Certified Information Security Manager CISM (CISM) — Questions 76–150

Sharing IoCs helps other organizations detect and defend against similar threats, improving collective security.

Risk reduction and alignment with business strategy ensure investments address the most critical needs and support organizational goals.

Understanding business objectives first ensures that security initiatives support the organization's goals and are prioritized accordingly.

Executive sponsorship demonstrates leadership commitment and sets the tone at the top.

Breach avoidance value quantifies the financial impact of prevented incidents, providing a direct link between security investment and risk reduction, which is compelling to the board.

For critical incidents, regular and frequent communication is required to keep executives informed.

Engaging the forensic firm through legal counsel and having them work under the direction of legal helps protect communications under attorney-client privilege. Direct engagement by the business may waive privilege.

According to NIST SP 800-61 (Computer Security Incident Handling Guide), after containment, the next phase is eradication. Eradication involves removing the root cause of the incident, such as deleting malware, disabling compromised accounts, or patching vulnerabilities, to ensure the threat is fully eliminated before recovery begins.

Mean time to detect (MTTD) is a key performance indicator that directly measures how quickly the security program identifies incidents, reflecting the effectiveness of detection controls, monitoring tools, and incident response readiness. Unlike compliance-focused metrics, MTTD provides actionable insight into the program's ability to minimize dwell time and reduce potential impact, making it the most relevant metric for senior management to assess program effectiveness.

Rebuilding servers from clean, uninfected images is the only reliable way to restore operations when backups have also been encrypted. Since the ransomware encrypted both production systems and backup data, any restoration attempt from compromised backups would reintroduce the malware. Clean images ensure a known-good state without relying on potentially corrupted or encrypted backup files.

Correct matches: CISO → overall strategy, Security Manager → daily operations, Security Architect → design, Security Auditor → evaluation. Common confusions involve swapping these responsibilities.

Phishing simulation click rates directly measure how employees respond to a common threat.

Leading indicators measure proactive security posture; access review completion rate indicates how well entitlements are managed.

Root cause analysis (RCA) digs into multiple layers to find underlying issues, often using techniques like 5 Whys or fishbone diagrams.

Rapid activation of the IR team depends on knowing who to contact and their backup.

Data residency and regulatory compliance requirements are critical in cloud adoption because data may be stored or processed in jurisdictions with different privacy laws (e.g., GDPR, CCPA, LGPD). An emerging risk assessment must evaluate whether the cloud provider's data centers are located in regions that could expose the organization to legal penalties or breach of contractual obligations. This is not a generic concern but a specific legal and technical risk tied to the physical location of cloud infrastructure.

The exhibit describes a cloud-based architecture with multiple business units and third-party integrations, but no centralized security governance board or oversight mechanism is mentioned. Without a governance body to define, approve, and enforce security policies, the organization lacks strategic direction, accountability, and risk management alignment, making this the most significant gap in the Information Security Governance domain.

The SOC core functions include monitoring security events, detecting threats, and responding to incidents. Vulnerability management and security architecture are typically separate functions, though they may interact with the SOC.

The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $10,000 and an ARO of 0.5, the ALE is $10,000 × 0.5 = $5,000. This represents the expected annual financial loss from server failures based on the frequency and impact of such events.

The steering committee's primary role is to provide strategic direction and oversight for the information security program, ensuring alignment with business objectives and risk appetite. This includes approving the overall security strategy, budget, and major initiatives, rather than engaging in operational tasks like policy drafting or technical assessments.

NIST SP 800-53 is a comprehensive catalog of controls organized into families, commonly used by US federal agencies and many private organizations.

A is correct because risk-based security policies allow each business unit to tailor controls to its specific risk appetite, ensuring that high-risk units implement stronger safeguards (e.g., stricter access controls, enhanced logging) while low-risk units avoid unnecessary overhead. This aligns with the CISM principle that security governance must accommodate varying risk tolerances through differentiated policy frameworks rather than a one-size-fits-all approach.

Phishing click rate is a leading indicator that measures user awareness and predicts future compromise risk.

A top-down governance approach ensures that a consistent baseline of security controls is mandated at the corporate level, which is critical for managing risk across a multinational enterprise. By allowing local adaptation, the framework can incorporate region-specific legal requirements (e.g., GDPR in Europe, CCPA in California) without deviating from the core security posture. This balance between uniformity and flexibility is the primary benefit, as it prevents fragmented security while respecting jurisdictional mandates.

Industry benchmarks indicate that mature security programs allocate 10-15% of IT budget to security. 12% falls within this range, suggesting a mature program.

Threat identification is a key component of an information security risk assessment because it involves systematically cataloging potential sources of harm (e.g., malware, insider threats, natural disasters) that could exploit vulnerabilities. Without identifying threats, the risk assessment cannot evaluate the likelihood or impact of adverse events, making the entire risk analysis incomplete. This step directly feeds into risk identification, which is the foundation of the risk management process as defined by frameworks like ISO 27005 and NIST SP 800-30.

