Knowledge + Practice

Certified Information Security Manager CISM (CISM) — Questions 301–375

871 questions total · 12pages · All types, answers revealed

Take a mock exam Exam hub

Page 5 of 12

301

MCQhard

A large healthcare organization recently experienced a ransomware attack that encrypted patient records (ePHI). The attack originated from a phishing email that bypassed the email security gateway. The security program includes annual security awareness training, but post-incident analysis reveals that employees often ignore suspicious emails. The CISO wants to revise the program to reduce the likelihood of similar incidents. Which course of action is most effective?

A.Restrict users' ability to receive emails from external domains except from approved senders

B.Implement a next-generation email security gateway with AI-based threat detection

C.Deploy endpoint detection and response (EDR) on all workstations

D.Increase the frequency of phishing simulations and enforce mandatory remedial training for employees who fall for them

AnswerD

This directly modifies employee behavior through repeated testing and education.

Why this answer

Most effective because it directly addresses the human factor by increasing the frequency of phishing simulations and providing remedial training, which reinforces secure behavior. Option A improves technology but does not change employee behavior. Option B (next-generation email security gateway) may help block some phishing emails but does not address the root cause of employees ignoring suspicious emails.

Option C (EDR) can detect ransomware after execution but does not prevent the initial phishing compromise.

Full explanation →

302

MCQhard

A company experiences a DDoS attack that overwhelms its internet-facing services. The incident response team implements mitigation measures. During which phase of incident response is it most appropriate to collect and preserve evidence for potential legal action?

A.During containment, eradication, and recovery

B.During preparation

C.During detection and analysis

D.During post-incident activity

AnswerA

Evidence preservation should be done before or during containment and recovery to ensure admissibility.

Why this answer

Evidence collection should occur during containment, eradication, and recovery, but ideally before remediation to preserve forensic data. In a DDoS, logs and traffic captures should be preserved early.

Full explanation →

303

Multi-Selecthard

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Select 2 answers

A.Business impact analysis (BIA) results.

B.Security awareness training for all employees.

C.Security controls for backup and recovery.

D.Vulnerability scanning schedules.

AnswersA, C

Why this answer

A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Exam trap

The trap here is that candidates mistakenly treat security awareness training as a continuity-supporting activity, when in fact it is a general security hygiene measure, not a direct input to business continuity planning or recovery operations.

Why the other options are wrong

B

Training is important but not directly a continuity integration.

D

Vulnerability scanning is proactive security, not continuity.

Full explanation →

304

MCQhard

In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?

A.Accept the risk because the control is not cost-justified.

B.Accept the risk because ALE after control is only $2,500.

C.Implement the control because it reduces ALE to $2,500.

D.Implement the control because ALE is $10,000, and control cost is only $12,000.

AnswerA

The cost of control is greater than the risk reduction benefit, so acceptance is appropriate.

Why this answer

The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified.

Therefore, accepting the risk is the most cost-effective response.

Exam trap

The trap here is that candidates often compare the control cost to the original ALE ($10,000) or to the residual ALE ($2,500) instead of comparing it to the reduction in ALE ($7,500), leading to incorrect cost-justification conclusions.

How to eliminate wrong answers

Option B is wrong because it states 'accept the risk because ALE after control is only $2,500' — this is a correct observation about the residual ALE but fails to compare the control cost ($12,000) against the reduction in ALE ($7,500), which is the key cost-benefit analysis. Option C is wrong because it says 'implement the control because it reduces ALE to $2,500' — this ignores that the control cost ($12,000) is greater than the reduction in ALE ($7,500), making it not cost-justified. Option D is wrong because it says 'implement the control because ALE is $10,000, and control cost is only $12,000' — this incorrectly implies that a control cost lower than the original ALE justifies implementation, but the correct comparison is between the control cost and the reduction in ALE (not the original ALE).

Full explanation →

305

Multi-Selecthard

Which THREE of the following are challenges in implementing information security governance in a decentralized organization?

Select 3 answers

A.Unified risk reporting

B.Redundant security controls and tools

C.Centralized incident response

D.Diverse regulatory compliance requirements

E.Inconsistent policy enforcement across business units

AnswersB, D, E

Each unit may purchase similar tools, increasing costs and complexity.

Why this answer

In a decentralized organization, each business unit often selects its own security tools and controls, leading to redundant security controls and tools across the enterprise. This redundancy increases costs, creates management complexity, and can introduce gaps in coverage due to inconsistent integration. The lack of centralized oversight means that duplicate solutions for the same function (e.g., multiple endpoint protection platforms) are common, making unified monitoring and maintenance difficult.

Exam trap

The trap here is that candidates confuse the desired outcomes of governance (like unified reporting and centralized response) with the inherent challenges of a decentralized structure, leading them to select those as challenges rather than recognizing them as missing capabilities.

Full explanation →

306

MCQmedium

After a DDoS attack, the incident response team determines that the incident cannot be resolved within the maximum tolerable downtime (MTD). According to best practices, what should happen next?

A.Notify customers and shut down operations.

B.Escalate to the business continuity and disaster recovery teams.

C.Continue current response efforts and hope for the best.

D.Declare the incident as a disaster immediately without further analysis.

AnswerB

BC/DR activation ensures continuity of critical business functions.

Why this answer

If MTD cannot be met, business continuity or disaster recovery plans should be activated.

Full explanation →

307

MCQhard

After a security incident, the incident response team identifies that the root cause was a phishing email that bypassed the email filter. The email contained a malicious macro that executed PowerShell commands. Which control would be MOST effective in preventing similar incidents in the future?

A.Implement network segmentation for sensitive systems

B.Disable macros in documents originating from external sources

C.Deploy additional antivirus software on endpoints

D.Conduct security awareness training for all employees

AnswerB

This directly prevents the attack vector used in the incident.

Why this answer

Disabling macros in documents from external sources directly addresses the attack vector: the malicious macro that executed PowerShell commands. This control prevents the macro from running, regardless of the email filter's failure, by blocking the execution environment at the endpoint level. It is a preventive technical control that stops the attack before it can proceed.

Exam trap

The trap here is that candidates often choose security awareness training (D) because it seems like a broad solution, but the question asks for the 'most effective' control against a specific technical attack vector, and disabling macros is a direct technical prevention that does not rely on human behavior.

How to eliminate wrong answers

Option A is wrong because network segmentation limits lateral movement after a compromise but does not prevent the initial phishing email or macro execution. Option C is wrong because additional antivirus software relies on signature or heuristic detection, which can be bypassed by obfuscated or zero-day macros; it is a detective/reactive control, not a preventive one. Option D is wrong because security awareness training reduces human error but does not prevent the macro from executing if a user still opens the document; it is a administrative control, not a technical control that blocks the attack vector directly.

Full explanation →

308

Multi-Selectmedium

A CISO is presenting a security investment proposal to the board. Which two metrics are most effective for articulating the business value of the investment?

Select 2 answers

A.Breach cost avoidance

B.Mean time to patch

C.Number of security staff

D.Number of security tools deployed

E.Compliance cost avoidance

AnswersA, E

Measures financial benefit of preventing breaches.

Why this answer

Breach cost avoidance directly quantifies risk reduction, and compliance cost avoidance shows regulatory value.

Full explanation →

309

Multi-Selectmedium

Which TWO budget components are considered 'services' in a typical security budget?

Select 2 answers

A.Penetration testing conducted by an external firm

B.Security awareness training software license

C.Firewall hardware

D.Salaries for security staff

E.Managed Security Service Provider (MSSP) fees

AnswersA, E

Pen testing is a professional service.

Why this answer

Services include external consultants and managed security services, not personnel or technology purchases.

Full explanation →

310

Drag & Dropmedium

Arrange the steps for implementing a new firewall rule in an enterprise environment.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Firewall changes require clear objectives, change control, testing, implementation, and verification.

Full explanation →

311

MCQmedium

An organization's incident response team is notified of a potential denial-of-service (DoS) attack targeting their web application. The team suspects a distributed denial-of-service (DDoS) attack. What is the FIRST step the team should take?

A.Contact the ISP to block the attacking IPs.

B.Shut down the web application to protect resources.

C.Implement rate limiting on the web server.

D.Analyze network traffic to confirm the attack.

AnswerD

Traffic analysis confirms the attack and provides details for response.

Why this answer

Before taking any action, the incident response team must first confirm that a DDoS attack is actually occurring. Analyzing network traffic (e.g., using NetFlow, sFlow, or packet capture) allows the team to distinguish a genuine DDoS from a flash crowd, a misconfiguration, or a legitimate spike in traffic. This step ensures that subsequent mitigation efforts are based on accurate evidence, preventing unnecessary disruption to services.

Exam trap

The trap here is that candidates often jump to immediate mitigation (blocking IPs or shutting down) without first verifying the incident, but the CISM framework emphasizes that the first step in incident response is always to confirm and characterize the event before taking action.

