Courseiva

Certified Information Security Manager CISM (CISM) — Questions 151–225

871 questions total · 12pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 12

Page 4
151
MCQhard

An information security manager needs to justify a budget increase. Which approach would be MOST effective for gaining executive approval?

A.List all planned technology purchases
B.Describe the latest cyber threats
C.Present ROI analysis showing breach avoidance savings
D.Show industry benchmarks for security spending
AnswerC

Directly ties spending to risk reduction and financial impact.

Why this answer

Executives respond to financial justification. ROI based on breach avoidance demonstrates value in monetary terms.

Full explanation →
152
MCQhard

Match each information security program component with its correct description.

Policy.High-level statement of management intent
Standard.Mandatory requirement to support policy
Guideline.Recommended practice or advisory action
Procedure.Detailed step-by-step instructions

Why this answer

Each information security program component is correctly matched with its description: Policy is a high-level statement of management intent, Standard is a mandatory requirement to support policy, Guideline is a recommended practice or advisory action, and Procedure provides detailed step-by-step instructions. All options are correct matches.

Exam trap

Candidates often confuse standard with guideline; standards are mandatory, guidelines are advisory.

Full explanation →
153
MCQmedium

An auditor reviews the BYOD policy and notes that mobile device management (MDM) logs show several devices without encryption. The policy has been in effect for 6 months. Which of the following is the most likely reason for this non-compliance?

A.The grace period allows non-compliance for 7 days
B.Employees are unaware of the encryption requirement
C.The policy does not explicitly require encryption
D.MDM is not configured to enforce encryption automatically
AnswerD

Without automated enforcement, compliance is voluntary.

Why this answer

MDM systems can enforce encryption policies automatically by requiring devices to comply before granting access to corporate resources. If the MDM is not configured to enforce encryption, devices will remain non-compliant even if the policy requires encryption. The logs showing several devices without encryption after six months strongly indicate that the MDM is not actively enforcing the encryption requirement, making D the most likely reason.

Exam trap

The trap here is that candidates may assume the policy itself is flawed (option C) or that user awareness is the root cause (option B), but the question specifically highlights MDM logs showing non-compliance, pointing to a technical enforcement gap rather than a policy or awareness issue.

How to eliminate wrong answers

Option A is wrong because a 7-day grace period would not explain persistent non-compliance after six months; the grace period would have expired long ago. Option B is wrong because while employee awareness is important, MDM enforcement is a technical control that can override user behavior; the core issue is the lack of automatic enforcement, not just awareness. Option C is wrong because the scenario states the BYOD policy has been in effect for six months and the auditor notes non-compliance with encryption; if the policy did not explicitly require encryption, there would be no basis for the auditor to flag non-compliance, so the policy must include the requirement.

Full explanation →
154
MCQeasy

A company has a small security team and limited budget. Which initial investment provides the MOST value for building an effective security program?

A.Implement an automated policy enforcement system
B.Deploy an asset inventory management tool
C.Conduct security awareness training for all employees
D.Perform a comprehensive penetration test
AnswerC

Awareness training is cost-effective and reduces phishing and other user-related risks.

Why this answer

Security awareness training is the most cost-effective initial investment because human error remains the leading cause of security incidents, especially in resource-constrained environments. By educating employees on phishing, social engineering, and safe data handling, the organization reduces the attack surface without requiring expensive tools or specialized staff. This foundational control directly addresses the most common threat vector—user behavior—which automated systems alone cannot fully mitigate.

Exam trap

The trap here is that candidates often overvalue technical controls like penetration tests or automated enforcement, assuming they provide immediate risk reduction, while underestimating the foundational role of human-centric controls in a budget-constrained environment.

How to eliminate wrong answers

Option A is wrong because an automated policy enforcement system typically requires a mature asset inventory and defined policies to function correctly; without those prerequisites, the tool may enforce incorrect rules or miss unmanaged devices, wasting limited budget on a solution that cannot be properly configured. Option B is wrong because deploying an asset inventory management tool, while important, does not directly reduce risk; it provides visibility but requires additional processes and tools to act on that data, and a small team may lack the capacity to remediate findings promptly. Option D is wrong because a comprehensive penetration test is a point-in-time assessment that identifies vulnerabilities but does not build ongoing security capabilities; without a foundation of security awareness and basic controls, the findings may overwhelm the small team and lead to no sustainable improvement.

Full explanation →
155
MCQmedium

An information security manager is designing a program for a healthcare organization. Which of the following should be the FIRST step in establishing the program?

A.Develop information security policies and procedures
B.Conduct a risk assessment
C.Select and implement security controls
D.Define security metrics and reporting
AnswerB

Why this answer

Conducting a risk assessment is the foundational first step because it identifies and prioritizes the specific threats and vulnerabilities facing the healthcare organization's sensitive data (e.g., PHI under HIPAA). Without this baseline understanding, any subsequent policies, controls, or metrics would be misaligned with actual risk exposure, leading to ineffective or wasteful security investments.

Exam trap

ISACA often tests the misconception that policy development is the logical starting point, but CISM emphasizes that risk assessment must precede all other program elements to ensure alignment with business objectives and regulatory requirements.

Why the other options are wrong

A

Policies should be based on risk assessment results, not developed first.

C

Controls are selected after risks are identified.

D

Metrics are defined after program objectives and controls are established.

Full explanation →
156
Multi-Selectmedium

A multinational corporation is designing an information security program to align with diverse business units and regulatory requirements across different regions. The CISO is prioritizing key components that ensure the program is both comprehensive and adaptable. Which TWO components are most critical for achieving this alignment?

Select 2 answers
A.Focusing exclusively on the most stringent regulatory requirement to satisfy all others
B.Establishing a governance structure with defined roles, responsibilities, and oversight
C.Creating a control framework that maps common controls to multiple regulatory requirements
D.Adopting a single security framework such as ISO 27001 for all regions
E.Implementing separate security programs for each business unit to address unique needs
AnswersB, C

A governance structure provides the foundation for consistent decision-making and accountability across the organization.

Why this answer

A governance structure with defined roles, responsibilities, and oversight (Option B) is critical because it provides the authority, accountability, and decision-making framework needed to align security activities with diverse business units and regulatory requirements. Without clear governance, the program lacks the mechanisms to enforce policies, manage exceptions, and adapt to regional legal variations, such as GDPR in Europe or CCPA in California.

Exam trap

The trap here is that candidates often confuse 'comprehensive' with 'uniform,' leading them to choose Option D (single framework) or Option A (most stringent rule), when in reality, adaptability requires a governance structure that can manage multiple frameworks and exceptions, not a one-size-fits-all approach.

Full explanation →
157
MCQeasy

An organization is developing its information security strategy. Which of the following should be the PRIMARY driver for defining security objectives?

A.Industry best practices
B.Historical security incidents
C.Business objectives
D.Regulatory compliance requirements
AnswerC

Security strategy must align with and enable business goals.

Why this answer

Business objectives are the primary driver for defining security objectives because information security exists to enable the organization to achieve its mission and strategic goals. Security objectives must align with and support business objectives to ensure that resources are allocated effectively and that security controls are prioritized based on risk to the business, not just compliance or generic practices.

Exam trap

The trap here is that candidates often select 'regulatory compliance requirements' as the primary driver because they confuse legal necessity with strategic priority, but CISM emphasizes that security governance must be business-driven, not compliance-driven.

How to eliminate wrong answers

Option A is wrong because industry best practices (e.g., NIST CSF, ISO 27001) provide useful guidance but are not the primary driver; they are tools to help achieve security objectives that must first be derived from business needs. Option B is wrong because historical security incidents inform risk assessment and lessons learned, but they are reactive and do not define proactive strategic objectives aligned with business goals. Option D is wrong because regulatory compliance requirements (e.g., GDPR, PCI DSS) set minimum legal standards but are not the primary driver; compliance alone can lead to a checkbox mentality that fails to address business-specific risks and priorities.

Full explanation →
158
MCQhard

An organization is implementing a quantitative risk analysis for a critical application. The asset value is $2,000,000. The exposure factor (EF) is 0.25, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

A.$250,000
B.$1,000,000
C.$125,000
D.$500,000
AnswerA

ALE = $2,000,000 × 0.25 × 0.5 = $250,000.

Why this answer

The annualized loss expectancy (ALE) is calculated as ALE = AV × EF × ARO, where AV is the asset value ($2,000,000), EF is the exposure factor (0.25), and ARO is the annualized rate of occurrence (0.5). Multiplying these gives $2,000,000 × 0.25 × 0.5 = $250,000, which represents the expected annual financial loss from this risk.

Exam trap

The trap here is that candidates often forget to multiply by the ARO after computing SLE, or they confuse ARO with a percentage and incorrectly apply it as a divisor instead of a multiplier.

How to eliminate wrong answers

Option B ($1,000,000) is wrong because it incorrectly multiplies AV by EF only ($2,000,000 × 0.25 = $500,000) and then doubles it, or misapplies ARO as 1.0 instead of 0.5. Option C ($125,000) is wrong because it multiplies AV by ARO only ($2,000,000 × 0.5 = $1,000,000) and then divides by 8, or incorrectly halves the EF to 0.125. Option D ($500,000) is wrong because it calculates AV × EF ($2,000,000 × 0.25 = $500,000) but omits the ARO multiplier entirely, treating ARO as 1.0.

Full explanation →
159
MCQhard

A large enterprise experiences a data breach involving personal identifiable information (PII) of customers. The incident response team has contained the breach and is now in the eradication phase. The CISO wants to ensure that the same vulnerability cannot be exploited again. Which action is MOST critical?

