning security strategy with business strategy. This ensures that security initiatives support organizational objectives, risk tolerance, and regulatory requirements, rather than operating in isolation. Without this alignment, security investments may conflict with business goals, leading to inefficiencies or reduced adoption.

The board requires strategic-level information to make risk-based decisions. Option D provides a summary of top risks, alignment with risk appetite, and treatment status, which directly supports strategic oversight. Operational details like firewall counts or patch levels are tactical and do not convey the business impact or risk posture needed for board-level decisions.

The 5 Whys should drill down from technical cause to process failure to management/governance failure, as per the domain content.

Disconnecting an infected workstation from the network is a classic containment action because it immediately isolates the compromised system, preventing the spread of malware or unauthorized lateral movement to other hosts. Containment focuses on limiting the scope and impact of an incident, not on remediation or investigation. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is performed before eradication and recovery.

Option B is correct because the first action in incident response is to validate the alert by examining the web server logs on 192.168.1.10. This confirms whether the IDS alert corresponds to actual exploitation, such as a SQL injection attempt or directory traversal, before taking containment or eradication steps. Reviewing logs provides forensic evidence and ensures the response is based on confirmed facts, not assumptions.

Moving the backup server to a geographically separate location directly eliminates the single point of failure by ensuring that a localized disaster (e.g., fire, flood, power outage) at the primary data center does not simultaneously destroy both the primary and backup data. This is a classic risk mitigation strategy that reduces the likelihood and impact of data loss, aligning with the principle of geographic redundancy for disaster recovery.

Risk assessment is a core component of an information security risk management program because it systematically identifies, analyzes, and evaluates risks to information assets. It provides the foundational understanding of threats, vulnerabilities, and impacts necessary for informed decision-making. Without a formal risk assessment, the program lacks the data needed to prioritize and justify security investments.

These metrics directly reflect employee behavior and the effectiveness of the security culture program.

Leading indicators are proactive; patch compliance reflects current security posture, and access review completion indicates governance effectiveness.

Low detection time but high response time indicates that while alerts are generated quickly, the response process is slow due to inefficiencies in triage or remediation.

Conducting due diligence before contracting is essential to identify risks and ensure the vendor meets security requirements. Vulnerability scans are part of due diligence but not the most critical step. NDA and liability clauses are important but secondary to initial assessment.

Updating the plan based on lessons learned and scheduling a follow-up test improves preparedness.

The correct answer is A because DNS tunneling exfiltrates data by encoding it within DNS queries and responses, which are often allowed through firewalls without deep inspection. The attacker remained undetected for three months because the security team lacked monitoring of DNS traffic for anomalies, such as unusual query volumes, non-standard record types (e.g., TXT records), or domains with high entropy. Without DNS-specific anomaly detection or a security information and event management (SIEM) system correlating DNS logs, the exfiltration blended into normal traffic.

After containment and eradication, the priority is to preserve evidence for root cause analysis and potential legal action. Creating a forensic image of the file server and affected endpoints captures the ransomware artifacts, encryption keys, and system state before any recovery actions that could overwrite critical data. This aligns with the CISM incident management phase of 'lessons learned' and ensures the team can determine the attack vector and prevent recurrence.

Option C is correct because it ensures that the information security governance committee includes senior leaders from each business unit, the CISO, and the Chief Risk Officer. This composition directly aligns security initiatives with business strategy by integrating business objectives, risk appetite, and security expertise at the strategic decision-making level, which is essential for effective governance as defined by ISACA's CISM framework.

The SOC's primary objectives include monitoring, detection, and response to security incidents. Risk assessment is typically a GRC function, and policy creation is a governance function.

Time to patch critical vulnerabilities directly reflects the organization's ability to reduce exposure to known exploits, which is a key outcome of an effective security program. Unlike input metrics (budget, tools) or lagging indicators (incident count), this metric measures the speed of a critical risk-reduction process, aligning with CISM's focus on program governance and risk management.

During a P1 incident, the CMT must provide timely, concise updates to the board to maintain trust and enable strategic decisions. Option A is correct because it balances frequency (hourly) with content discipline (avoiding speculation) and includes legal counsel review, which is critical for compliance and liability management. This aligns with the CISM Incident Management domain's emphasis on clear, non-technical communication to senior leadership.

A risk assessment is performed to understand the risks before defining contract requirements and ongoing monitoring.

Option A is correct because qualitative risk assessment uses ordinal rating scales (e.g., 1-5 or Low-Medium-High) to estimate likelihood and impact based on expert judgment, not precise numerical values. This approach is standard in frameworks like ISO 27005 and NIST SP 800-30, which define qualitative analysis as relying on subjective categorization rather than hard financial data.

Progressive difficulty and remediation training for clickers helps users learn while minimizing negative impact on productivity.