How to eliminate wrong answers

Option A is wrong because contacting the ISP to block attacking IPs is premature without first confirming the attack; moreover, in a DDoS, source IPs are often spoofed, making IP-based blocking ineffective and potentially blocking legitimate users. Option B is wrong because shutting down the web application is a drastic, last-resort action that should only be taken after confirming the attack and exhausting other mitigation options; it unnecessarily denies service to legitimate users. Option C is wrong because implementing rate limiting on the web server is a reactive mitigation step that should be applied only after the attack is confirmed and its characteristics (e.g., traffic patterns, protocols) are understood; premature rate limiting can inadvertently throttle legitimate traffic.

Full explanation →

312

MCQeasy

During an incident, the incident response team needs to preserve evidence for legal proceedings. Which of the following is the MOST important action to take?

A.Create a forensic image of affected systems using write-blockers.

B.Document the incident in a free-form text.

C.Take screenshots of system logs.

D.Notify law enforcement immediately.

AnswerA

Creating a forensic image with write-blockers ensures evidence integrity.

Why this answer

Creating a forensic image of affected systems using write-blockers is the most important action because it preserves the original data in a bit-for-bit, unaltered state, ensuring the evidence is admissible in legal proceedings. Write-blockers prevent any write operations to the source drive, maintaining the integrity of the evidence chain of custody. Without a forensically sound image, any subsequent analysis could be challenged as tampered or unreliable.

Exam trap

The trap here is that candidates often choose 'Notify law enforcement immediately' because they assume legal proceedings require early police involvement, but the CISM exam emphasizes that evidence preservation and chain of custody must be secured first, and law enforcement notification is a separate decision based on legal counsel and organizational policy.

How to eliminate wrong answers

Option B is wrong because documenting the incident in free-form text is subjective and lacks the structured, timestamped, and verifiable format required for legal evidence; it does not preserve the actual system state. Option C is wrong because taking screenshots of system logs captures only a static, potentially incomplete view and does not preserve volatile data or metadata such as timestamps and log sequence numbers, making it easy to fabricate or miss critical context. Option D is wrong because notifying law enforcement immediately is premature and may bypass internal incident response procedures; law enforcement should be contacted only after the organization has secured the evidence and assessed legal obligations, as premature notification can disrupt containment and preservation efforts.

Full explanation →

313

Multi-Selecthard

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Select 2 answers

A.Number of security tools deployed

B.Risk management integrated into business processes

C.Low number of security incidents

D.Trend of improving security metrics over time

AnswersB, D

Why this answer

Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Exam trap

The trap here is that candidates often mistake a low number of security incidents as a sign of success, but CISM emphasizes that a mature program is defined by integrated risk management and measurable improvement trends, not by the absence of incidents, which can be deceptive due to detection gaps or reporting biases.

Why the other options are wrong

A

More tools do not equal maturity; could indicate complexity.

C

May be coincidental; not a reliable maturity metric.

Full explanation →

314

MCQmedium

Refer to the exhibit. The CISO wants to improve the program. Which recommendation BEST addresses the main gap shown in the dashboard?

A.Implement automated patching for high-risk vulnerabilities

B.Reduce the compliance target for high-risk vulnerabilities to 90 days

C.Focus on critical vulnerability remediation

D.Increase patch frequency for all systems

AnswerA

Automation can help reduce the 12% that exceed the 60-day window.

Why this answer

The dashboard shows high-risk vulnerability remediation at 88%, which is below the target. Implementing automated patching for high-risk vulnerabilities would directly address this gap by ensuring faster and more consistent remediation. Option B is incorrect because reducing the compliance target does not fix the underlying issue.

Option C is incorrect because critical vulnerability remediation is already high. Option D is incorrect because increasing patch frequency for all systems may not specifically target the high-risk vulnerability gap.

Full explanation →

315

MCQmedium

A company's incident response team uses a SIEM to detect security events. Which SIEM capability is MOST critical for early detection of a potential incident?

A.Correlation rules

B.Real-time alerting

C.User and entity behavior analytics (UEBA)

D.Long-term log retention

AnswerA

Correlation rules link related events across sources to detect attacks early.

Why this answer

Correlation rules are the most critical SIEM capability for early detection because they allow the incident response team to define specific patterns of activity (e.g., multiple failed logins followed by a successful login from a different geographic location) that indicate a potential security incident. Unlike raw log review or simple alerting, correlation rules reduce false positives by combining multiple data sources and time-based conditions, enabling the SIEM to identify complex attack chains at the earliest possible stage. Without correlation, the team would rely on manual log analysis or isolated alerts, which significantly delays detection.

Exam trap

The trap here is that candidates often confuse 'real-time alerting' (a notification feature) with 'detection capability,' assuming that speed of notification is more important than the logic that determines what constitutes an incident, but CISM emphasizes that detection effectiveness depends on the rule logic, not the alerting speed.

How to eliminate wrong answers

Option B (Real-time alerting) is wrong because real-time alerting is a delivery mechanism, not a detection capability; it only notifies the team after a rule or threshold is triggered, so without correlation rules, the alerts would be based on single events and miss multi-step attack patterns. Option C (User and entity behavior analytics (UEBA)) is wrong because UEBA is an advanced, machine-learning-driven capability that establishes baselines over time and detects anomalies, but it is not the most critical for early detection—it requires historical data and tuning, whereas correlation rules can immediately detect known attack signatures and patterns. Option D (Long-term log retention) is wrong because long-term log retention supports forensic analysis and compliance, not early detection; it stores logs for later review but does not actively analyze or correlate events in real time to identify incidents as they occur.

Full explanation →

316

Multi-Selecteasy

Which THREE steps are essential in the post-incident review process?

Select 3 answers

A.Identify lessons learned and process improvements

B.Update the incident response plan

C.Assign blame for the incident

D.Conduct a root cause analysis

E.Renew vendor contracts

AnswersA, B, D

Continuous improvement is a primary goal.

Why this answer

The post-incident review process is fundamentally a learning exercise, not a punitive one. Identifying lessons learned and process improvements ensures that the organization captures what worked, what did not, and how to enhance future detection, response, and recovery capabilities. This step directly feeds into the continuous improvement cycle of the incident management program, reducing the likelihood and impact of similar incidents.

Exam trap

ISACA CISM often tests the distinction between a constructive, process-oriented review and a blame-seeking exercise; the trap here is that candidates may mistakenly think 'assigning blame' is necessary for accountability, when in fact it undermines the entire purpose of the review.

Full explanation →

317

MCQmedium

A large enterprise is implementing a new governance framework. The board has approved a risk appetite statement. What is the MOST important next step for the information security manager?

A.Implement technical controls to reduce risks

B.Develop an audit plan to monitor risk levels

C.Define risk acceptance criteria and thresholds

D.Conduct security awareness training for employees

AnswerC

Risk appetite needs operationalization through criteria.

Why this answer

Once the board has approved a risk appetite statement, the information security manager must translate that high-level appetite into actionable risk acceptance criteria and thresholds. This step is critical because it defines the specific boundaries (e.g., maximum acceptable monetary loss per incident, maximum tolerable downtime) that guide all subsequent risk treatment decisions. Without these criteria, technical controls (Option A) and training (Option D) cannot be properly scoped, and audit plans (Option B) would lack measurable benchmarks.

Exam trap

The trap here is that candidates often confuse the order of governance steps, mistakenly thinking that implementing controls (Option A) is the immediate next action, when in fact the risk acceptance criteria must be defined first to ensure controls are properly scoped and aligned with the board's risk appetite.

How to eliminate wrong answers

Option A is wrong because implementing technical controls before defining risk acceptance criteria and thresholds would be premature and potentially misaligned with the board's risk appetite, leading to over- or under-investment in controls. Option B is wrong because developing an audit plan to monitor risk levels assumes that the risk acceptance criteria and thresholds have already been defined, which is not the case; audits measure compliance against established criteria, not the criteria themselves. Option D is wrong because conducting security awareness training for employees is an operational activity that should be guided by the risk acceptance criteria and thresholds, not a prerequisite for defining them.

Full explanation →

318

Drag & Dropmedium

Arrange the steps for responding to a data breach involving personally identifiable information (PII).

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Incident response begins with containment, then evidence preservation, internal notification, impact assessment, and external notification.

Full explanation →

319

MCQmedium

Under the proposed SEC rules for cybersecurity incident disclosure, what is the timeframe for reporting a material cybersecurity incident?

A.Within 4 business days

B.Within 7 calendar days

C.Within 72 hours

D.Within 24 hours

AnswerA

The proposed SEC rule requires disclosure within 4 business days of determining materiality.

Why this answer

The proposed SEC rules require reporting within 4 business days for material cybersecurity incidents. GDPR requires 72 hours for personal data breaches.