A.Change all passwords of affected accounts.
B.Notify affected customers about the breach.
C.Deploy additional endpoint protection software.
D.Patch the specific vulnerability identified.
AnswerD

Patching the vulnerability directly prevents re-exploitation.

Why this answer

Patching the specific vulnerability is the most critical action during the eradication phase because it permanently removes the root cause of the breach. Without this step, the same attack vector (e.g., an unpatched SQL injection flaw or a known CVE in a web server) remains exploitable, rendering containment efforts temporary. The CISO's goal to prevent recurrence directly requires eliminating the technical weakness, not just mitigating its symptoms.

Exam trap

ISACA often tests the distinction between containment actions (like password resets) and eradication actions (like patching), tricking candidates into choosing a visible, immediate step over the root-cause fix.

How to eliminate wrong answers

Option A is wrong because changing passwords of affected accounts is a containment and recovery action that addresses credential compromise, not the underlying vulnerability (e.g., a code injection flaw) that allowed the breach. Option B is wrong because notifying customers is a legal and public relations obligation that occurs after eradication, but it does not fix the technical root cause. Option C is wrong because deploying additional endpoint protection software is a preventive control that may detect future attacks but does not remove the existing vulnerability; the attacker could still exploit the same unpatched flaw.

Full explanation →
160
MCQmedium

Which of the following incident types is MOST likely to require activation of the crisis management team (CMT) due to potential regulatory and reputational impact?

A.A P1 data breach involving customer personally identifiable information (PII).
B.A P2 denial-of-service attack that is quickly mitigated.
C.A P4 phishing email reported by a user.
D.A P3 insider threat involving an employee accessing unauthorized files.
AnswerA

High impact data breaches demand strategic decisions and external communication.

Why this answer

A P1 data breach involving customer PII triggers mandatory breach notification laws (e.g., GDPR Article 33, HIPAA Breach Notification Rule) and often requires immediate CMT activation to manage regulatory filings, legal liability, and public relations. The CMT is designed for high-severity incidents with significant business, legal, or reputational consequences, which a P1 breach directly entails.

Exam trap

The trap here is that candidates may confuse technical severity (e.g., a DDoS causing downtime) with business/regulatory impact, failing to recognize that only incidents with legal or reputational fallout (like a PII breach) necessitate CMT activation, not merely high technical severity.

How to eliminate wrong answers

Option B is wrong because a P2 denial-of-service attack that is quickly mitigated typically does not involve data loss or regulatory notification requirements, so it would be handled by the technical incident response team without CMT escalation. Option C is wrong because a P4 phishing email reported by a user is a low-severity, routine event that is usually handled via standard security awareness processes and does not warrant CMT involvement. Option D is wrong because a P3 insider threat involving unauthorized file access, while serious, is typically contained and investigated by the incident response team and HR, and only escalates to the CMT if it leads to a confirmed data breach or regulatory exposure.

Full explanation →
161
MCQhard

A multinational corporation is establishing a risk appetite framework. The board has defined risk appetite as 'no more than one major security incident per year resulting in financial loss exceeding $1M'. Which of the following best represents the risk tolerance for a specific business unit's annual cybersecurity budget allocation?

A.The business unit should maintain annual losses from security incidents between $500,000 and $1,000,000.
B.The business unit may experience up to $1M in losses per year from security incidents.
C.The business unit can accept up to $1.5M loss from a single incident per year.
D.The business unit should not exceed a single incident causing $500,000 loss per year.
AnswerA

Tolerance bands define the acceptable range around appetite, typically a buffer below the appetite limit.

Why this answer

Risk appetite is the broad level of risk the organization is willing to accept, while risk tolerance is the acceptable variation around that appetite. In this case, the tolerance is a range of financial loss from the appetite level up to the capacity (maximum bearable loss). A range of $500,000 to $1,000,000 defines the boundaries within which the business unit can operate without breaching appetite.

Full explanation →
162
MCQmedium

In the context of defense-in-depth, which control provides protection at the network layer to prevent unauthorized access?

A.Encryption of data at rest
B.Antivirus software
C.Firewalls
D.Security awareness training
AnswerC

Firewalls enforce network access control.

Why this answer

Firewalls are a network security control that filter traffic based on rules.

Full explanation →
163
MCQmedium

A company is developing security metrics to present to the C-suite. Which metric is a leading indicator of security performance?

A.Percentage of user access reviews completed on time
B.Mean time to detect (MTTD) security incidents
C.Total cost of security incidents
D.Number of data breaches in the past quarter
AnswerA

This is a leading indicator because timely access reviews prevent unauthorized access.

Why this answer

Leading indicators predict future security outcomes. Access review completion rates indicate how well access controls are managed, which reduces risk of unauthorized access.

Full explanation →
164
MCQhard

An organization's information security program includes a formal exception process. When reviewing an exception request to bypass a critical control, what is the MOST important factor for the information security manager to consider?

A.The cost of implementing the control
B.The residual risk after compensating controls
C.The number of users affected by the exception
D.The duration of the exception
AnswerB

Why this answer

The most important factor when reviewing an exception request to bypass a critical control is the residual risk after compensating controls. This ensures that the organization's risk appetite is not exceeded and that the compensating controls adequately mitigate the risk to an acceptable level, as required by frameworks like ISO 27001 and NIST SP 800-53.

Exam trap

The trap here is that candidates often focus on operational or business factors (cost, user count, duration) instead of the core risk management principle that the residual risk must be acceptable to the organization.

Why the other options are wrong

A

Cost is a factor but not the most important; risk acceptance is paramount.

C

Number of users is less important than the risk exposure.

D

Duration matters but is secondary to the risk level.

Full explanation →
165
Multi-Selecthard

An information security manager is evaluating the maturity of the organization's security program. Which of the following indicators suggest a high level of maturity? (Select TWO.)

Select 2 answers
A.All security incidents are resolved within 24 hours
B.Security metrics are included in regular executive reports
C.The program uses the latest encryption standards
D.A formal risk acceptance process is in place and used
E.The security team conducts annual penetration tests
AnswersB, D

Why this answer

Including security metrics in regular executive reports demonstrates that security performance is being measured, tracked, and communicated to leadership as part of ongoing governance. This aligns with a mature security program where security is integrated into business decision-making, not treated as a siloed technical function.

Exam trap

The trap here is that candidates confuse operational effectiveness (e.g., fast incident resolution or use of modern encryption) with process maturity, which is about governance, measurement, and continuous improvement rather than technical speed or tooling.

Why the other options are wrong

A

Resolution time is not necessarily an indicator of maturity; process consistency is more important.

C

Using latest technology is a tactical choice, not a maturity indicator.

E

Annual testing is a good practice but not a strong indicator of overall program maturity.

Full explanation →
166
MCQeasy

Which of the following is the primary reason for conducting a lessons learned meeting after an incident?

A.To document the incident for insurance
B.To update the IR plan and playbooks
C.To satisfy regulatory requirements
D.To assign blame
AnswerB

Lessons learned lead to improvements in plans and procedures.

Why this answer

The lessons learned meeting aims to identify improvements to the incident response process.

Full explanation →
167
MCQeasy

An organization has a decentralized governance model where each business unit manages its own security. What is a key challenge of this model?

A.Lower cost due to elimination of central security team
B.Rapid decision-making due to fewer layers
C.Increased central control and uniformity
D.Inconsistent security policies and controls across units
AnswerD

Without central oversight, policies can vary widely.

Why this answer

Decentralized models often lead to inconsistent security practices and lack of standardization across the organization.

Full explanation →
168
MCQhard

Based on the exhibit, which role is missing from the governance policy that would be essential for enforcing accountability?

A.External auditor
B.Internal audit function
C.A role with authority to enforce compliance and impose consequences
D.Chief compliance officer
AnswerC

Policy lacks enforcement mechanisms; accountability requires consequences.

Why this answer

The governance policy lacks a role with explicit authority to enforce compliance and impose consequences, which is essential for accountability. Without such enforcement, policies become aspirational rather than binding, as no mechanism exists to address non-compliance or ensure corrective actions. This aligns with the CISM principle that governance requires clear accountability structures, including disciplinary measures for violations.

Exam trap

The trap here is that candidates confuse oversight roles (auditor, compliance officer) with enforcement authority, failing to recognize that accountability requires a designated role with the power to impose consequences, not just monitor or advise.

How to eliminate wrong answers

Option A is wrong because an external auditor provides independent assessment but lacks the authority to enforce compliance or impose consequences; their role is advisory and verification-based, not punitive. Option B is wrong because the internal audit function evaluates controls and reports findings but does not have the mandate to enforce compliance or impose consequences; it is an oversight body, not an enforcement one. Option D is wrong because a chief compliance officer typically oversees compliance programs but may not have direct authority to impose consequences across the organization; enforcement often requires a higher-level governance role with cross-functional authority.

Full explanation →
169
MCQmedium

During a merger, two companies with different information security programs are being integrated. The combined entity must maintain compliance with PCI DSS and GDPR. The CISO is concerned about gaps in coverage due to differing maturity levels. Which of the following is the BEST approach to harmonize the programs?

A.Adopt the more stringent security program from the acquirer across the entire entity.
B.Merge the two programs by combining all controls from each.
C.Implement a completely new framework that meets both regulations.
D.Perform a gap analysis against the requirements and prioritize remediation.
AnswerD

A gap analysis provides a clear picture of what is missing and allows for efficient resource allocation.