The correct answer is A because the scenario states the security program has been in place for two years, yet incidents persist due to lack of user awareness. This indicates the awareness program exists but is not being regularly updated or evaluated for effectiveness, which is a common root cause in mature programs where content becomes stale and fails to address evolving threats like phishing or social engineering.

Option B is correct because risk acceptance is justified when the cost of mitigation exceeds the potential financial loss from a breach. This aligns with the cost-benefit analysis principle in risk management: if the cost to implement controls (e.g., migrating to a more secure vendor or adding encryption) is higher than the expected loss (e.g., $50,000 in breach costs vs. $100,000 in mitigation), accepting the residual risk is economically rational. The decision must still ensure the risk is within the organization's risk appetite.

A BIA first identifies critical functions, then determines acceptable downtime, assesses impact, prioritizes recovery, and finally documents findings.

Playbooks are tailored to incident types; credential compromise has its own specific playbook.

When an IDS alerts on potential C2 communication, the organization must first verify the alert and determine the scope of the incident. The Detection and Analysis phase is the initial step in the incident response lifecycle, as defined by NIST SP 800-61, because it involves confirming the alert, analyzing indicators of compromise (IoCs), and assessing the severity before any containment actions are taken. Without proper detection and analysis, containment efforts could be misdirected or ineffective.

When an incident cannot be resolved within MTD, the organization should escalate to business continuity and disaster recovery activation.

Managing nth-party risk requires understanding the cloud provider's supply chain. Contractual requirements for the provider to manage their subcontractors and regular audits help mitigate downstream risks.

Option B is correct because ISO 31000 defines risk transfer (sharing) as a valid risk treatment option, where the risk is shifted to another party, such as through insurance or outsourcing. This is a standard approach in information security risk management to reduce the financial impact of a risk event.

Critical controls that address the most significant risks should be implemented first.

Option B is correct because the immediate priority in ransomware containment is to prevent lateral movement and further encryption of systems. Disconnecting the server from the network (e.g., unplugging the Ethernet cable or disabling the virtual switch port) stops the ransomware from communicating with its command-and-control (C2) server and encrypting additional network shares. This aligns with the NIST SP 800-61 incident response containment strategy, which emphasizes isolation before any other action.

Root cause analysis should uncover not just technical causes but also the process and governance failures that allowed the misconfiguration. Addressing the management failure (e.g., inadequate change management) provides a systemic fix.

Mean Time to Respond (MTTR) directly measures the speed and effectiveness of incident response.

The board of directors is essential because it holds ultimate accountability for the organization's risk posture and must approve the information security strategy, policies, and resource allocation. Without board-level oversight, security governance lacks the authority to enforce compliance and align security objectives with business goals. This aligns with the CISM framework's emphasis on top-down governance, where the board provides strategic direction and ensures adequate funding for security initiatives.

Creating a forensic image with a write blocker (Option A) is a best practice because it captures an exact bit-for-bit copy of the storage media without altering the original data. The write blocker intercepts write commands at the hardware or software level, ensuring the integrity of the evidence. This preserves the original state for later analysis and admissibility in legal proceedings.

An IR programme must include a formal policy and a documented plan. Playbooks are also important but the core components are policy and plan.

Database activity monitoring (DAM) can detect unauthorized access or exfiltration attempts, providing visibility and alerting without impacting performance. Encryption at rest is preferred, but DAM is a compensating control when encryption is not feasible.

When an incident cannot be resolved within the MTD, it triggers the transition to business continuity and disaster recovery (BC/DR) plans to maintain critical operations.

Best practices recommend holding the lessons learned meeting within two weeks of incident resolution to capture details while they are fresh.

Nth-party risk requires understanding the provider's subcontractors; requiring disclosure and assessment of their vendors is key.

A is correct because establishing a risk management framework is the foundational component of an Information Security Risk Management program. It defines the policies, procedures, and governance structure for identifying, assessing, and treating risks, aligning with standards like ISO 31000 or NIST SP 800-39. Without a framework, risk management activities lack consistency and accountability.

Option C is correct because the CISO must align security controls with business reality. Rather than enforcing an unworkable policy that executives are already circumventing, the CISO should update the policy to incorporate a mobile device management (MDM) solution that enforces device encryption, remote wipe, and conditional access via Azure AD or similar identity provider. This approach reduces risk by bringing personal devices under formal governance while maintaining executive productivity.

The exhibit shows a high volume of incidents but no evidence of structured documentation, such as incident records, post-incident reports, or standardized logging. Without proper documentation, the organization cannot perform root cause analysis, track incident trends, or demonstrate compliance, making this the most significant gap because it undermines the entire incident management lifecycle.

A high near-miss reporting rate indicates that employees are vigilant and willing to report potential issues without fear of blame.

Integrating information security risk into ERM ensures that security risks are considered alongside business risks, enabling better prioritization and resource allocation. This alignment helps the organization make informed decisions that balance risk appetite and business objectives. The primary driver is to support strategic decision-making, not just compliance or reporting.