Full explanation →

320

MCQeasy

After a security incident, the incident response team prepares a report detailing the root cause, impact, and lessons learned. Who is the PRIMARY audience for this report?

A.The affected users

B.Senior management and the board of directors

C.The IT support team

D.External auditors

AnswerB

They need to make strategic decisions based on the incident.

Why this answer

The primary audience for a post-incident report detailing root cause, impact, and lessons learned is senior management and the board of directors. They require this information to make strategic decisions about risk acceptance, resource allocation for remediation, and to fulfill fiduciary duties regarding cybersecurity governance. The report provides the business context and financial impact necessary for executive-level oversight, not the technical details needed by operational teams.

Exam trap

The trap here is that candidates confuse the audience for the detailed technical incident report (which goes to IT and the incident response team) with the audience for the lessons-learned executive summary, which is specifically designed for senior management and the board.

How to eliminate wrong answers

Option A is wrong because affected users need only immediate guidance on how to resume normal operations and any required password resets, not a detailed root cause analysis or lessons learned. Option C is wrong because the IT support team requires operational runbooks and specific technical indicators (e.g., IOCs, log snippets, patch versions) to implement fixes, not a high-level executive summary. Option D is wrong because external auditors typically request evidence of incident response process compliance (e.g., chain of custody, timestamps, policy adherence) rather than the strategic lessons-learned report intended for internal governance.

Full explanation →

321

MCQeasy

A small business is developing its first information security program. Which approach is most effective?

A.Hire an external security consultant to design the entire program.

B.Adopt a comprehensive framework like ISO 27001 immediately.

C.Conduct a risk assessment to identify key assets and threats.

D.Purchase and deploy a next-generation firewall.

AnswerC

Aligns program with actual business risks and priorities.

Why this answer

Conducting a risk assessment (Option C) is the foundational step in building an information security program because it identifies the specific assets, threats, vulnerabilities, and impacts unique to the small business. Without this context, any controls or frameworks applied would be misaligned with the actual risk profile, leading to wasted resources and potential security gaps. The CISM framework emphasizes that risk assessment drives the selection of cost-effective, prioritized controls tailored to the organization's needs.

Exam trap

The trap here is that candidates often confuse 'security tools' or 'frameworks' with 'program development,' mistakenly believing that deploying a specific technology or adopting a standard immediately constitutes an effective security program, when in fact the CISM exam requires that risk assessment must precede any control selection or framework adoption.

How to eliminate wrong answers

Option A is wrong because hiring an external consultant to design the entire program bypasses the necessary internal risk assessment and ownership, resulting in a generic program that may not address the business's specific threat landscape or operational constraints. Option B is wrong because adopting a comprehensive framework like ISO 27001 immediately is premature and overly complex for a small business; it requires a mature risk management process and significant resources, and without a prior risk assessment, the controls implemented may be irrelevant or excessive. Option D is wrong because purchasing and deploying a next-generation firewall (NGFW) is a point solution that addresses only network perimeter threats, ignoring other critical areas such as data classification, access controls, incident response, and employee training, which are essential for a holistic security program.

Full explanation →

322

MCQeasy

During an internal audit, it was found that the security policy does not address the use of personal devices for work. Which governance action should be taken first?

A.Develop a mobile device management policy and conduct a risk assessment

B.Train users on security awareness

C.Purchase MDM software

D.Immediately ban all personal devices

AnswerA

This is the proper governance approach: policy first, then technology and training.

Why this answer

The first governance action should be to develop a mobile device management (MDM) policy and conduct a risk assessment because governance requires establishing a formal framework before implementing technical controls. Without a policy, any subsequent actions (like purchasing MDM software or training) lack a defined scope, risk appetite, and compliance baseline. The risk assessment identifies specific threats (e.g., data leakage via unmanaged devices, lack of encryption) and informs the policy's requirements, aligning with the CISM governance domain's emphasis on policy as the foundation for all security activities.

Exam trap

The trap here is that candidates often jump to a technical solution (MDM software) or a punitive measure (banning devices) because they focus on immediate risk mitigation, but CISM governance questions test the principle that policy and risk assessment must precede any technical or operational controls.

How to eliminate wrong answers

Option B is wrong because training users on security awareness is an operational control that should follow policy definition; without a policy, training lacks specific guidance on acceptable use, data handling, and device requirements. Option C is wrong because purchasing MDM software is a technical solution that should be selected based on policy requirements and risk assessment findings; implementing technology before governance leads to misalignment and wasted resources. Option D is wrong because immediately banning all personal devices is a reactive, non-governance action that ignores business needs and user productivity; a policy-based approach allows for risk-managed acceptance or conditional use rather than outright prohibition.

Full explanation →

323

Multi-Selectmedium

Which THREE of the following are common challenges in incident response? (Select exactly 3)

Select 3 answers

A.Over-reliance on cloud services

B.Poor coordination between teams

C.Insufficient staffing and expertise

D.Difficulty in identifying the root cause

E.Lack of proper tools and technology

AnswersB, C, E

Silos hinder effective response.

Why this answer

Poor coordination between teams (Option B) is a common challenge in incident response because security incidents often require collaboration across IT, legal, PR, and management. Without clear communication channels and predefined roles, response efforts become fragmented, leading to delays in containment and recovery. This is a well-documented issue in frameworks like NIST SP 800-61, which emphasizes the need for a coordinated incident response plan.

Exam trap

ISACA often tests the distinction between operational challenges during active response (coordination, staffing, tools) versus strategic or post-incident issues (cloud dependency, root cause analysis) to see if candidates confuse the incident response lifecycle phases.

Full explanation →

324

Drag & Dropmedium

Order the steps for conducting an internal audit of an information security management system (ISMS) based on ISO 27001.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Audits start with scope definition, planning, execution, documentation, and reporting.

Full explanation →

325

MCQhard

A CISO is building a business case for a new security tool. Which approach BEST articulates the return on investment (ROI) to the board?

A.Total cost of ownership (TCO) compared to competitors

B.Risk reduction value minus total cost of ownership

C.Compliance with industry standards

D.Number of alerts the tool will generate

AnswerB

This shows net benefit (ROI) by comparing risk reduction to cost.

Why this answer

Risk reduction value quantifies the expected reduction in loss, which directly ties to business value.

Full explanation →

326

MCQeasy

A security manager is designing a security awareness program for a mid-sized organization. Which of the following is the MOST effective approach to ensure that training is relevant to different employee roles?

A.Deliver the same annual training to all employees to ensure consistency.

B.Provide role-based training that addresses specific risks for each job function.

C.Focus only on senior executives since they are the primary targets of social engineering.

D.Conduct quarterly phishing simulations without any formal training.

AnswerB

Role-based training is tailored and more effective.

Why this answer

Role-based training tailors content to specific job functions, making it more relevant and effective than generic training. Developers need secure coding, executives need social engineering awareness, and all staff need basic awareness.

Full explanation →

327

MCQhard

Refer to the exhibit. An analyst observes the network traffic between three internal hosts and a web server. Which of the following is the MOST likely interpretation of this traffic?

A.A SYN flood attack is in progress.

B.A single host is using multiple IP addresses to scan the server.

C.Multiple users are accessing the web server normally.

D.A distributed denial-of-service (DDoS) attack is occurring.

AnswerC

The logs show successful TCP connections followed by HTTP requests.

Why this answer

The exhibit shows multiple internal hosts (10.0.0.1, 10.0.0.2, 10.0.0.3) each establishing a normal TCP three-way handshake with the web server (192.168.1.100) on port 80, with varying source ports and no abnormal flags or packet rates. This pattern indicates legitimate concurrent user access, as each host completes the handshake and exchanges data without flooding or scanning behavior.

Exam trap

The trap here is that candidates may misinterpret any traffic from multiple hosts as a DDoS attack, failing to notice the normal handshake completion and low packet volume that indicate legitimate user access rather than an attack.

How to eliminate wrong answers

Option A is wrong because a SYN flood attack would show a high volume of SYN packets from a single source with no corresponding SYN-ACK completions, often with spoofed source IPs, not the clean three-way handshakes seen here. Option B is wrong because a single host using multiple IP addresses to scan the server would typically send probes to multiple ports or show incomplete connections (e.g., SYN scans with RST responses), not full handshakes to the same port from distinct internal IPs. Option D is wrong because a DDoS attack would involve a massive number of packets from many sources overwhelming the server, often with incomplete connections or unusual traffic patterns, not the orderly, low-rate connections from three hosts.

Full explanation →

328

Multi-Selecteasy

An incident response team is creating playbooks for different incident types. Which TWO incident types should have a dedicated playbook? (Select TWO.)

Select 2 answers

A.Ransomware

B.Password expiration

C.Data breach

D.Software update failure

E.Phishing simulation

AnswersA, C

Ransomware has unique containment and recovery steps.