Why this answer

A gap analysis identifies where controls are missing or insufficient, allowing for a prioritized remediation plan. Option A is wrong because adopting the higher standard may be unnecessary and costly. Option B is wrong because merging without analysis could introduce risks.

Option C is wrong because a new framework from scratch may not leverage existing investments.

Full explanation →
170
MCQeasy

Which of the following is the PRIMARY reason for including communication templates in the incident response plan?

A.To reduce the workload on the communications lead.
B.To comply with regulatory requirements for breach notification.
C.To ensure consistent and timely messaging to stakeholders.
D.To avoid legal liability by using approved language.
AnswerC

Templates help deliver clear, pre-approved messages quickly.

Why this answer

Communication templates ensure that notifications are consistent, accurate, and timely during the stress of an incident, reducing the risk of errors or omissions.

Full explanation →
171
Matchingmedium

Match each incident management phase to its activity.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Develop incident response plan and train team

Identify and validate security incidents

Isolate threat, remove malware, restore operations

Conduct lessons learned and update procedures

Notify stakeholders and regulatory bodies

Why these pairings

The correct phases are: Detection (identifying signs), Response (immediate containment), Mitigation (controls to reduce impact), and Recovery (restoration). Common confusions include swapping Detection and Response activities, or Mitigation and Recovery activities.

Full explanation →
172
MCQmedium

An organization is implementing a hybrid governance model for information security. Which statement best describes this approach?

A.All security decisions are made by a central security team
B.Each business unit has full autonomy over security without central coordination
C.Security is outsourced to a third-party provider
D.A central security team sets policies and provides oversight, while business units execute security operations
AnswerD

Hybrid combines central direction with local execution.

Why this answer

Hybrid combines centralized oversight with decentralized execution within business units.

Full explanation →
173
Multi-Selecthard

A security manager is presenting risk analysis results to the board. Which of the following should the manager include to effectively communicate risk? (Select THREE)

Select 3 answers
A.Monetary value of potential losses
B.Detailed technical vulnerabilities
C.Likelihood of occurrence expressed as annual probability
D.Anecdotal stories of past incidents
E.Comparison of residual risk to risk appetite
AnswersA, C, E

Why this answer

Monetary value of potential losses (A) is correct because it translates technical risk into financial terms that board members understand, enabling informed decisions on resource allocation for risk mitigation. This aligns with the CISM focus on business-aligned risk communication, where quantitative metrics like Annualized Loss Expectancy (ALE) directly support cost-benefit analysis.

Exam trap

The trap here is that candidates often select 'Detailed technical vulnerabilities' (B) thinking it demonstrates thoroughness, but the board requires business-impact language, not technical depth.

Why the other options are wrong

B

Board members typically lack technical background; focus on business impact.

D

Anecdotes are not quantitative and may skew perception.

Full explanation →
174
MCQeasy

During incident investigation, which evidence preservation method is most important?

A.Take screenshots of the attack
B.Interview witnesses immediately
C.Create a forensic image of affected drives
D.Reboot the system to capture memory
AnswerC

Correct: Forensic imaging preserves the exact state for analysis.

Why this answer

Creating a forensic image of affected drives (option C) is the most important evidence preservation method because it captures a bit-for-bit copy of the storage media, including deleted files, slack space, and unallocated clusters, without altering the original evidence. This ensures data integrity and admissibility in legal proceedings, as the image can be hashed (e.g., using SHA-256) and verified against the original. In incident response, the order of volatility dictates that persistent storage is preserved after volatile memory, but for long-term analysis, the forensic image is the gold standard.

Exam trap

The trap here is that candidates often confuse the order of volatility (where memory is captured first) with the most important method for long-term evidence preservation, leading them to choose memory capture (option D) over forensic imaging, which is the foundational step for reconstructing the incident timeline and recovering deleted artifacts.

How to eliminate wrong answers

Option A is wrong because taking screenshots captures only a static, user-visible view of the system state, missing critical hidden data such as memory-resident malware, network connections, and file system artifacts; it also introduces potential metadata alteration and lacks cryptographic verification. Option B is wrong because interviewing witnesses immediately, while valuable for context, does not preserve the technical evidence itself and may lead to memory contamination or loss of volatile data if not conducted after proper preservation steps. Option D is wrong because rebooting the system to capture memory destroys volatile data (e.g., running processes, network connections, encryption keys) and alters the system state, violating the forensic principle of not changing the original evidence; memory should be captured before reboot using tools like FTK Imager or LiME.

Full explanation →
175
MCQeasy

Which of the following is the best indicator that an organization has effective information security governance?

A.Achievement of ISO 27001 certification
B.The security budget has increased year over year
C.Low number of security incidents
D.Security metrics are reviewed by the board quarterly
AnswerD

Security metrics reviewed by the board ensure strategic alignment and accountability, which is the best indicator of effective governance.

Why this answer

(ISO 27001 certification) indicates compliance, not necessarily governance performance. Option B (security budget increased) does not guarantee effectiveness. Option C (low number of incidents) could be due to luck.

Option D (board review of metrics) demonstrates governance oversight and strategic alignment.

Full explanation →
176
MCQhard

During a major incident, the crisis management team (CMT) has been activated. Which of the following is the PRIMARY responsibility of the communications lead on the CMT?

A.Coordinating all external and internal communications
B.Authorizing financial expenditures for incident response
C.Directing technical containment efforts
D.Preserving digital evidence for litigation
AnswerA

The communications lead ensures consistent messaging and manages stakeholder communication.

Why this answer

The communications lead manages external and internal messaging, including media and customer notifications.

Full explanation →
177
Multi-Selecteasy

Which TWO of the following are examples of risk mitigation controls? (Choose two.)

Select 2 answers
A.Enforcing least privilege access controls
B.Implementing intrusion detection systems
C.Discontinuing a high-risk business process
D.Purchasing cyber insurance
E.Accepting the risk in a formal statement
AnswersA, B

Access controls reduce the likelihood of unauthorized access.

Why this answer

Options A and B are correct. Enforcing least privilege access controls reduces the risk by limiting user permissions, and implementing intrusion detection systems mitigates risk by detecting and alerting on threats. Option C (discontinuing a high-risk business process) is risk avoidance, option D (purchasing cyber insurance) is risk transfer, and option E (accepting the risk in a formal statement) is risk acceptance.

Full explanation →
178
MCQmedium

An organization's incident response plan requires that evidence be preserved for potential litigation. Which of the following actions is MOST critical to ensure the admissibility of digital evidence?

A.Storing evidence in a secure, access-controlled location.
B.Creating forensic images of all affected systems before remediation.
C.Encrypting all evidence files to prevent unauthorized access.
D.Documenting the chain of custody for all evidence collected.
AnswerD

Chain of custody is the foundation for evidence integrity in court.

Why this answer

Admissibility of digital evidence in court hinges on demonstrating that the evidence has not been tampered with from the moment of collection to presentation. The chain of custody is the legally mandated documentation that tracks every person who handled the evidence, the time and date of each transfer, and the purpose of each action. Without a complete and verifiable chain of custody, the opposing counsel can successfully argue that the evidence may have been altered, making it inadmissible regardless of how securely it was stored or imaged.

Exam trap

The trap here is that candidates confuse operational best practices (like creating forensic images or securing evidence) with the legal requirement for admissibility, which is fundamentally about proving an unbroken chain of custody through meticulous documentation.

How to eliminate wrong answers

Option A is wrong because storing evidence in a secure, access-controlled location protects its integrity but does not create the legal record required to prove that integrity in court; a secure location alone cannot rebut allegations of tampering without documented custody transfers. Option B is wrong because creating forensic images before remediation is a best practice for preserving evidence, but the images themselves are useless for litigation if the chain of custody is not documented; the image must be accompanied by a hash (e.g., SHA-256) and a custody log to be admissible. Option C is wrong because encrypting evidence files prevents unauthorized access but introduces a separate admissibility hurdle: if the encryption key is lost or the decryption process cannot be verified, the evidence may be deemed inaccessible or its integrity questioned; encryption does not replace the need for a documented chain of custody.

Full explanation →
179
MCQeasy

A small business cannot afford a dedicated security team. Which governance model is most appropriate?

A.Implement a full security program based on ISO 27001
B.Hire a virtual CISO and outsource security operations
C.Ignore security until a breach occurs
D.Delegate security to the IT manager with periodic board updates
AnswerB

This provides governance oversight and operational capability cost-effectively.

Why this answer

For a small business without the budget for a dedicated security team, the most appropriate governance model is to hire a virtual CISO (vCISO) and outsource security operations. This provides access to expert strategic guidance and managed security services (e.g., SIEM monitoring, incident response) at a fraction of the cost of a full-time internal team, aligning with the principle of risk-based resource allocation in information security governance.

Exam trap

The trap here is that candidates often choose Option D, mistakenly believing that delegating security to the IT manager is sufficient for governance, but CISM emphasizes that governance requires dedicated security expertise and strategic oversight, not just operational IT management.

How to eliminate wrong answers

Option A is wrong because implementing a full security program based on ISO 27001 requires significant ongoing resources, including dedicated personnel for policy management, internal audits, and continuous improvement, which is impractical for a small business that cannot afford a security team. Option C is wrong because ignoring security until a breach occurs violates the fundamental governance principle of proactive risk management, leading to potentially catastrophic financial and reputational damage that could bankrupt the business. Option D is wrong because delegating security to the IT manager with periodic board updates conflates IT operations with security governance; IT managers typically lack the specialized expertise in risk assessment, compliance, and incident response frameworks (e.g., NIST CSF, ISO 27005) needed for effective governance, and periodic updates are insufficient for real-time threat monitoring.