When unsure, the best practice is to escalate to the security team to investigate further. Deleting the file could destroy evidence, and scanning may not be sufficient. Option B is correct.

The IDS alert indicates a malware beacon, and the firewall log shows periodic outbound connections to an external IP, which is typical of command and control traffic.

A steering committee is a key governance component because it provides executive oversight, strategic direction, and resource allocation for the information security program. It ensures that security initiatives align with business objectives and that decisions are made at the appropriate authority level, which is essential for effective governance.

Inherent risk is the risk level before any security controls are applied. When evaluating inherent risk for a new cloud-based HR system, the likelihood of threat actors targeting the system (B) is a key factor because it directly influences the probability of a risk event occurring, independent of any existing or planned controls. This assessment considers the system's exposure, attractiveness to attackers, and the threat landscape specific to cloud HR platforms.

For P1 (critical) incidents, hourly situation reports (sitreps) are expected to keep executives informed of rapidly evolving events.

GDPR requires notification within 72 hours. The SEC proposed rule requires notification within 4 business days for material cybersecurity incidents.

A configuration management database (CMDB) provides a centralized, authoritative inventory of all IT assets, including their current patch status. Linking the CMDB to an automated patch deployment tool ensures that patches are consistently and systematically applied to all systems based on their configuration records, directly addressing the inconsistency in the patch management process. This control enforces a standardized, repeatable workflow that eliminates reliance on manual, ad-hoc patching.

Isolating the database server is the most appropriate initial response because it immediately halts the suspected data exfiltration, containing the incident and preventing further loss of sensitive customer data. In incident management, the priority is to stop the active threat before performing any investigative or notification steps, as per the NIST SP 800-61 incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery). Delaying containment to review logs or run scans allows the exfiltration to continue, increasing the potential damage.

Compensating controls require formal acceptance of the residual risk and approval by management to ensure accountability.

A SOC's core functions are monitoring for threats and responding to incidents. Vulnerability management and architecture are separate functions.

Mean time to detect (MTTD) is the most indicative metric of team effectiveness during an IRP exercise because it directly measures how quickly the team identifies a security incident. A lower MTTD reflects faster detection, which is critical for minimizing dwell time and limiting attacker impact. In contrast, cost, tool count, or log volume do not measure detection speed or response quality.

The board needs high-level, strategic metrics. Percentage of systems patched within SLA provides a clear, concise view of vulnerability management status, which is critical for risk reduction.

Documenting lessons learned captures actionable insights from the incident, enabling the organization to improve future detection, response, and prevention. This aligns with the CISM Incident Management domain, where post-incident reviews focus on process improvement rather than punitive measures.

The number of risk acceptances approved vs. rejected directly reflects the board's governance of risk appetite and decision-making. It shows how management formally accepts residual risk, which is a key governance function, unlike operational metrics that measure tactical execution.

Connection to 203.0.113.5:44333 is the most suspicious because it uses a non-standard high port (44333) to an external IP address, which is a common technique for C2 traffic to evade detection by blending with HTTPS-like traffic. Legitimate web servers typically connect to well-known ports (e.g., 80, 443) or internal services, not arbitrary external high ports. The exhibit likely shows a netstat output where this outbound connection to an external IP on an unusual port stands out as anomalous.

Security investment vs. loss avoidance directly links spending to prevented losses, demonstrating ROI and program effectiveness to the board.

The policy lifecycle begins with a gap analysis to identify deficiencies between current policies and business/regulatory requirements.

Detection & Analysis is the phase where potential security incidents are identified through monitoring tools, alerts, and user reports, and then analyzed to confirm the incident, assess its scope, and prioritize response actions. This phase is explicitly defined in both NIST SP 800-61 (Computer Security Incident Handling Guide) and ISO/IEC 27035 as the second step after preparation, ensuring that incidents are accurately recognized before containment begins.

Breach avoidance value, compliance cost avoidance, and operational efficiency gains are direct, quantifiable benefits that resonate with executives.

Capturing memory from the endpoint is the most critical step because encryption keys for HTTPS sessions are often stored in plaintext within the process memory of the web browser or application (e.g., in the TLS master secret). Without these keys, the encrypted traffic captured on the wire cannot be decrypted, making memory forensics essential to recover the plaintext data exfiltrated by the attacker.

The core issue is that the security steering committee lacks decision-making authority, which prevents it from prioritizing projects and allocating resources. Empowering the committee with budget and resource allocation authority directly addresses this root cause by enabling it to make binding decisions, thereby eliminating delays caused by lack of prioritization. This aligns with the CISM governance principle that steering committees must have defined authority to effectively oversee the information security program.