Why this answer

Ransomware and data breach are common incident types that require specific procedures.

Full explanation →

329

MCQmedium

Which of the following is the primary purpose of conducting a root cause analysis (RCA) after a security incident?

A.To identify the technical vulnerability that was exploited

B.To determine process and governance failures that allowed the incident to occur

C.To satisfy regulatory reporting requirements

D.To assign blame to responsible individuals

AnswerB

RCA looks beyond technical causes to process and management failures.

Why this answer

RCA aims to identify underlying causes to prevent recurrence. While it may involve understanding the technical cause, the ultimate goal is to improve processes and controls.

Full explanation →

330

Multi-Selectmedium

Which of the following are key components of an information security program's strategic plan? (Select two.)

Select 2 answers

A.Annual budget allocation

B.Security program vision and objectives

C.Incident response procedures

D.Roadmap for security initiatives

AnswersB, D

Why this answer

The strategic plan for an information security program defines the long-term direction and governance framework. The security program vision and objectives (B) establish the overarching goals and alignment with business strategy, while the roadmap for security initiatives (D) provides the phased implementation plan to achieve those objectives. These are foundational components of strategic planning, not operational or tactical elements.

Exam trap

ISACA often tests the distinction between strategic (vision, roadmap) and operational/tactical (budget, procedures) components, leading candidates to mistakenly select annual budget allocation as a strategic element because it is a common management activity.

Why the other options are wrong

A

Budgeting is operational, not strategic.

C

Procedures are operational.

Full explanation →

331

MCQhard

Acme Corp, a global manufacturer, has a decentralized security governance model. Each business unit manages its own security, resulting in inconsistent policies and repeated audit findings. The new CISO proposes a federated model where a central team sets minimum standards and each unit can add local controls. However, the European unit's head insists on full autonomy due to GDPR strictness. The board is concerned about compliance costs. What should the CISO do first?

A.Implement the federated model immediately and require all units to comply

B.Allow the European unit to keep full autonomy while others follow the model

C.Conduct a risk assessment to identify where local controls are truly needed

D.Hire a GDPR expert for the European unit

AnswerC

A risk-based approach provides evidence for the federated model.

Why this answer

Conducting a risk assessment will identify where local controls are truly necessary and justify the federated model. Option A ignores local concerns. Option B undermines the federation goal.

Option D is a tactical fix, not strategic.

Full explanation →

332

MCQeasy

In a vendor tiering system for third-party risk management, which factor is most critical for determining the tier?

A.Vendor's data access and service criticality

B.Vendor's annual revenue

C.Vendor's geographic location

D.Vendor's number of employees

AnswerA

These determine the potential impact on the organization.

Why this answer

The vendor's access to sensitive data and the criticality of the service to business operations are the primary factors for tiering, as they directly impact risk exposure.

Full explanation →

333

MCQeasy

Refer to the exhibit. The dashboard shows the incident response plan test is overdue. What is the MOST immediate risk?

A.Loss of cyber insurance coverage

B.Regulatory fines for non-compliance with testing requirements

C.Extended recovery time during an incident

D.Increased likelihood of a successful breach due to untested procedures

AnswerD

Without testing, the incident response plan may fail, leading to greater damage.

Why this answer

An untested incident response plan may have invalidated or outdated procedures, increasing the likelihood that a real incident will succeed due to ineffective response. Option A is wrong: loss of cyber insurance coverage is a potential consequence but not the most immediate risk—testing overdue does not instantly void coverage. Option B is wrong: regulatory fines may follow non-compliance, but the immediate operational risk is higher.

Option C is wrong: extended recovery time is a possible outcome, but the primary immediate risk is the increased chance of a successful breach.

Full explanation →

334

MCQhard

During a risk assessment, the risk team identifies that a key vendor has access to sensitive data. The vendor's security posture is unclear. Which of the following is the BEST course of action?

A.Ignore the risk because the vendor is known

B.Terminate the vendor relationship immediately

C.Conduct a third-party risk assessment

D.Request the vendor's latest security certification

AnswerC

A formal assessment evaluates the vendor's security controls.

Why this answer

When a vendor's security posture is unclear and they have access to sensitive data, the best course of action is to conduct a third-party risk assessment. This assessment evaluates the vendor's security controls, compliance with standards (e.g., ISO 27001, SOC 2), and contractual obligations before making any decisions. It provides the necessary evidence to determine if the risk is acceptable or requires mitigation, rather than acting on assumptions.

Exam trap

The trap here is that candidates may choose D, thinking a certification is a definitive proof of security, but CISM emphasizes that certifications are only one piece of evidence and must be supplemented with a current, context-specific risk assessment.

How to eliminate wrong answers

Option A is wrong because ignoring the risk based solely on vendor familiarity violates the principle of due care and could lead to data breaches; risk must be assessed regardless of relationship length. Option B is wrong because terminating the relationship immediately is a drastic, reactive measure that may disrupt business operations without first verifying the actual security posture; a risk assessment should precede such decisions. Option D is wrong because requesting the latest security certification alone is insufficient; certifications may be outdated, not cover all relevant controls, or be falsified, and a comprehensive assessment is needed to validate the vendor's current security state.

Full explanation →

335

MCQeasy

Which incident category involves unauthorized access to systems or data by an individual within the organization?

A.DDoS

B.Data breach

C.Ransomware

D.Insider threat

AnswerD

Insider threat is the correct category for malicious or accidental actions by insiders.

Why this answer

Insider threat incidents are caused by employees, contractors, or other trusted insiders.

Full explanation →

336

Multi-Selectmedium

Which THREE of the following are key activities in a third-party risk management (TPRM) program?

Select 3 answers

A.Ongoing monitoring of vendor security posture

B.Providing vendor with access to internal network

C.Negotiating contract security requirements

D.Onboarding risk assessment for new vendors

E.Performing background checks on vendor employees

AnswersA, C, D

Continuous monitoring detects changes in risk.

Why this answer

TPRM includes onboarding risk assessment, contract security requirements, and ongoing monitoring.

Full explanation →

337

MCQmedium

During a phishing campaign, several employees clicked a malicious link that downloaded a remote access trojan (RAT). The incident response team has isolated the infected endpoints and is analyzing network traffic. They suspect that data may have been exfiltrated but are unsure. The team needs to determine the extent of data exfiltration as quickly as possible. What action should the team take FIRST?

A.Review DNS logs for outbound connections to unknown destinations

B.Block the malicious domain at the firewall

C.Reset all employees' passwords

D.Run a full network scan for open ports

AnswerA

DNS logs can show queries to command-and-control or exfiltration domains, providing evidence.

Why this answer

Reviewing DNS logs can reveal connections to known malicious domains or unusual patterns, helping identify data exfiltration. Blocking the domain is a containment step but doesn't aid analysis. Running a network scan may be too broad.

Resetting passwords is important but not for detecting exfiltration.

Full explanation →

338

Multi-Selecthard

Which THREE of the following are common challenges when implementing a risk management program in an organization? (Choose three.)

Select 3 answers

A.Lack of senior management support

B.Inability to quantify risks in financial terms

C.Too many controls implemented too quickly

D.Resistance to change from business units

E.Overly detailed risk appetite

AnswersA, B, D

Without top-down support, the program may lack resources and authority.

Why this answer

Lack of senior management support (A) is a common challenge because risk management programs require executive sponsorship to enforce policies, allocate budget, and drive cross-departmental compliance. Without C-level backing, risk assessments and remediation efforts often stall due to insufficient authority and resources.

Exam trap

ISACA CISM often tests the distinction between implementation challenges (e.g., lack of support, resistance, quantification difficulty) and operational symptoms (e.g., too many controls), so candidates mistakenly select 'too many controls' because it sounds like a problem, but it is not a root challenge of program implementation.

Full explanation →

339

MCQeasy

Which incident severity level requires executive notification and a 24/7 response?

A.P3 — Medium

B.P1 — Critical

C.P4 — Low

D.P2 — High

AnswerB

P1 incidents require 24/7 response and executive notification.

Why this answer

P1 — Critical incidents, such as a complete system outage or data breach, require immediate executive notification and a 24/7 response because they pose an imminent threat to business operations, legal compliance, or data integrity. This severity level triggers the highest escalation path, often involving the CEO, CISO, and legal counsel, with round-the-clock resource allocation to contain and remediate the issue.

Exam trap

The trap here is that candidates often confuse P2 (High) with P1 (Critical) because both involve significant business impact, but only P1 mandates executive notification and 24/7 response, as P2 incidents are typically managed by the incident response team without C-suite involvement unless they escalate.