Full explanation →
180
MCQmedium

An organization's CISO reports to the CIO. The CISO is concerned that security initiatives are often deprioritized due to conflicts of interest. Which reporting structure would best address this concern?

A.Reporting to the CEO
B.Reporting to the COO
C.Reporting to the board or risk committee
D.Reporting to the CFO
AnswerC

This ensures independent oversight and alignment with risk appetite.

Why this answer

Reporting to the board or a risk committee provides independent oversight and reduces conflicts inherent in reporting to IT or operations.

Full explanation →
181
Multi-Selectmedium

A CISO is establishing a vendor risk management (TPRM) program. Which THREE of the following are key components of an effective TPRM program?

Select 3 answers
A.Exit procedures to ensure data is returned or destroyed.
B.Performing a single annual assessment for all vendors.
C.Onboarding risk assessment based on vendor criticality and data access.
D.Requiring all vendors to have ISO 27001 certification.
E.Ongoing monitoring of vendor security posture.
AnswersA, C, E

Proper termination reduces residual risk.

Why this answer

A TPRM program includes onboarding risk assessment, ongoing monitoring, and exit procedures to manage risks throughout the vendor lifecycle.

Full explanation →
182
MCQhard

A security manager needs to justify an increase in the security budget. Which metric is MOST compelling to demonstrate the value of security investments to the board?

A.Number of phishing simulations conducted
B.Percentage of IT budget allocated to security
C.Return on investment (ROI) from avoided breach costs
D.Number of security tools deployed
AnswerC

ROI shows the financial benefit of security spending.

Why this answer

ROI calculations, such as breach avoidance value, show financial benefit and resonate with the board.

Full explanation →
183
Multi-Selectmedium

An organization is developing a vendor risk management program. Which TWO of the following should be included in the vendor onboarding risk assessment?

Select 2 answers
A.Verification of security certifications (e.g., SOC 2, ISO 27001)
B.Assessment of data classification and access levels
C.Vendor's employee satisfaction surveys
D.Review of vendor's financial stability
E.Vendor's marketing materials
AnswersA, B

Provides evidence of security controls.

Why this answer

Onboarding assessment should evaluate inherent risk (data access) and security capabilities (certifications).

Full explanation →
184
MCQeasy

Which incident severity level is characterized by major business impact, requires executive notification, and demands 24/7 response?

A.P3 — Medium
B.P2 — High
C.P4 — Low
D.P1 — Critical
AnswerD

P1 incidents have major business impact, executive notification, and 24/7 response.

Why this answer

P1 (critical) incidents have the highest severity and require immediate, around-the-clock response.

Full explanation →
185
MCQmedium

After a P2 (high) incident is resolved, the incident response team conducts a lessons learned meeting. Which timeframe is most appropriate for holding this meeting?

A.Immediately after containment
B.Only after the root cause analysis is completed
C.Within 2 weeks of incident resolution
D.Within 30 days of incident resolution
AnswerC

This timeframe balances freshness of details with time to gather data.

Why this answer

Industry best practices and many frameworks recommend holding a lessons learned meeting within two weeks of incident resolution while details are still fresh.

Full explanation →
186
MCQeasy

Based on the risk register entry, what is the primary gap in the current controls?

A.The policy exists but is not enforced technically
B.MDM is not a suitable control
C.The risk score is too low to require action
D.The likelihood of occurrence is low
AnswerA

Policy without enforcement is ineffective.

Why this answer

The risk register entry indicates that a mobile device management (MDM) policy exists but is not enforced through technical controls, such as device compliance checks or automated policy application. This creates a gap because the policy remains a paper-based directive without active enforcement mechanisms like certificate-based authentication or conditional access rules, leaving devices vulnerable to non-compliance and potential data breaches.

Exam trap

The trap here is that candidates assume a policy exists means the control is effective, but CISM emphasizes that a policy without technical enforcement (e.g., via MDM or NAC) is a gap, not a control.

How to eliminate wrong answers

Option B is wrong because MDM is a suitable control for managing mobile devices; the issue is not the suitability of MDM itself but the lack of technical enforcement of the existing policy. Option C is wrong because the risk score being low does not justify inaction; the gap in controls means the residual risk may be higher than assessed, and a low score does not eliminate the need for enforcement. Option D is wrong because a low likelihood of occurrence does not address the control gap; even if likelihood is low, the absence of technical enforcement means the control is ineffective, and the risk could materialize under changing conditions.

Full explanation →
187
MCQhard

Refer to the exhibit. Based on the risk register extract, which risk should the information security manager prioritize for additional treatment?

A.R-001 only
B.Neither risk requires additional treatment
C.R-002 only
D.Both R-001 and R-002
AnswerD

Correct. Both R-001 and R-002 have residual risk levels above the risk appetite of 5, requiring additional treatment for both.

Why this answer

Both R-001 and R-002 have residual risk levels exceeding the risk appetite of 5 (R-001: 9, R-002: 6). According to standard risk management practice, any residual risk above the appetite threshold requires additional treatment. Although R-002 has a higher inherent risk (24 vs. 12), the priority for treatment is determined by the gap between residual risk and appetite.

R-001's gap of 4 is larger than R-002's gap of 1, indicating a more urgent need for treatment. Therefore, both risks require additional treatment.

Exam trap

Candidates often mistakenly prioritize based on inherent risk magnitude alone, ignoring that residual risk relative to appetite is the primary driver for additional treatment decisions. Here, R-002's higher inherent risk might seem more critical, but R-001's residual risk exceeds appetite by a larger margin, making it equally or more urgent.

How to eliminate wrong answers

Option A is wrong because R-001's residual risk of 9 exceeds the risk appetite threshold of 5, so it does require additional treatment, but it is not the higher priority. Option B is wrong because both risks have residual ratings above the appetite threshold (R-001: 9 > 5, R-002: 6 > 5), so both require additional treatment. Option D is wrong because while both need treatment, the question asks which should be prioritized; R-002's higher inherent risk (24 vs. 12) and larger gap between residual and appetite (6 vs. 5, but with higher inherent) make it the priority, not both equally.

Full explanation →
188
MCQeasy

Which capability maturity model (CMM) level indicates that security processes are managed and measured using quantitative metrics?

A.Level 4: Managed
B.Level 3: Defined
C.Level 2: Repeatable
D.Level 5: Optimizing
AnswerA

Managed uses quantitative measures.

Why this answer

Level 4 (Managed) is characterized by quantitative management of processes.

Full explanation →
189
MCQmedium

According to the exhibit, which role is responsible for conducting forensic analysis?

A.Incident Manager
B.Technical Lead
C.Legal Counsel
D.Communication Lead
AnswerB

The Technical Lead is correct because they possess the deep technical expertise required to preserve, acquire, and examine digital evidence without altering its integrity, following proper chain-of-custody procedures.

Why this answer

The Technical Lead is responsible for conducting forensic analysis because they possess the deep technical expertise required to preserve, acquire, and examine digital evidence without altering its integrity. In incident response, the Technical Lead oversees the technical team, ensuring that chain-of-custody procedures are followed and that forensic tools (e.g., FTK Imager, EnCase, or dd for disk imaging) are correctly applied to capture volatile and non-volatile data.

Exam trap

The trap here is that candidates confuse the Incident Manager's overall authority with the hands-on technical execution, assuming the manager performs all tasks, when in fact the Technical Lead is the specific role for forensic analysis in a structured incident response team.

How to eliminate wrong answers

Option A is wrong because the Incident Manager coordinates the overall response, allocates resources, and communicates with stakeholders, but does not perform hands-on forensic analysis. Option C is wrong because Legal Counsel advises on legal compliance, data privacy laws, and evidentiary admissibility, but does not execute forensic collection or examination. Option D is wrong because the Communication Lead manages internal and external messaging, public relations, and stakeholder updates, not the technical forensic investigation.

Full explanation →
190
MCQhard

You are the information security manager for a financial services company that processes credit card transactions. The company uses a mix of on-premises servers and cloud services. During a routine vulnerability scan, you discover that one of the web servers has been compromised with a web shell that allows remote command execution. The server is part of a cluster that handles customer-facing web traffic. The incident response team is activated. The team's immediate actions include isolating the server from the network and taking a forensic image. However, the server is critical for business operations, and management is pressuring you to restore service quickly. The server's logs show that the web shell was uploaded three days ago, and during that time, the server processed approximately 10,000 transactions. The team has not yet fully analyzed the forensic image. You need to decide on the next steps. What should you do FIRST?

A.Wait for the next scheduled patch cycle to apply updates and then restore the server.
B.Restore the server from the most recent clean backup and bring it back online immediately to minimize revenue loss.
C.Notify the payment card industry (PCI) compliance auditor and request guidance on next steps.
D.Conduct a thorough analysis of the forensic image to determine the extent of data access and exfiltration.
AnswerD

Understanding the breach scope is critical for response and notification.

Why this answer

Before any restoration, it is critical to conduct a thorough forensic analysis to determine the extent of the breach, including whether sensitive data (e.g., credit card numbers) was accessed or exfiltrated. This analysis informs legal, regulatory, and compliance obligations. Option A is premature without understanding the full impact of the compromise.

Option B is risky as the root cause may not be fully addressed, and the backup may also be compromised. Option C may be necessary later but is not the first priority; internal investigation should precede external notification.

Full explanation →
191
MCQeasy

Which role is primarily responsible for ensuring that information security risks are identified, assessed, and managed within a business unit?

A.Data owner
B.Chief Information Security Officer (CISO)
C.Board of directors
D.Risk owner
AnswerD

Risk owner is accountable for specific risks.