A primary objective of a security awareness program is to reduce the number of security incidents by educating employees on threats like phishing, social engineering, and unsafe practices. By raising awareness, employees are less likely to fall for attacks that could lead to data breaches or malware infections, directly lowering incident frequency.

Disconnecting the workstation from the network (Option C) is the most appropriate containment strategy because it immediately stops the malware from communicating with command-and-control servers, prevents lateral movement to other systems, and preserves the volatile evidence (e.g., running processes, memory contents) needed for forensic analysis. This aligns with the NIST SP 800-61 incident response containment phase, which prioritizes isolation over destruction or data exfiltration risk.

The executive sponsor provides authority, resources, and strategic direction, and ensures the IR team has the support needed to respond effectively.

The information security governance committee is a high-level body responsible for strategic oversight. Approving major changes to information security policies (Option C) is a core governance function, ensuring that policy updates align with business objectives and regulatory requirements before implementation. This is distinct from operational tasks like vulnerability assessments or daily monitoring.

The SIEM alert indicates a successful brute-force login from source IP 10.0.0.55 to the destination server using the account 'jsmith'. Locking the user account immediately stops the attacker from further exploiting the compromised credentials, which is the most direct containment action. Blocking the IP alone would not prevent re-authentication if the attacker switches IPs, and contacting the user wastes critical time during an active incident.

KPIs (Key Performance Indicators) and KRIs (Key Risk Indicators) provide quantifiable metrics that directly tie security activities to business objectives, ensuring the strategy is both actionable (through measurable targets) and measurable (through defined thresholds). This alignment allows the multinational corporation to track progress, demonstrate value to stakeholders, and adjust controls based on risk appetite, which is essential for global operations with diverse regulatory and operational contexts.

The phishing click-through rate directly measures behavioral change—the primary goal of security awareness training. A sustained reduction indicates that employees are applying training to recognize and avoid phishing attempts, which is a more valid effectiveness metric than completion rates or lagging indicators like incidents or violations.

A framework of minimum security requirements establishes a baseline that satisfies corporate governance needs while explicitly allowing local business units to add controls to meet regional regulations (e.g., GDPR, PIPL). This approach preserves the principle of subsidiarity in governance, ensuring that local compliance obligations are met without fragmenting the overall security posture.

GDPR Article 33 requires notification within 72 hours of becoming aware of the breach.

Data classification levels determine handling requirements: Public (no special handling), Internal (limited access), Confidential (authorized access only), Restricted (highest protection). Common confusions involve swapping handling requirements between levels.

Legal counsel involvement helps protect communications under attorney-client privilege and avoids speculation that could create liability.

R001 should be addressed first because it has the highest risk level, as indicated by its placement in the top-right quadrant of the risk heat map (high likelihood and high impact). With limited resources, the organization must prioritize risks that pose the greatest potential damage and are most likely to occur, which aligns with the foundational risk management principle of treating high-priority risks first.

Containment is the immediate priority in incident response to stop the spread of damage and prevent further compromise. Implementing temporary workarounds—such as isolating affected systems, blocking malicious IPs via firewall rules, or disabling compromised accounts—directly halts the incident's impact without waiting for full eradication or recovery. Option E is also correct because deploying patches or configuration changes can serve as a containment measure by closing the vulnerability that allowed the attack, thereby preventing the attacker from re-entering or continuing the exploit.

SOX applies to financial reporting, PCI DSS to payment cards, and sector-specific regulations may apply; GDPR is EU-specific.

The first step in validating a potential command and control (C2) alert is to correlate the IDS event with other network logs (e.g., firewall, proxy) and threat intelligence. This helps confirm whether the traffic matches known C2 patterns (e.g., beaconing intervals, unusual DNS queries) before taking any disruptive action. Premature blocking or forensic analysis without correlation risks false positives or missing context.

Prioritizing critical controls first ensures the most important risks are addressed before less critical ones.

Security champions are volunteers within development teams who promote security best practices and facilitate communication between security and development.

P1 (Critical) incidents have major business impact, require executive notification, and demand a 24/7 response effort.

Requiring encryption of data in transit (e.g., TLS 1.3, IPsec) is the most appropriate control because Category C financial reports are sensitive and must be protected from interception during transmission over networks. This aligns with the principle of protecting data confidentiality and integrity at the network layer, which is a fundamental security control for any data repository handling classified information.

The organization's risk appetite mandates that residual risk must be at 'medium' or lower. With an inherent risk of 'high' and controls rated 'partially effective', the residual risk remains above the acceptable threshold. Therefore, the best course is to insist on additional controls to bring residual risk down to at least 'medium', ensuring compliance with the risk appetite.

Accepting a high residual risk means the organization has decided to tolerate a level of risk that likely exceeds the board-approved risk appetite. This is a governance failure because the board sets the risk appetite, and management must ensure that all accepted risks fall within that threshold. If the residual risk is high and the treatment is 'Accept,' it indicates a disconnect between the risk acceptance process and the governance framework.