How to eliminate wrong answers

Option A is wrong because P3 — Medium incidents, such as localized performance degradation, are handled during normal business hours and do not require executive notification or 24/7 response. Option C is wrong because P4 — Low incidents, like minor user errors or cosmetic issues, are typically logged for routine resolution and never trigger executive escalation. Option D is wrong because P2 — High incidents, such as a critical application being slow for many users, may require after-hours response but do not mandate executive notification unless they escalate to P1.

Full explanation →

340

MCQhard

Based on the exhibit, what is the most likely vulnerability that an attacker could exploit?

A.An attacker could perform a DDoS attack on the external interface to disrupt email services.

B.An attacker could use SQL injection on the web server to extract data directly from the database via the permitted MySQL traffic.

C.An attacker could exploit the SMTP service to send spam.

D.An attacker could sniff traffic on the DMZ segment to capture LDAP credentials.

AnswerB

The MySQL rule allows direct database access from web; SQL injection can leverage this.

Why this answer

The exhibit shows that MySQL traffic is permitted from the web server to the database server. An attacker who compromises the web server (e.g., via SQL injection) can use that allowed MySQL connection to extract sensitive data directly from the database, bypassing other network controls. This is a classic example of a trust-based vulnerability where internal database access is not sufficiently restricted.

Exam trap

CISM exams often test the concept that permitted traffic between zones (e.g., web to database) can be abused once an intermediate host is compromised, leading candidates to overlook the SQL injection vector in favor of more obvious but less specific attacks like DDoS or spam.

How to eliminate wrong answers

Option A is wrong because a DDoS attack on the external interface would disrupt all inbound services, not just email, and the question asks for a vulnerability that an attacker could most likely exploit based on the exhibit—DDoS is a generic attack, not a specific exploitation of a misconfigured rule. Option C is wrong because the SMTP service is typically used for sending email, but the exhibit does not indicate any misconfiguration that would allow an attacker to abuse it for spam; SMTP relay attacks require open relay configuration, which is not shown. Option D is wrong because LDAP traffic is not shown in the exhibit as being present on the DMZ segment; LDAP credentials would be transmitted over a dedicated directory service channel, and sniffing on the DMZ would not capture them unless LDAP traffic traverses that segment, which is not indicated.

Full explanation →

341

MCQmedium

An organization's board of directors wants to improve security culture. Which initiative would have the GREATEST impact?

A.Increasing the security awareness training budget

B.Implementing a near-miss reporting system

C.Establishing executive sponsorship of security

D.Conducting monthly phishing simulations

AnswerC

Executive sponsorship signals priority and accountability.

Why this answer

Executive sponsorship from the board demonstrates top-down commitment, which is critical for driving cultural change.

Full explanation →

342

MCQeasy

Which incident severity level requires executive notification and a 24/7 response?

A.P2 — High

B.P3 — Medium

C.P1 — Critical

D.P4 — Low

AnswerC

P1 incidents are critical with major business impact, requiring executive notification and 24/7 response.

Why this answer

P1 (critical) incidents have major business impact and require immediate executive notification and round-the-clock response.

Full explanation →

343

Multi-Selecthard

A security manager is developing a set of objectives and key results (OKRs) for the security program. Which THREE would be considered effective security OKRs?

Select 3 answers

A.Objective: Implement a new SIEM. Key Result: Deploy SIEM by Q3.

B.Objective: Enhance incident response. Key Result: Achieve 100% of incidents logged within 1 hour of detection.

C.Objective: Improve vulnerability management. Key Result: Reduce mean time to remediate critical vulnerabilities from 30 to 7 days.

D.Objective: Increase security awareness. Key Result: Conduct quarterly phishing simulations.

E.Objective: Reduce risk from third parties. Key Result: Complete risk assessments for 100% of high-tier vendors by year-end.

AnswersB, C, E

Measurable and outcome-focused.

Why this answer

OKRs should be measurable and tied to security outcomes.

Full explanation →

344

MCQmedium

An organization's security program includes metrics to measure performance. Which metric BEST indicates the effectiveness of the vulnerability management process?

A.Number of vulnerabilities identified

B.Number of patches deployed per month

C.Percentage of systems scanned weekly

D.Mean time to remediate (MTTR) vulnerabilities

AnswerD

MTTR shows how quickly the organization fixes vulnerabilities, a key effectiveness indicator.

Why this answer

Mean time to remediate (MTTR) directly measures how quickly the organization closes the window of exposure after a vulnerability is identified. A lower MTTR indicates a more effective vulnerability management process because it reduces the risk window, whereas raw counts of vulnerabilities or patches do not reflect the timeliness or completeness of remediation.

Exam trap

The trap here is that candidates confuse activity metrics (number of patches, scan coverage) with outcome metrics (MTTR), which is the only option that directly measures the effectiveness of closing vulnerabilities in a timely manner.

How to eliminate wrong answers

Option A is wrong because the number of vulnerabilities identified is a detection metric, not an effectiveness metric; a high count could simply reflect a larger attack surface or more aggressive scanning, not better management. Option B is wrong because patches deployed per month measures patching throughput but ignores whether critical vulnerabilities are being prioritized or whether patches are actually closing the identified exposures. Option C is wrong because the percentage of systems scanned weekly measures coverage of the scanning process, not the outcome of remediation; an organization can scan 100% of systems yet never fix the vulnerabilities found.

Full explanation →

345

MCQhard

You are the CISO of a mid-sized e-commerce company with 500 employees. The company recently suffered a data breach where an attacker exfiltrated customer credit card data from the production database. The investigation revealed that the breach originated from a compromised developer workstation. The developer had been granted direct access to the production database for troubleshooting purposes, a practice that had been in place for years. The security governance framework currently lacks a formal process for managing privileged access. The board has asked for immediate improvements to prevent recurrence. Which course of action BEST addresses the governance gap?

A.Implement a privileged access management (PAM) solution with just-in-time access and session recording.

B.Segment the network to isolate production databases from developer workstations.

C.Conduct security awareness training for all developers on password security.

D.Deploy endpoint protection and patch management for all workstations.

AnswerA

Addresses the governance gap by formalizing and controlling privileged access.

Why this answer

The core governance gap is the lack of a formal process for managing privileged access. Implementing a Privileged Access Management (PAM) solution with just-in-time (JIT) access and session recording directly addresses this by enforcing time-bound, auditable, and approved access to the production database, eliminating standing privileges. This aligns with the principle of least privilege and provides a governance mechanism to control, monitor, and revoke elevated access, which is the root cause of the breach.

Exam trap

The trap here is that candidates confuse technical controls (segmentation, patching, training) with governance controls (policies, processes, and oversight), leading them to select a solution that mitigates symptoms rather than the root governance gap of unmanaged privileged access.

How to eliminate wrong answers

Option B is wrong because network segmentation is a technical control that reduces the attack surface but does not establish a formal governance process for managing privileged access; it does not address the lack of a policy or procedure for granting, reviewing, or revoking production database access. Option C is wrong because security awareness training focuses on user behavior and password hygiene, but it does not solve the governance deficiency of having no formal privileged access management process; the breach occurred due to standing privileges, not weak passwords. Option D is wrong because endpoint protection and patch management are essential security hygiene measures but do not create a governance framework for controlling who gets privileged access and under what conditions; they mitigate workstation compromise but not the systemic lack of access governance.

Full explanation →

346

MCQhard

You are the incident response manager for a multinational corporation that processes sensitive financial data. The company has a mature security operations center (SOC) that monitors network traffic, endpoints, and cloud services. At 2:00 AM local time, the SOC alerts you to a critical incident: an internal server (IP 10.10.10.50) is communicating with an external IP address (198.51.100.23) known to be associated with a ransomware group. The server hosts a financial database that is replicated to a secondary site every 6 hours. The last successful replication was at 1:00 AM. The SOC has already isolated the server from the network by blocking its outbound traffic at the firewall. However, the server is still running. The initial investigation suggests that the communication started 30 minutes ago. The database contains customer PII and transactional data. Your incident response plan includes steps for containment, eradication, recovery, and post-incident review. The CEO is being notified and expects a recommendation on the best course of action. The company has a cyber insurance policy that requires timely notification and preservation of evidence. The legal department advises that any action that could destroy evidence must be carefully considered. Which of the following is the BEST course of action?

A.Take a forensic image of the server's memory and disk for analysis, then rebuild the server from a known good backup.

B.Reconnect the server to the network and attempt to negotiate with the attacker if ransomware is detected.

C.Immediately wipe the server and restore from the 1:00 AM backup to minimize downtime.

D.Leave the server isolated but running to monitor the attacker's actions and gather intelligence.

AnswerA

Forensic imaging preserves evidence, and rebuilding ensures a clean system.

Why this answer

It balances forensic preservation (memory and disk imaging) with recovery from a known good backup, ensuring evidence is intact for legal and insurance requirements while restoring operations. The server is isolated, so imaging can be done safely without risk of further compromise, and the 1:00 AM backup (just one hour before the 2:00 AM communication started) is likely clean, minimizing data loss.