Why this answer

The risk owner is the individual within a business unit who is accountable for ensuring that information security risks are identified, assessed, and managed. This role owns the risk treatment plan and is responsible for implementing controls to reduce risk to an acceptable level, as defined by the organization's risk appetite.

Exam trap

The trap here is confusing the risk owner with the CISO, as candidates often assume the CISO owns all risks, but the CISO is responsible for the risk management process, not for owning specific business unit risks.

How to eliminate wrong answers

Option A is wrong because the data owner is responsible for classifying and protecting data assets, not for managing the overall risk process within a business unit. Option B is wrong because the CISO is an enterprise-level executive who oversees the information security program and risk management framework, but does not own the risks within individual business units. Option C is wrong because the board of directors provides oversight and sets risk appetite, but is not operationally responsible for identifying, assessing, and managing risks in a specific business unit.

Full explanation →
192
MCQeasy

A security analyst receives an alert from the SIEM indicating a high number of failed login attempts from a single external IP address targeting a public-facing web server. The analyst checks the logs and sees that the attempts are using common usernames. What is the MOST appropriate immediate response?

A.Block the IP address at the firewall.
B.Ignore the alert as it is likely a false positive.
C.Disable the web server.
D.Notify law enforcement.
AnswerA

Immediate containment stops ongoing attacks.

Why this answer

The immediate response to a brute-force attack from a single external IP is to block that IP at the firewall. This stops the attack at the network perimeter, preventing further authentication attempts without affecting legitimate users (assuming the IP is not a known legitimate source). Delaying action could allow the attacker to compromise an account via password guessing, especially since common usernames are being targeted.

Exam trap

The trap here is that candidates may think notifying law enforcement is the first step, but CISM emphasizes immediate containment (blocking the IP) before escalation or external notification.

How to eliminate wrong answers

Option B is wrong because ignoring the alert could allow a successful brute-force attack, leading to account compromise; SIEM alerts for high failed login rates are a classic indicator of an active attack, not a false positive. Option C is wrong because disabling the web server would cause a denial of service for all legitimate users, which is disproportionate and unnecessary when a targeted firewall block can mitigate the threat. Option D is wrong because notifying law enforcement is not an immediate technical response; it should be done after containment and as part of the formal incident response process, not as the first action.

Full explanation →
193
MCQhard

Refer to the exhibit. A security analyst reviews the firewall configuration and identifies a potential risk. What is the most likely risk?

A.Risk of unauthorized external access to internal services.
B.Risk of denial-of-service attacks from internal hosts.
C.Risk of IP spoofing attacks from the inside network.
D.Risk of data exfiltration via DNS tunneling.
AnswerD

Permissive DNS outbound can be exploited for covert data transfer.

Why this answer

The exhibit shows a firewall rule that permits DNS traffic (UDP/TCP port 53) from the internal network to any external destination. This configuration allows internal hosts to perform DNS queries to external servers, which can be exploited for DNS tunneling—a technique where data is encapsulated within DNS queries and responses to bypass security controls and exfiltrate sensitive information. Since DNS traffic is typically allowed through firewalls, this creates a covert channel for data exfiltration, making option D the most likely risk.

Exam trap

The trap here is that candidates may focus on the firewall rule allowing outbound DNS traffic and incorrectly assume it only poses a risk of unauthorized external access (option A), overlooking the more subtle but critical risk of data exfiltration via DNS tunneling, which is a well-known covert channel in security assessments.

How to eliminate wrong answers

Option A is wrong because the firewall rule permits outbound DNS traffic from internal to external, not inbound traffic from external to internal, so unauthorized external access to internal services is not directly facilitated by this rule. Option B is wrong because denial-of-service attacks from internal hosts would require a different attack vector, such as flooding, and the DNS rule does not inherently enable internal hosts to launch DoS attacks; it merely allows DNS queries. Option C is wrong because IP spoofing attacks from the inside network involve forging source IP addresses, which is not directly related to the DNS rule; spoofing is typically mitigated by ingress/egress filtering, not by DNS-specific firewall rules.

Full explanation →
194
MCQhard

An organization's information security governance committee has not met for the past six months. Which of the following is the most significant risk associated with this situation?

A.Increased operational costs due to uncoordinated security investments
B.Regulatory fines from noncompliance
C.Delayed response to security incidents
D.Lack of oversight leading to misalignment with business strategy
AnswerD

The committee is responsible for ensuring security supports business goals; without meetings, oversight is lost.

Why this answer

The governance committee's failure to meet for six months directly undermines the strategic alignment of security initiatives with business objectives. Without regular oversight, security investments and priorities may drift from the organization's risk appetite and strategic goals, leading to misallocation of resources and increased exposure to unmanaged risks. This misalignment is the most significant risk because it affects the entire security program's effectiveness and long-term viability.

Exam trap

The trap here is that candidates often confuse operational risks (like delayed incident response) with governance risks, failing to recognize that the committee's primary role is strategic oversight, not day-to-day operations.

How to eliminate wrong answers

Option A is wrong because increased operational costs from uncoordinated security investments are a consequence of poor governance, but they are a financial impact rather than the primary governance risk; the core issue is strategic misalignment, not cost overruns. Option B is wrong because regulatory fines from noncompliance are a potential outcome of specific control failures, but the committee's absence does not directly cause noncompliance—it creates a lack of oversight that may lead to noncompliance over time, not an immediate fine. Option C is wrong because delayed response to security incidents is an operational risk typically tied to incident response processes and team readiness, not directly to the governance committee's meeting cadence; the committee's role is strategic oversight, not tactical incident handling.

Full explanation →
195
MCQhard

During a risk assessment, an organization identifies that a legacy system processes credit card data and has a high likelihood of being exploited. The cost to remediate the vulnerability is $500,000, while the potential loss from a breach is $2 million with a 30% annual probability. What is the most appropriate risk treatment decision based on this information?

A.Risk mitigation by implementing controls to fix the vulnerability
B.Risk transfer by purchasing cyber insurance
C.Risk acceptance because the probability is low
D.Risk avoidance by decommissioning the legacy system
AnswerA

Remediation cost less than ALE.

Why this answer

The annualized loss expectancy (ALE) is $600,000 (30% × $2,000,000), which exceeds the $500,000 remediation cost, making mitigation economically justified. Implementing controls to fix the vulnerability directly reduces the high likelihood of exploitation on the legacy system processing credit card data, aligning with PCI DSS requirements for protecting cardholder data.

Exam trap

The trap here is that candidates may incorrectly calculate ALE as $2 million × 0.3 = $600,000 but then compare it to the potential loss ($2 million) rather than the remediation cost ($500,000), leading them to choose risk transfer or acceptance instead of the economically optimal mitigation.

How to eliminate wrong answers

Option B is wrong because risk transfer via cyber insurance would still leave the organization exposed to the $2 million breach (minus deductible) and does not address the underlying vulnerability, nor does it satisfy PCI DSS compliance for securing credit card data. Option C is wrong because a 30% annual probability is not low; risk acceptance is only appropriate when the residual risk is within the organization's risk appetite, which is not the case here given the high ALE. Option D is wrong because risk avoidance by decommissioning the legacy system would eliminate the risk but is not the 'most appropriate' decision when cost-effective remediation ($500,000) is available, and decommissioning may disrupt business operations or require costly migration.

Full explanation →
196
MCQhard

A company is implementing a third-party risk management program and needs to prioritize vendors for assessment. Which factor should be given the highest weight?

A.Data access level and service criticality
B.Contract value
C.Duration of the relationship
D.Vendor size
AnswerA

These directly impact the organization's risk posture.

Why this answer

The sensitivity of data accessed and the criticality of the service to operations are primary risk factors for vendor prioritization.

Full explanation →
197
MCQmedium

During an incident, the incident response team discovers that the attacker used stolen credentials to access the network. What should the team do during the eradication phase?

A.Conduct a security awareness training.
B.Block the attacker's IP addresses.
C.Install additional antivirus software.
D.Reset all user passwords.
AnswerD

Correct: Directly removes attacker's access.

Why this answer

Resetting all user passwords (option D) is the correct action during the eradication phase because the attacker used stolen credentials, meaning the compromised accounts remain a backdoor even after the initial threat is contained. Eradication requires removing all traces of the attacker's access, and password reset ensures that stolen hashes or plaintext credentials are no longer valid, preventing re-entry via the same authentication vector. This aligns with NIST SP 800-61 guidance on eliminating attacker footholds by invalidating compromised authentication tokens.

Exam trap

The trap here is that candidates confuse containment actions (like blocking IPs or isolating systems) with eradication steps, failing to recognize that stolen credentials require invalidating the authentication method itself, not just the network-level access.

How to eliminate wrong answers

Option A is wrong because security awareness training is a preventive or corrective control, not an eradication activity; it does not remove the attacker's access or remediate the compromised credentials during an active incident. Option B is wrong because blocking attacker IP addresses is a containment action (e.g., via firewall ACLs or blackhole routing), not eradication; the attacker can easily pivot from a different IP, and the stolen credentials remain valid. Option C is wrong because installing additional antivirus software does not address the root cause of stolen credentials; it may detect some malware but does not revoke the attacker's authenticated access or remove persistence mechanisms tied to compromised accounts.

Full explanation →
198
MCQmedium

During an incident, the team identifies that a contractor's credentials were used to access sensitive data. Which of the following should be the IMMEDIATE action?