Exam trap

ISACA often tests the misconception that immediate eradication (wiping) is faster and safer, but the trap here is that destroying evidence before forensic imaging violates legal and insurance requirements, and the isolated server can be safely imaged without risk of spread.

How to eliminate wrong answers

Option B is wrong because reconnecting the server to the network to negotiate with attackers would expose the environment to active ransomware deployment, violating containment principles and potentially destroying evidence. Option C is wrong because immediately wiping the server destroys volatile memory evidence (e.g., running processes, network connections) and disk artifacts needed for forensic analysis, which could violate cyber insurance policy requirements for evidence preservation. Option D is wrong because leaving the server isolated but running to monitor attackers risks the ransomware encrypting data in memory or triggering a delayed payload, and the SOC has already blocked outbound traffic, so no actionable intelligence can be gathered from a severed connection.

Full explanation →

347

MCQhard

Following a major security incident, the lessons learned meeting is scheduled. Which of the following outcomes is MOST important to ensure the effectiveness of future incident response?

A.Conducting a new risk assessment

B.Creating a detailed report for senior management

C.Updating the incident response plan and playbooks based on findings

D.Assigning blame to responsible parties

AnswerC

Continuous improvement is key to effective IR.

Why this answer

The primary outcome of a lessons learned meeting is to identify improvements and update the IR plan, not just document or blame.

Full explanation →

348

Multi-Selecthard

An organization is implementing a policy exception management process. Which THREE elements are essential for effective exception handling? (Select THREE.)

Select 3 answers

A.Periodic review and renewal of exceptions

B.Publicizing the exception to all employees

C.Automatic expiration of the exception after a defined period

D.Approval by the CISO or designated authority

E.Documentation of the business justification

AnswersA, D, E

Periodic review ensures exceptions remain valid.

Why this answer

Effective exception management requires documentation, approval, and periodic review to prevent exceptions from becoming permanent risks.

Full explanation →

349

Multi-Selecthard

A security analyst reviews the following alert from the SIEM: 'Multiple failed login attempts from IP 10.0.0.5 to the domain controller within 5 minutes.' Which TWO actions should the analyst take as part of initial incident response?

Select 2 answers

A.Block the IP address in the firewall immediately.

B.Review authentication logs from other servers for similar patterns.

C.Escalate the alert to the incident response team.

D.Reset the password of the targeted account.

E.Check if the source IP belongs to an internal asset.

AnswersB, E

Correlation helps identify a broader attack.

Why this answer

Reviewing authentication logs from other servers for similar patterns helps determine if the failed login attempts are part of a broader brute-force or password-spraying attack targeting multiple systems, not just the domain controller. This lateral analysis is a key initial step in incident response to assess the scope and identify compromised accounts or additional indicators of compromise (IoCs). Option E is correct because verifying whether the source IP belongs to an internal asset is critical to distinguish between an external attacker and a misconfigured internal service or user, which directly impacts the response strategy (e.g., internal remediation vs. external threat containment).

Exam trap

The trap here is that candidates often confuse immediate containment (blocking the IP) with proper triage, failing to recognize that validating the source IP's ownership and correlating logs across systems are essential first steps before any irreversible action is taken.

Full explanation →

350

MCQmedium

A CISO is presenting security metrics to the board. Which of the following metrics would be MOST relevant for a one-page executive dashboard?

A.Breach count and associated financial impact

B.Mean time to detect (MTTD) for incidents

C.Number of firewall rule changes per month

D.Percentage of employees who completed training

AnswerA

Directly relates to business risk and is easy to understand.

Why this answer

Executives need high-level summary metrics. Breach count is a lagging indicator that directly communicates security effectiveness to the board.

Full explanation →

351

Matchingmedium

Match each security metric to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Average time to detect an incident

Average time to remediate an incident

Average time between system failures

Contractual commitment for service levels

Indicator of risk level change

Why these pairings

Security metrics are used to measure different aspects of incident response and risk management. MTTD measures detection speed, MTTR measures response speed, MTBF measures system reliability, and ALE measures financial risk. Common confusions include swapping MTTD and MTTR definitions.

Full explanation →

352

MCQmedium

A CISO is evaluating the reporting structure for the information security team. Which reporting line is generally considered MOST effective for ensuring independence and organizational influence?

A.Report to the Chief Financial Officer (CFO)

B.Report to the Chief Information Officer (CIO)

C.Report to the board of directors or audit committee

D.Report to the Chief Operating Officer (COO)

AnswerC

This structure provides independence, authority, and visibility at the highest level.

Why this answer

Reporting to the board of directors or a board committee ensures security has a direct voice at the highest level, avoiding conflicts with IT or business operations.

Full explanation →

353

MCQmedium

An incident response team discovers that an attacker used stolen credentials to access a database. Which step is MOST critical during the eradication phase?

A.Reset all passwords and revoke certificates.

B.Implement multi-factor authentication.

C.Patch the database server.

D.Restore the database from backup.

AnswerA

Eliminates attacker's access using stolen credentials.

Why this answer

During the eradication phase, the primary goal is to remove all traces of the attacker's access and prevent immediate re-entry. Since the breach occurred via stolen credentials, resetting all passwords and revoking certificates ensures that the attacker can no longer authenticate using those compromised secrets, directly addressing the root cause of the initial access.

Exam trap

The trap here is that candidates confuse the eradication phase with the containment or recovery phase, choosing to patch or restore first, when the immediate priority is to invalidate the attacker's authentication tokens to prevent re-entry.

How to eliminate wrong answers

Option B is wrong because implementing multi-factor authentication (MFA) is a preventive control that should be applied during the recovery or improvement phase, not during eradication; it does not remove the attacker's existing access. Option C is wrong because patching the database server addresses a potential vulnerability but does not invalidate the stolen credentials that were already used to gain access. Option D is wrong because restoring the database from backup may remove malicious data or changes but does not revoke the stolen credentials, leaving the attacker with a potential backdoor if the backup contains the same credentials.

Full explanation →

354

MCQmedium

During a data breach investigation, the incident response team discovers that a backup was encrypted by ransomware. The team needs to determine the sequence of events leading to the encryption. Which of the following documentation is MOST critical to preserve for potential litigation?

A.The communication logs between team members

B.The chain of custody for the backup media

C.The forensic tools used in the investigation

D.The incident response plan version used during the incident

AnswerB

Chain of custody ensures evidence integrity.

Why this answer

Chain of custody documentation is essential to prove the integrity and admissibility of digital evidence in court.

Full explanation →

355

Multi-Selecteasy

Which TWO of the following are primary responsibilities of the board of directors in information security governance?

Select 2 answers

A.Approving the organization's information security risk appetite.

B.Implementing security controls to mitigate identified risks.

C.Designing the technical security architecture for the organization.

D.Holding executive management accountable for the effectiveness of the security program.

E.Conducting internal security audits of the information systems.

AnswersA, D

The board sets the risk appetite.

Why this answer

The board of directors is responsible for setting the organization's risk appetite, which defines the acceptable level of risk in information security. This is a strategic governance decision that guides all subsequent security activities. Approving the risk appetite ensures that security investments align with business objectives and regulatory requirements.

Exam trap

A common pitfall in CISM questions is confusing the board's strategic governance duties (approving risk appetite, holding management accountable) with management's operational tasks (implementing controls, designing architecture).

Full explanation →

356

MCQhard

A CISO is developing a multi-year security roadmap aligned with business strategy. The organization is in a highly regulated industry with frequent regulatory changes. Which of the following should be the PRIMARY driver for prioritizing security initiatives?

A.Reduction of the mean time to detect (MTTD) security incidents

B.Cost savings from consolidating security tools

C.Achieving a target capability maturity model (CMM) level

D.Alignment with current and upcoming regulatory requirements

AnswerD

Regulatory compliance is a critical business requirement; non-compliance can result in fines, legal action, and reputational damage.

Why this answer

While risk reduction is important, in a highly regulated environment with frequent changes, compliance alignment ensures the organization avoids legal penalties and maintains business continuity.

Full explanation →

357

MCQmedium

An organization has a decentralized security governance model. The CISO is struggling to enforce consistent security policies across business units. What is the BEST approach to improve consistency?

A.Allow each business unit to define its own security policies.

B.Implement a federated model where business units have complete autonomy.

C.Mandate that all business units adopt the same security tools and processes.

D.Establish a central security governance committee with representation from each business unit.

AnswerD

Balances consistency with business unit needs.

Why this answer

In a decentralized governance model, the best approach to enforce consistent security policies without undermining business unit autonomy is to establish a central security governance committee with representation from each business unit. This federated approach ensures that policies are collaboratively developed, agreed upon, and uniformly applied, leveraging cross-unit input to balance security requirements with operational needs. It directly addresses the CISO's enforcement challenge by creating a formal, inclusive decision-making body that drives policy standardization.