A.Notify the client whose data was accessed.
B.Revoke the contractor's access and terminate the contract.
C.Contact the contractor to ask about the activity.
D.Disable the compromised credentials and initiate forensic investigation.
AnswerD

Disabling the credentials stops further unauthorized access immediately, and initiating forensic investigation ensures proper evidence collection and understanding of the incident. This aligns with the containment and investigation phases of incident response.

Why this answer

When compromised credentials are identified during an incident, the immediate priority is to contain the threat by disabling the compromised credentials to prevent further unauthorized access, and then to initiate a forensic investigation to determine the scope, method, and impact of the breach. Option D correctly follows the incident response containment and investigation phases, ensuring that evidence is preserved and the attack vector is understood before any notification or contractual actions are taken.

Exam trap

The trap here is that candidates confuse 'immediate containment' with 'immediate notification or punitive action', failing to recognize that the first priority in incident management is to stop the bleeding and secure evidence, not to assign blame or notify external parties.

How to eliminate wrong answers

Option A is wrong because notifying the client before the investigation is complete could cause unnecessary panic, violate legal hold requirements, and may be premature if the scope of data access is not yet fully understood. Option B is wrong because terminating the contract immediately could destroy evidence, such as logs or system artifacts, and may be an overreaction if the contractor's credentials were stolen rather than misused by the contractor. Option C is wrong because contacting the contractor could alert a potential malicious insider or an attacker who has compromised the contractor's account, allowing them to cover their tracks or destroy evidence before forensic analysis can begin.

Full explanation →
199
MCQeasy

Which of the following is the PRIMARY purpose of an incident response plan?

A.To document vendor contacts only
B.To assign blame for security failures
C.To replace the need for incident response training
D.To provide a step-by-step guide for responding to incidents
AnswerD

The plan outlines roles, procedures, and communication to enable effective response.

Why this answer

The IR plan provides a structured approach to manage incidents, minimizing impact and ensuring efficient response.

Full explanation →
200
MCQhard

An organization has experienced a ransomware incident that has encrypted critical servers. The incident response team is working on containment. Which communication should the incident manager prioritize FIRST?

A.Notify the executive sponsor, legal counsel, and communications lead
B.Contact the organization's cyber insurance provider
C.Notify law enforcement
D.Issue a press release
AnswerA

These key stakeholders need to be informed immediately to activate crisis management and legal protocols.

Why this answer

Immediate containment and notification of key internal stakeholders (executive sponsor, legal, communications) is the first priority to coordinate response and manage legal/regulatory obligations.

Full explanation →
201
Multi-Selecthard

Which THREE of the following are key activities during the post-incident phase of incident management? (Select THREE.)

Select 3 answers
A.Updating incident response plans and playbooks based on lessons learned
B.Activating the disaster recovery site
C.Conducting root cause analysis using techniques like 5 Whys
D.Sharing indicators of compromise with relevant ISACs
E.Implementing immediate containment measures
AnswersA, C, D

Plans and playbooks should be updated to reflect improvements.

Why this answer

Root cause analysis, updating the IR plan/playbooks, and sharing IoCs with ISACs are all post-incident activities. Activating the DR site occurs during the response, not post-incident.

Full explanation →
202
MCQeasy

A newly appointed CISO wants to establish an information security governance committee. What is the PRIMARY purpose of this committee?

A.To manage day-to-day security operations.
B.To implement security controls across the organization.
C.To approve technical security solutions.
D.To ensure security strategy aligns with business objectives and provide oversight.
AnswerD

Governance committees bridge security and business strategy.

Why this answer

The primary purpose of an information security governance committee is to ensure that the security strategy aligns with business objectives and to provide oversight. This committee does not execute day-to-day operations or implement controls; instead, it sets direction, reviews risk posture, and ensures that security investments support organizational goals, as defined in frameworks like COBIT and ISO 38500.

Exam trap

The trap here is that candidates often confuse governance (strategic oversight and alignment) with management (tactical implementation and operations), leading them to select options that describe operational or technical tasks rather than the committee's true strategic purpose.

How to eliminate wrong answers

Option A is wrong because managing day-to-day security operations is the responsibility of operational teams (e.g., SOC, IT security staff), not a governance committee, which focuses on strategic oversight. Option B is wrong because implementing security controls is a tactical or operational activity carried out by technical teams based on policies approved by governance, not the committee's primary role. Option C is wrong because approving technical security solutions is typically a function of architecture review boards or engineering leads, while the governance committee focuses on strategic alignment and risk acceptance, not detailed technical approvals.

Full explanation →
203
MCQmedium

After a data breach incident, the incident response team must preserve evidence for potential litigation. Which of the following actions should be taken FIRST?

A.Update the IR plan
B.Begin remediation
C.Notify law enforcement
D.Issue a legal hold
AnswerD

A legal hold prevents destruction of evidence.

Why this answer

Issuing a legal hold ensures that all relevant data is preserved and not deleted, which is the first step in evidence preservation.

Full explanation →
204
MCQmedium

Which metric is considered a lagging indicator of security program performance?

A.Patch compliance percentage
B.Mean time to detect (MTTD)
C.Access review completion rate
D.Phishing simulation click rate
AnswerB

Correct. MTTD measures how quickly past incidents were detected.

Why this answer

Lagging indicators measure past events. Mean time to detect (MTTD) is a lagging indicator because it reflects historical detection efficiency.

Full explanation →
205
MCQhard

You are the incident response manager for a mid-sized e-commerce company. At 2:00 PM, the security operations center receives an alert from the intrusion detection system indicating a potential SQL injection attack against the customer database server. The server hosts a critical database containing customer PII and payment card data. The alert shows multiple suspicious queries from an internal IP address 192.168.10.50, which belongs to the development team's jump box. The development team uses this jump box to access production servers for maintenance. The jump box is managed by the IT operations team. The CEO is currently in a meeting with investors and cannot be disturbed. The CISO is on leave. The company has a written incident response plan that designates the IT director as the incident response coordinator in the absence of the CISO. The IT director has limited security knowledge. The database administrator (DBA) reports that the database is experiencing high CPU usage and that some customer records appear to have been modified. You need to take immediate action. What should you do FIRST?

A.Shut down the database server to prevent further data loss
B.Contact the development team lead to ask about the activity
C.Isolate the jump box from the network immediately
D.Escalate the incident to the IT director and request guidance
AnswerC

Stops the attack and preserves evidence.

Why this answer

Isolating the jump box (192.168.10.50) is the correct first action because it immediately stops the active SQL injection attack at its source, preventing further data exfiltration or modification. The suspicious queries originate from this internal IP, and containment is the priority in incident response to halt the threat before investigation or recovery. This aligns with the NIST SP 800-61 containment strategy, which prioritizes stopping the attack vector before preserving evidence or notifying stakeholders.

Exam trap

The trap here is that candidates confuse 'escalation' with 'first action'—they think notifying the IT director is required per the plan, but CISM emphasizes that incident response managers must take immediate containment steps before escalation when an active attack is confirmed.

How to eliminate wrong answers

Option A is wrong because shutting down the database server destroys volatile evidence (e.g., active connections, memory-resident queries) and causes unnecessary business disruption; containment should isolate the attacker, not the asset. Option B is wrong because contacting the development team lead wastes critical time and may tip off a potential insider threat or compromised account; the jump box could be under attacker control, and human verification is unreliable during an active breach. Option D is wrong because escalating to the IT director, who has limited security knowledge, delays decisive containment action; the incident response plan designates the IT director as coordinator, but you, as the incident response manager, have the authority to execute immediate containment steps per your role.

Full explanation →
206
MCQeasy

Which of the following is the PRIMARY purpose of having a pre-established contract with a digital forensics firm before an incident occurs?

A.To ensure attorney-client privilege is automatically applied
B.To ensure the firm is available 24/7
C.To guarantee a discounted rate
D.To reduce the time required to engage the firm during an incident
AnswerD

A retainer speeds up the contracting process.

Why this answer

The primary purpose of a pre-established contract with a digital forensics firm is to eliminate procurement delays during an incident. When an incident occurs, time is critical; having a signed contract in place allows the firm to be engaged immediately without waiting for legal or administrative approvals, which directly supports the incident response goal of minimizing damage and preserving evidence.

Exam trap

The trap here is that candidates confuse a secondary benefit (like cost savings or availability) with the primary operational goal of reducing engagement time, which is the core driver in incident management scenarios.

How to eliminate wrong answers

Option A is wrong because attorney-client privilege is not automatically applied by a contract; it requires specific legal agreements and actions (e.g., engaging counsel to direct the work under privilege rules), and a pre-established contract alone does not guarantee this protection. Option B is wrong while availability is a benefit, it is not the primary purpose; 24/7 availability can be arranged without a pre-established contract, and the core issue is reducing engagement time, not just availability. Option C is wrong because discounted rates are a secondary commercial benefit, not the primary purpose; the main driver is operational efficiency during an incident, not cost savings.

Full explanation →
207
MCQmedium

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this principle?

A.A single firewall with access control lists
B.Antivirus software on all endpoints
C.Physical locks on server room doors and CCTV
D.Network segmentation, intrusion detection systems, and full-disk encryption
AnswerD

Multiple overlapping controls across network, host, and data layers.

Why this answer

Defense-in-depth uses multiple layers of controls. Network segmentation, IDS, and encryption provide preventive, detective, and corrective layers at different points.

Full explanation →
208
MCQmedium

An information security program is being developed for a multinational organization. Which of the following is the PRIMARY driver for aligning the security program with business objectives?

A.Compliance with industry regulations
B.Reducing information security costs
C.Achieving the organization's strategic goals
D.Implementing the latest security technologies
AnswerC

Why this answer

The primary driver for aligning the security program with business objectives is to ensure that security initiatives directly support and enable the organization's strategic goals. Without this alignment, security becomes a cost center rather than a business enabler, and resources may be misallocated to activities that do not advance the enterprise's mission. CISM emphasizes that security governance must be integrated with business strategy to justify investment and demonstrate value to stakeholders.

Exam trap

The trap here is that candidates often mistake compliance (A) as the primary driver because it is a visible and mandatory requirement, but CISM stresses that compliance is a subset of governance, not the overarching goal of program alignment.

Why the other options are wrong

A

Compliance is a requirement but not the primary driver; the program must support business goals to be effective.

B

Cost reduction is a possible outcome but not the primary driver for alignment.

D

Adopting new technologies is a tactic, not the primary driver.

Full explanation →
209
MCQeasy

Which document outlines the overall strategy, roles, and responsibilities for incident response across the organization?

A.Communication plan
B.Incident response plan
C.Incident response policy
D.Incident response playbook
AnswerB

The plan defines the strategy, roles, and responsibilities.

Why this answer

The incident response plan provides the high-level strategy and coordination framework.

Full explanation →
210
MCQmedium

Given the exhibit, what is the most likely classification of this incident?

A.Malware infection
B.Denial of service
C.Brute-force attack
D.Insider threat
AnswerC

Correct: Typical pattern of brute-force password guessing.

Why this answer

The exhibit shows a high volume of failed authentication attempts (e.g., repeated 'Login failed' events) from a single external IP address targeting multiple user accounts within a short time window. This pattern is characteristic of a brute-force attack, where an attacker systematically tries password combinations to gain unauthorized access. The incident classification is based on the specific behavior of repeated login failures, not on malware signatures or traffic flooding.

Exam trap

The trap here is that candidates may confuse a high volume of failed logins with a denial of service attack, but the key distinction is that brute-force attacks focus on authentication attempts rather than overwhelming system resources.

How to eliminate wrong answers

Option A is wrong because a malware infection typically involves the execution of malicious code, file modifications, or unusual outbound connections, not a high volume of failed authentication attempts. Option B is wrong because a denial of service attack aims to overwhelm system resources with traffic or requests, causing service unavailability, whereas the exhibit shows repeated login failures without evidence of resource exhaustion. Option D is wrong because an insider threat would involve actions by an authorized user, such as data exfiltration or privilege misuse, not repeated failed logins from an external IP address.

Full explanation →
211
MCQeasy

Which capability maturity model (CMM) level indicates that security processes are measured and controlled?

A.Level 3: Defined
B.Level 5: Optimizing
C.Level 4: Managed
D.Level 2: Repeatable
AnswerC

Correct: Quantitative measurement and control.

Why this answer

Level 4 (Managed) involves quantitative measurement and control of processes.

Full explanation →
212
MCQhard

Refer to the exhibit. The audit finding reveals a deficiency in which critical aspect of information security governance?

A.Strategic alignment between security objectives and business goals is missing.
B.The board has not approved the security strategy.
C.Resource allocation for security initiatives is not based on business impact.
D.Risk management processes are not integrated with business planning.
AnswerA

Measurable objectives aligned with business goals are essential for strategic alignment.

Why this answer

The audit finding highlights that security initiatives are not aligned with business objectives, which is a core deficiency in strategic alignment—a critical aspect of information security governance. Without this alignment, security investments may fail to support organizational goals, leading to wasted resources and increased risk exposure. The finding directly indicates a gap between the security strategy and the business strategy, not a lack of board approval, resource allocation methodology, or risk integration.

Exam trap

The trap here is that candidates confuse a lack of board approval (Option B) with strategic alignment, but the finding explicitly describes a missing connection between security and business goals, not a missing approval signature.

How to eliminate wrong answers

Option B is wrong because the finding does not mention board approval; it focuses on the absence of alignment between security and business goals, which is a strategic alignment issue, not a governance approval gap. Option C is wrong because the finding does not address how resources are allocated or whether business impact is considered; it specifically points to a missing link between security objectives and business goals. Option D is wrong because the finding does not discuss risk management processes or their integration with business planning; it centers on the disconnect between security strategy and business strategy, not risk integration.

Full explanation →
213
MCQeasy

An information security manager is evaluating the effectiveness of the organization's security governance. Which of the following metrics would best indicate that governance processes are functioning properly?

A.Total spending on security tools compared to the approved budget.
B.Percentage of risk treatment plans that have been implemented as scheduled.
C.Number of security incidents reported per quarter.
D.Mean time to detect (MTTD) for security incidents.
AnswerB

This shows whether governance decisions on risk are being carried out.

Why this answer

The percentage of risk treatment plans implemented as scheduled directly measures whether the governance process is translating risk decisions into action. Effective governance ensures that risk owners execute agreed-upon treatments within defined timelines, reflecting accountability and process adherence. This metric aligns with the CISM governance principle that oversight should focus on outcomes of risk management activities, not just operational metrics.

Exam trap

The CISM exam often tests the distinction between governance metrics (e.g., risk treatment implementation) and operational metrics (e.g., MTTD, incident counts), and the trap here is that candidates confuse operational efficiency with governance effectiveness, picking a metric that sounds security-relevant but does not measure process oversight.

How to eliminate wrong answers

Option A is wrong because spending against budget measures financial compliance, not governance effectiveness; a governance process can be fully funded yet fail to enforce risk treatment decisions. Option C is wrong because the number of incidents reported per quarter is an operational security metric that can be influenced by detection capabilities or reporting culture, not a direct indicator of governance process health. Option D is wrong because mean time to detect (MTTD) is a tactical incident response metric that reflects detection efficiency, not whether governance structures (e.g., steering committees, policy reviews) are functioning properly.

Full explanation →
214
MCQhard

During a third-party risk assessment, the security team discovers that a critical vendor's sub-supplier (nth party) has access to sensitive data. The vendor contract does not address nth-party risk. What is the BEST course of action?

A.Accept the risk because the vendor is contractually responsible
B.Revise the contract to require the vendor to flow down security requirements to sub-suppliers
C.Perform an on-site assessment of the sub-supplier
D.Request that the vendor terminate the sub-supplier relationship
AnswerB

This ensures the vendor manages nth-party risks contractually.

Why this answer

The organization should require the vendor to contractually manage nth-party risks, as the organization's data is still at risk.

Full explanation →
215
MCQhard

A financial institution is integrating a newly acquired fintech startup. The startup has a very different security culture. What governance approach best ensures integration without stifling innovation?

A.Allow the startup to maintain its own security policies indefinitely
B.Force the startup to adopt all of the institution's policies immediately
C.Use a transitional risk-based approach, phasing in critical controls while allowing flexibility
D.Create a separate security team for the startup
AnswerC

This method ensures security while respecting the startup's culture and innovation.

Why this answer

A transitional risk-based approach balances control with flexibility, allowing the fintech startup to maintain some of its innovative security practices while gradually aligning with the institution's critical controls. Option A is incorrect because indefinitely allowing the startup to maintain its own policies creates ongoing security gaps and governance inconsistency. Option B is incorrect because forcing immediate adoption of all policies would likely stifle innovation and cause resistance, potentially harming the startup's culture.

Option D is incorrect because creating a separate security team can lead to silos and undermines unified governance. The transitional approach minimizes disruption while ensuring essential compliance.

Full explanation →
216
MCQmedium

You are the information security program manager at a global financial services firm. The firm has a mature security program, but the CISO is concerned that the program is not keeping pace with emerging threats such as supply chain attacks and advanced persistent threats (APTs). Additionally, the program currently focuses heavily on compliance with regulations (e.g., PCI DSS, GDPR) rather than proactive risk management. The board wants to see a more strategic approach to information security. However, the compliance team is large and influential, and they resist changes that might reduce their role. You have been asked to propose a new program model that addresses these concerns while maintaining regulatory compliance. What should you do?

A.Restructure the compliance team into a risk management function.
B.Expand the compliance team to cover more regulations and increase auditing frequency.
C.Increase security awareness training across the organization.
D.Evolve the program to a risk-based approach that integrates threat intelligence and adapts controls dynamically, while keeping compliance as a baseline.
AnswerD

Balances proactive risk management with compliance requirements.

Why this answer

Evolving the program to a risk-based approach (Option D) integrates threat intelligence and dynamically adapts controls, directly addressing the need for proactive management of emerging threats while maintaining compliance as a baseline. This balances strategic evolution with the compliance team's continued role. Option A (restructuring the compliance team) risks political friction and does not inherently shift to risk management.

Option B (expanding compliance coverage) increases focus on compliance, not proactive risk. Option C (increasing awareness training) is too narrow and does not address the program's strategic direction.

Full explanation →
217
MCQhard

A company is considering a policy exception that would allow temporary non-compliance with a data encryption standard due to a legacy system. What is the most important element of the exception management process?

A.Notification to all employees
B.Annual renewal without further review
C.Approval by the CISO only
D.A documented remediation plan with timelines and risk acceptance
AnswerD

This ensures the exception is temporary and risks are accepted.

Why this answer

Exceptions must include a documented remediation plan and risk acceptance to ensure accountability.

Full explanation →
218
MCQhard

During a forensic investigation, an incident responder needs to collect memory from a compromised server. What is the BEST method to preserve evidence integrity?

A.Remotely acquire memory using a network connection.
B.Use a live forensic toolkit to capture memory to a network share.
C.Reboot the system into safe mode and then capture memory.
D.Perform a hardware memory acquisition using a write-blocker.
AnswerD

Ensures data integrity and volatile data preservation.