Exam trap

The trap here is that candidates often confuse a federated model (Option B) with a collaborative governance committee, but the key distinction is that a federated model grants complete autonomy without central coordination, whereas a committee provides structured representation to enforce consistency.

How to eliminate wrong answers

Option A is wrong because allowing each business unit to define its own security policies would perpetuate inconsistency and fragmentation, directly contradicting the goal of improving consistency. Option B is wrong because implementing a federated model where business units have complete autonomy would remove any central oversight, making it impossible to enforce uniform security standards across the organization. Option C is wrong because mandating that all business units adopt the same security tools and processes is a rigid, top-down approach that ignores unique unit requirements and operational contexts, likely leading to resistance and non-compliance rather than genuine consistency.

Full explanation →

358

MCQhard

After a merger, the combined organization has two different risk tolerance levels: one entity is risk-averse, the other is risk-taking. What is the best governance action?

A.Adopt the less restrictive risk tolerance

B.Maintain separate risk tolerance levels for each legacy entity

C.Adopt the more conservative risk tolerance across the board

D.Reassess risk appetite and approve a single unified statement

AnswerD

A unified risk appetite ensures consistent risk-taking aligned with strategic goals.

Why this answer

After a merger, maintaining two separate risk tolerance levels creates governance fragmentation and prevents a unified security posture. The correct action is to reassess the combined organization's risk appetite and approve a single unified statement, as this aligns with the CISM principle that risk governance must be cohesive across the entire enterprise. This ensures consistent risk management decisions, resource allocation, and policy enforcement, avoiding conflicts that could lead to security gaps or regulatory non-compliance.

Exam trap

The trap here is that candidates assume the more conservative risk tolerance is always safer, but CISM emphasizes that risk governance must be based on a deliberate reassessment of the new entity's combined risk appetite, not a simple default to the lowest common denominator.

How to eliminate wrong answers

Option A is wrong because adopting the less restrictive risk tolerance exposes the combined organization to unacceptable residual risk, potentially violating compliance requirements and increasing the likelihood of security incidents. Option B is wrong because maintaining separate risk tolerance levels for each legacy entity perpetuates siloed governance, leading to inconsistent security controls and conflicting risk decisions that undermine the merger's objective of unified operations. Option C is wrong because adopting the more conservative risk tolerance across the board may be overly restrictive, stifling business agility and innovation without considering the new entity's strategic objectives, and it fails to address the need for a deliberate reassessment of risk appetite.

Full explanation →

359

MCQeasy

A data breach has occurred exposing customer personal information. The risk manager needs to select a response to reduce the likelihood of similar incidents. Which risk response is most appropriate?

A.Avoid the risk by discontinuing online services

B.Transfer the risk through cyber insurance

C.Accept the risk

D.Mitigate the risk by implementing stronger access controls

AnswerD

Addressing the control weakness reduces the likelihood of similar incidents.

Why this answer

Mitigating the risk by implementing stronger access controls directly addresses the root cause and reduces the likelihood of future breaches. Accepting the risk is inappropriate when a breach has already occurred. Transferring via insurance only covers financial loss but does not reduce likelihood.

Avoiding by discontinuing online services is extreme and not immediately necessary.

Full explanation →

360

MCQmedium

During a security audit, several deviations from policy are found. What should the security manager do first?

A.Accept the risk and move on

B.Investigate the root cause of the deviations

C.Update the policies immediately

D.Take disciplinary action against responsible employees

AnswerB

Root cause analysis identifies systemic issues and informs corrective actions.

Why this answer

The security manager must first investigate the root cause of the deviations to understand why the policy was not followed. This aligns with the corrective action phase of the incident response lifecycle, where identifying the underlying issue (e.g., misconfigured access controls, lack of awareness, or technical gaps) is essential before implementing any remediation. Without root cause analysis, subsequent actions like policy updates or disciplinary measures may address symptoms rather than the actual problem, leading to recurring non-compliance.

Exam trap

The trap here is that candidates often jump to 'update the policy' (Option C) because they assume the policy is outdated, but CISM emphasizes that policy deviations are typically symptoms of deeper issues, and immediate updates without root cause analysis can create compliance gaps or bypass the formal policy lifecycle.

How to eliminate wrong answers

Option A is wrong because accepting risk without understanding the root cause violates the principle of risk management; deviations may indicate a systemic vulnerability that requires mitigation, not acceptance. Option C is wrong because updating policies immediately without investigating why the existing policy was bypassed could introduce new inconsistencies or fail to address the actual control failure (e.g., a misconfigured SIEM rule rather than a policy gap). Option D is wrong because taking disciplinary action before root cause analysis is premature and could demoralize staff if the deviation resulted from inadequate training, unclear policy language, or a technical flaw (e.g., a firewall rule that conflicts with the policy).

Full explanation →

361

Multi-Selecthard

An organization is implementing a security culture measurement program. Which THREE metrics would BEST indicate a positive security culture?

Select 3 answers

A.Percentage of employees completing security training

B.Incidents caused by human error

C.Time since last security audit

D.Near-miss reporting rate

E.Number of security incidents reported to management

AnswersA, B, D

High completion shows engagement and commitment to security.

Why this answer

A positive culture is reflected in proactive reporting, low error rates, and high engagement. Near miss reporting, training completion, and low human error incidents are key indicators.

Full explanation →

362

Multi-Selecthard

A security manager is designing a security budget for a mid-sized company. Which TWO of the following are typical components of a security budget?

Select 2 answers

A.Technology costs for security tools and infrastructure.

B.Legal fees for contract reviews.

C.Marketing budget for security awareness campaigns.

D.Office renovation for security operations center.

E.Personnel costs for security staff salaries and benefits.

AnswersA, E

Tools like SIEM, firewalls are necessary.

Why this answer

Security budgets typically include personnel costs (salaries) and technology costs (tools, software). Training and licensing are also common but may be subsumed under personnel or technology.

Full explanation →

363

MCQeasy

Which of the following is the primary purpose of an Information Security Program?

A.To implement the latest security technologies

B.To align security with business objectives and manage risk

C.To comply with all applicable regulations

D.To eliminate all security risks

AnswerB

Why this answer

The primary purpose of an Information Security Program is to align security initiatives with business objectives and manage risk to an acceptable level. While technology implementation, compliance, and risk elimination are components, they are means to the end of supporting the organization's mission and risk appetite. A program that does not align with business goals will lack executive support and fail to prioritize resources effectively.

Exam trap

ISACA often tests the misconception that an Information Security Program is primarily about technology or compliance, when in fact it is a governance mechanism to align security with business strategy and manage risk.

Why the other options are wrong

A

Technology is a tool, not the program's purpose.

C

Compliance is a component, not the primary purpose.

D

Eliminating all risks is impossible and impractical.

Full explanation →

364

MCQhard

You are the CISO of a large healthcare organization that has recently experienced a data breach due to an insider who exfiltrated patient data over several months. The breach was discovered by an external partner. The organization's information security program includes data loss prevention (DLP) tools, but they were not configured to monitor outbound data from the compromised system. Additionally, user activity monitoring (UAM) was only applied to privileged users, not to regular staff. The board demands a comprehensive improvement plan that will prevent similar incidents. However, there are concerns about employee privacy and budget constraints. The organization has a strong culture of trust and minimal monitoring. Which of the following should be the first priority in the revised program?

A.Expand user activity monitoring to all employees with a clear policy on privacy and acceptable use.

B.Implement stricter access controls and review user permissions quarterly.

C.Deploy a new DLP solution with advanced analytics and block all external data transfers.

D.Conduct additional security awareness training focused on insider threats.

AnswerA

Detects anomalous behavior; privacy guidelines address concerns.

Why this answer

Expanding user activity monitoring (UAM) to all users directly addresses the monitoring gap that allowed the exfiltration to go undetected for months. Implementing a clear policy on privacy and acceptable use balances security needs with employee privacy concerns. Option B (stricter access controls) is insufficient alone as it does not detect ongoing data exfiltration.

Option C (new DLP solution) could be helpful but may not catch slow, low-volume exfiltration and does not address the monitoring gap. Option D (security awareness training) is important but is a long-term preventive measure and does not immediately close the detection gap.

Full explanation →

365

MCQhard

A CISO is building a business case for a new security tool. Which of the following approaches is MOST effective for justifying the investment?

A.Highlighting that competitors are using the same tool

B.Comparing the tool's cost to industry averages for similar tools

C.Demonstrating how the tool reduces the likelihood and impact of a potential breach, translating to expected loss avoidance

D.Emphasizing the tool's advanced features and technical capabilities

AnswerC

This approach quantifies risk reduction and shows financial benefit.

Why this answer

Quantifying risk reduction in monetary terms directly links security investment to business value and risk management.