Why this answer

Hardware memory acquisition using a write-blocker ensures that the forensic tool accesses the physical memory (RAM) directly without any modification to the system's storage or memory contents. This method preserves the integrity of the evidence by preventing any writes to the original media, which is critical for maintaining a verifiable chain of custody and admissibility in legal proceedings.

Exam trap

The trap here is that candidates often choose a remote or network-based method (Options A or B) thinking it is 'live' and 'non-disruptive,' but they overlook the fundamental forensic principle that volatile memory must be captured without altering the system state, which network-based methods inherently fail to guarantee.

How to eliminate wrong answers

Option A is wrong because remotely acquiring memory over a network introduces latency, potential packet loss, and the risk of network-based tampering or interception, which can compromise the integrity and completeness of the memory capture. Option B is wrong because capturing memory to a network share requires writing data over the network, which may alter the system's state (e.g., network stack buffers) and introduces the risk of data corruption or unauthorized access during transit. Option C is wrong because rebooting the system into safe mode will clear the contents of volatile memory (RAM), destroying critical evidence such as running processes, network connections, and encryption keys that are only present in the live memory state.

Full explanation →
219
MCQeasy

What is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

A.To determine if legal action is needed
B.To calculate the financial impact of the incident
C.To assign disciplinary actions
D.To update the incident response plan and procedures
AnswerD

The meeting generates recommendations to enhance the IR program.

Why this answer

Lessons learned aims to improve future response by identifying what worked and what didn't.

Full explanation →
220
MCQmedium

Refer to the exhibit. During a ransomware incident, the response team discovers that the backup server is also encrypted. Which phase of the playbook is MOST impacted?

A.Phase 5: Post-Incident
B.Phase 3: Eradication
C.Phase 2: Containment
D.Phase 4: Recovery
AnswerD

Recovery relies on clean backups; encrypted backups hinder restoration.

Why this answer

The Recovery phase (Phase 4) is most impacted when the backup server is encrypted during a ransomware incident. Without clean, unencrypted backups, the organization cannot restore systems and data to a known good state, which is the primary goal of the Recovery phase. The encryption of backups directly undermines the ability to recover, forcing the team to consider alternative recovery methods such as decryption keys, offline backups, or system rebuilds.

Exam trap

The trap here is that candidates often confuse the Recovery phase with the Eradication phase, thinking that removing the ransomware will automatically restore access to backups, but in reality, encrypted backups require separate decryption or restoration processes that are part of Recovery, not Eradication.

How to eliminate wrong answers

Option A is wrong because the Post-Incident phase (Phase 5) focuses on lessons learned, reporting, and process improvement, not on the immediate technical recovery from encrypted backups. Option B is wrong because the Eradication phase (Phase 3) involves removing malware and closing attack vectors, but the encrypted backups are a recovery obstacle, not an eradication task. Option C is wrong because the Containment phase (Phase 2) aims to isolate the incident to prevent further spread, but the backup server being already encrypted means containment does not address the loss of recovery data.

Full explanation →
221
MCQmedium

Which of the following is a leading indicator for security performance?

A.Patch compliance percentage
B.Mean time to recover (MTTR)
C.Number of data breaches
D.Mean time to detect (MTTD)
AnswerA

Leading indicator of vulnerability management effectiveness.

Why this answer

Leading indicators are proactive measures that predict future performance. Patch compliance is a leading indicator because it shows current security posture that influences future incidents.

Full explanation →
222
MCQhard

During a merger, the acquiring company's board insists on integrating the target company's information security governance into its own within 90 days. However, the target has a significantly different risk culture and lacks documented policies. What is the most critical governance risk in this scenario?

A.The acquiring company's security team may lack the capacity to train the target's staff.
B.The target's employees may resist the new security culture.
C.The acquiring company may inadvertently accept unknown high-risk exposures.
D.There will be insufficient time to develop new security policies for the combined entity.
AnswerC

Rushing integration without understanding the target's risk posture can lead to severe exposure.

Why this answer

The most critical governance risk is that the acquiring company may inadvertently inherit unknown high-risk exposures from the target company. Without documented policies and a compatible risk culture, the target's security posture is opaque, meaning the acquirer cannot assess or control inherited vulnerabilities, compliance gaps, or threat vectors. This violates the core governance principle of risk visibility and could lead to material breaches or regulatory penalties post-merger.

Exam trap

The trap here is that candidates confuse operational or cultural challenges (like training capacity or employee resistance) with governance-level risks, but the CISM exam emphasizes that governance is about the board's duty to ensure risk visibility and informed decision-making, not execution details.

How to eliminate wrong answers

Option A is wrong because training capacity is an operational resource issue, not a governance risk; governance focuses on oversight and risk management, not the logistics of staff training. Option B is wrong because employee resistance is a cultural change management challenge, not a governance risk; governance risks involve strategic decision-making and risk acceptance, not personnel attitudes. Option D is wrong because insufficient time to develop new policies is a project management constraint, not a governance risk; governance risk centers on the board's failure to identify and control unknown exposures, not the speed of policy creation.

Full explanation →
223
MCQmedium

Match each risk assessment activity with the correct phase of the risk management lifecycle: Activities: 1. Identify assets and threats 2. Determine risk level 3. Select controls to reduce risk 4. Monitor risk over time Phases: A. Risk Assessment B. Risk Treatment C. Risk Monitoring D. Risk Communication (not used)

1.Identify assets and threats
2.Determine risk level
3.Select controls to reduce risk
4.Monitor risk over time

Why this answer

The correct mapping is: Activity 1 (Identify assets and threats) and Activity 2 (Determine risk level) belong to Risk Assessment (Phase A). Activity 3 (Select controls to reduce risk) belongs to Risk Treatment (Phase B). Activity 4 (Monitor risk over time) belongs to Risk Monitoring (Phase C).

Risk Communication is an overarching activity not assigned as a separate phase.

Exam trap

Candidates often confuse 'determine risk level' as part of risk treatment, but it is actually part of assessment. Also, monitoring is often overlooked as a separate phase.

Why the other options are wrong

1

Correct match is A

2

Correct match is A

3

Correct match is B

4

Correct match is C

Full explanation →
224
MCQeasy

A multinational organization is establishing an information security program. The Chief Information Security Officer (CISO) wants to ensure the program aligns with business objectives and is accountable to senior management. Which of the following governance structures would best support this goal?

A.A board-level risk committee oversees the information security program without management involvement.
B.An executive steering committee with representatives from business units, legal, and IT meets quarterly to review program status.
C.The CISO reports to the chief legal officer (CLO).
D.The information security function reports directly to the IT operations manager.
AnswerB

This structure ensures alignment, accountability, and cross-functional support.

Why this answer

An executive steering committee with cross-functional representation (business units, legal, IT) ensures the information security program is aligned with business objectives and provides direct accountability to senior management through regular quarterly reviews. This structure enables strategic oversight, resource allocation, and risk acceptance decisions that tie security initiatives to organizational goals, as recommended by the CISM framework for governance.

Exam trap

The trap here is that candidates may confuse operational reporting structures (like CISO reporting to CLO or IT ops) with effective governance, overlooking the need for cross-functional management oversight that directly ties security to business objectives.

How to eliminate wrong answers

Option A is wrong because a board-level risk committee without management involvement lacks the operational insight and authority to align security with day-to-day business objectives, creating a disconnect between governance and execution. Option C is wrong because reporting to the chief legal officer (CLO) can prioritize legal compliance over broader business risk management, potentially sidelining strategic alignment and senior management accountability. Option D is wrong because reporting to the IT operations manager places security under operational IT, which typically focuses on system uptime and efficiency rather than enterprise-wide risk governance, undermining the CISO's ability to influence business strategy.

Full explanation →
225
MCQmedium

An organization has implemented a risk management framework based on ISO 27005. During the risk identification phase, a new vulnerability is discovered in a critical business application that could lead to a data breach. According to ISO 27005, which of the following is the NEXT step the organization should take?

A.Escalate the vulnerability to senior management for acceptance.
B.Update the risk register with the new vulnerability.
C.Analyze the likelihood and impact of the vulnerability being exploited.
D.Select and implement controls to mitigate the vulnerability.
AnswerC

After risk identification, the next step is risk analysis to determine the level of risk.

Why this answer

According to ISO 27005, after risk identification (including discovering a new vulnerability), the next step is risk analysis, which involves assessing the likelihood and impact of the vulnerability being exploited. This analysis is required before any decision on risk treatment (e.g., mitigation, acceptance) can be made. Option C correctly identifies this sequential step in the ISO 27005 risk management process.

Exam trap

The trap here is that candidates confuse the order of the ISO 27005 phases, often jumping to risk treatment (selecting controls) or documentation (updating the register) before completing the mandatory risk analysis step.

How to eliminate wrong answers

Option A is wrong because risk acceptance is a decision made after risk evaluation (which follows risk analysis), not immediately after identification; escalating without analyzing likelihood and impact bypasses the structured ISO 27005 workflow. Option B is wrong because updating the risk register is a documentation activity that should occur after the risk has been analyzed and evaluated, not as the immediate next step after identification. Option D is wrong because selecting and implementing controls is part of risk treatment, which occurs only after risk analysis and risk evaluation have been completed, per the ISO 27005 lifecycle.

Full explanation →
Page 2

Page 3 of 12

Page 4

All pages

123456789101112

Practice CISM by domain

Target a specific domain to shore up weak areas.

Information Security GovernanceIncident ManagementInformation Security ProgrammeInformation Security ProgramInformation Security Risk Management
See all domains with question counts →