Full explanation →

366

MCQmedium

An organization is implementing a vendor risk management program. A vendor that provides cloud-based HR services will have access to employee PII. According to industry best practices, what should be the first step in the vendor lifecycle?

A.Include security requirements in the contract

B.Perform a risk assessment of the vendor

C.Request the vendor's SOC 2 report

D.Conduct an onsite audit of the vendor

AnswerB

Risk assessment is the first step to tier the vendor and scope due diligence.

Why this answer

The first step is to perform a risk assessment based on the vendor's data access and service criticality to determine the appropriate level of due diligence. This aligns with the NIST framework for third-party risk management.

Full explanation →

367

MCQmedium

An organization is implementing a security controls framework based on NIST SP 800-53. The CISO wants to prioritize controls that will provide the greatest risk reduction for critical assets. Which approach should be used to select the initial set of controls?

A.Select all controls from the framework to achieve full compliance.

B.Implement business-enabling controls before any other controls.

C.Apply the critical controls first, focusing on those that address the highest risks.

D.Choose compensating controls to replace all technical controls.

AnswerC

Critical controls provide the most risk reduction.

Why this answer

Applying critical controls first, such as those from the CIS Critical Security Controls, ensures that the most impactful controls are implemented early to reduce risk.

Full explanation →

368

MCQhard

An organization with a mature security program allocates 12% of its IT budget to security. Which factor is MOST likely to support this level of investment?

A.The organization is in a highly regulated industry with strict compliance mandates

B.The organization's IT budget is very large

C.The organization has a low number of security incidents historically

D.The organization has a high risk tolerance

AnswerA

Regulatory requirements often drive higher security spending.

Why this answer

A mature program typically invests 10-15% of IT budget. The key driver is the organization's risk appetite and compliance requirements, not just revenue percentage.

Full explanation →

369

MCQmedium

Which of the following is the PRIMARY role of the board of directors in information security governance?

A.Conducting daily security operations

B.Developing detailed security policies

C.Approving specific security technologies

D.Providing oversight and ensuring security is aligned with business strategy

AnswerD

Board oversight is a key governance responsibility.

Why this answer

The board sets the tone from the top and ensures security is integrated into organizational strategy and risk management.

Full explanation →

370

MCQhard

A financial institution has an incident involving a suspected data breach of customer PII. The incident response team contains the breach. What should be the NEXT priority according to legal and regulatory requirements?

A.Assess the extent of the breach.

B.Engage a public relations firm.

C.Notify affected customers.

D.Perform a root cause analysis.

AnswerA

Needed to determine legal notification requirements.

Why this answer

After containment, legal and regulatory requirements typically mandate assessing the scope and impact of the breach to determine notification obligations and regulatory reporting. This assessment is critical for prioritizing next steps such as customer notification (C) and public relations (B), which follow after the extent is known. Root cause analysis (D) is important but is a later step in the incident management process.

Full explanation →

371

MCQeasy

An organization's information security program recently experienced a ransomware attack that encrypted critical data. Which of the following program components should be improved first to prevent recurrence?

A.Develop an incident response plan specific to ransomware.

B.Conduct additional security awareness training on phishing.

C.Implement a robust backup and recovery process with offline copies.

D.Enhance network segmentation to isolate critical systems.

AnswerC

Effective backups ensure data can be restored without paying ransom.

Why this answer

While all options are valid security measures, the immediate priority after a ransomware attack that has already encrypted critical data is to ensure data resilience. A robust backup and recovery process with offline copies (e.g., immutable snapshots or air-gapped tape backups) directly addresses the core impact of ransomware by enabling restoration without paying the ransom. Without recoverable backups, even the best incident response plan or training cannot undo the encryption.

Exam trap

The trap here is that candidates often choose 'Develop an incident response plan' (A) because it sounds proactive, but the question asks for the component to improve first to *prevent recurrence*, and without recoverable backups, the organization remains vulnerable to the same data-loss impact regardless of the plan.

How to eliminate wrong answers

Option A is wrong because developing an incident response plan specific to ransomware is reactive and does not prevent the initial encryption; it focuses on containment and recovery after the fact, not on stopping the attack from succeeding. Option B is wrong because while phishing is a common vector, additional security awareness training alone cannot prevent all ransomware variants (e.g., drive-by downloads, exploit kits, or supply-chain attacks) and does not address the immediate need to recover encrypted data. Option D is wrong because network segmentation, though valuable for limiting lateral movement, does not prevent the initial encryption of data on the compromised system or provide a means to restore already encrypted files.

Full explanation →

372

MCQhard

The security analyst reviews the SIEM alert and finds that the source IP is from a trusted VPN broker used by remote employees. What is the most likely explanation for the alert?

A.The VPN broker itself is misconfigured

B.A legitimate user forgot their password

C.An attacker has compromised a remote employee's device and is brute-forcing the admin account

D.The alert is a false positive due to SIEM rule threshold

AnswerC

Source IP is VPN broker, but device behind it could be compromised.

Why this answer

A trusted VPN broker IP address in a SIEM alert for brute-force attempts against an admin account strongly indicates that an attacker has compromised a remote employee's device and is using the established VPN tunnel to launch the attack. The VPN broker itself is not misconfigured; rather, the attacker is leveraging the legitimate VPN connection to bypass perimeter defenses and target internal systems, making the alert a valid security incident.

Exam trap

The trap here is that candidates assume a trusted source IP (VPN broker) automatically means the traffic is legitimate, overlooking the common attack pattern where compromised endpoints are used to launch internal attacks from an authorized network path.

How to eliminate wrong answers

Option A is wrong because a misconfigured VPN broker would typically cause connectivity issues or authentication failures, not generate brute-force alerts against an admin account from a trusted IP. Option B is wrong because a legitimate user forgetting their password would result in a few failed login attempts, not a sustained brute-force pattern that triggers a SIEM alert. Option D is wrong because the alert is not a false positive; the SIEM rule threshold is correctly identifying anomalous brute-force behavior from a trusted source, which is a known attack vector.

Full explanation →

373

Multi-Selecteasy

Which THREE of the following are components of a security operations center (SOC)?

Select 3 answers

A.Vulnerability scanning

B.Response

C.Security monitoring

D.Security awareness training

E.Detection

AnswersB, C, E

Correct. SOC responds to incidents.

Why this answer

A SOC includes monitoring, detection, and response capabilities. Security awareness training is not a SOC function; it is part of the awareness program.

Full explanation →

374

MCQhard

A company wants to establish a security champions program. What is the primary benefit of embedding security champions in development teams?

A.Eliminating the requirement for a dedicated security team

B.Reducing the need for automated security testing tools

C.Reducing the frequency of penetration testing

D.Ensuring security is considered during the design and development phases

AnswerD

Champions advocate for security early in the SDLC.

Why this answer

Security champions act as liaisons, promoting secure coding practices and facilitating communication between security and development, thereby integrating security earlier.

Full explanation →

375

MCQmedium

During an incident investigation, the team discovers that a compromised account was used to exfiltrate data. Which of the following should the team do NEXT?

A.Determine the scope of the breach by analyzing accessed resources.

B.Reset the password and re-enable the account immediately.

C.Notify the affected users and customers.

D.Delete the compromised account from the system.

AnswerA

Correct. Determining the scope by analyzing accessed resources is the next step to understand the extent of data exfiltration and potential lateral movement, enabling effective containment.

Why this answer

The immediate priority after discovering a compromised account is to determine the scope of the breach by analyzing which resources the account accessed. This involves reviewing authentication logs, file access records, and data transfer logs to identify the extent of data exfiltration and potential lateral movement. Without this analysis, the team cannot contain the incident effectively or understand what data was compromised, which is a fundamental step in incident response per NIST SP 800-61.

Exam trap

The trap here is that candidates often confuse 'immediate containment' with 'immediate password reset or account deletion,' failing to recognize that the first step must be forensic analysis to understand the full impact before taking irreversible actions.

How to eliminate wrong answers

Option B is wrong because resetting the password and re-enabling the account immediately could allow the attacker to regain access if other persistence mechanisms (e.g., backdoor accounts, session tokens) are still active, and it bypasses the need to preserve forensic evidence. Option C is wrong because notifying affected users and customers should only occur after the scope is fully understood and containment is in place; premature notification can cause panic, legal exposure, and hinder the investigation. Option D is wrong because deleting the compromised account destroys forensic evidence (e.g., logs of lateral movement, privilege escalation) and may disrupt the investigation's ability to trace the attacker's actions or identify other compromised accounts.

Full explanation →

Page 5 of 12

All pages

1 2 3 4 5 6 7 8 9 10 11 12

Practice CISM by domain

Target a specific domain to shore up weak areas.

Information Security Governance Incident Management Information Security Programme Information Security Program Information Security Risk Management

See all domains with question counts →