871 questions total · 12pages · All types, answers revealed
In the incident response team structure, who is typically responsible for coordinating communication with external stakeholders such as customers and the media?
This role is dedicated to managing communications.
Why this answer
The communications lead handles external messaging to ensure consistency and accuracy.
Which of the following is the primary responsibility of the board of directors in information security governance?
Board sets risk appetite and provides oversight.
Why this answer
The board is responsible for oversight, ensuring security aligns with business strategy and risk appetite.
What is the PRIMARY purpose of a security champions program?
Champions help integrate security into daily work.
Why this answer
Security champions act as advocates within teams, promoting security practices and bridging the gap between security and development.
An organization is deciding whether to adopt a centralized or hybrid security governance model. Which factor MOST strongly favors a hybrid model?
Hybrid balances central control with unit flexibility.
Why this answer
A hybrid model allows business units to maintain some autonomy while benefiting from central standards and oversight.
Which TWO of the following are key performance indicators (KPIs) for measuring the effectiveness of an information security program?
Measures detection effectiveness.
Why this answer
Correct answers are B and D. Option B (Mean time to detect security incidents) directly measures detection effectiveness, a key performance indicator (KPI) for security program effectiveness. Option D (Percentage of critical systems patched within 30 days) measures the effectiveness of vulnerability management and protection.
Option A (Number of security policies approved) is a count of administrative actions, not a performance indicator. Option C (Employee satisfaction score) is a general HR metric unrelated to security performance. Option E (Percentage of security budget spent on tools) is a financial metric, not a measure of security program effectiveness.
A security manager is designing a metrics dashboard for the CISO. Which TWO metrics are leading indicators of security performance? (Select TWO)
Leading indicator of vulnerability management.
Why this answer
Phishing click rate and patch compliance are proactive measures that predict future risk, unlike breach count and MTTD which are lagging.
Which component of an incident response program is most likely to include step-by-step technical actions for addressing a specific type of security incident?
Playbooks contain detailed, step-by-step procedures for specific incident types.
Why this answer
An incident response playbook provides detailed, step-by-step technical procedures for handling specific incident types (e.g., ransomware, DDoS, phishing). Unlike higher-level documents, playbooks contain actionable commands, tool-specific instructions, and decision trees that guide responders through containment, eradication, and recovery. This granularity ensures consistent and efficient execution during an active security event.
Exam trap
ISACA CISM often tests the distinction between a plan (strategic, high-level) and a playbook (tactical, step-by-step), causing candidates to mistakenly choose the incident response plan because it sounds more comprehensive.
How to eliminate wrong answers
Option B (Communication templates) is wrong because they focus on predefined messaging for stakeholders (e.g., customers, regulators), not on technical remediation steps. Option C (Incident response policy) is wrong because it defines high-level governance, roles, and compliance requirements, not the tactical actions for a specific incident type. Option D (Incident response plan) is wrong because it outlines the overall organizational approach, escalation paths, and coordination procedures, but lacks the detailed, incident-specific technical steps found in a playbook.
After containing a security incident, the team conducts a root cause analysis. They find the breach originated from a compromised third-party vendor account. What is the most effective long-term mitigation?
Correct: Reduces risk of future compromises from vendor accounts.
Why this answer
Implementing vendor access reviews and enforcing MFA addresses the root cause of unauthorized access.
An organization has a mature security program but is experiencing an increase in successful social engineering attacks. The incident response team has confirmed that the attacks are bypassing current controls. What should the program manager do first?
Identifies gaps and informs control improvements.
Why this answer
A root cause analysis (RCA) is the correct first step because it identifies the specific weaknesses in people, processes, or technology that allowed the social engineering attacks to bypass existing controls. Updating the risk assessment based on RCA findings ensures that remediation efforts are prioritized against actual threats, rather than applying generic fixes. This aligns with the CISM principle that program management decisions must be data-driven and risk-based.
Exam trap
The trap here is that candidates often jump to a technical or training solution (B, C, or D) without first performing a root cause analysis, failing to recognize that the CISM framework requires a risk-based, diagnostic approach before implementing any control change.
How to eliminate wrong answers
Option B is wrong because implementing multi-factor authentication (MFA) for all systems is a broad technical control that does not address the root cause of social engineering—it may reduce credential theft but does not prevent manipulation of authorized users. Option C is wrong because disabling email links and attachments is a drastic, operational disruption that ignores other vectors (e.g., phone calls, SMS, in-person) and fails to address the underlying human or process gaps. Option D is wrong because increasing the frequency of security awareness training without first analyzing why current training failed may reinforce ineffective content; training must be tailored to the specific attack patterns identified in the RCA.
A company is designing its security awareness program. Which approach BEST addresses the need for role-based training?
Targets specific risks relevant to each role.
Why this answer
Role-based training tailors content to specific job functions, making it more relevant and effective.
A multinational corporation is designing its information security governance framework. The board has requested a single metric that best indicates the effectiveness of the security program. Which metric would BEST satisfy this request?
This directly measures the effectiveness of the security program.
Why this answer
The best metric because it directly measures whether security controls are functioning as designed, which is the ultimate indicator of security program effectiveness. Unlike input or activity metrics, this outcome-based metric validates that controls achieve their intended purpose, aligning with the board's need for a single, high-level effectiveness measure.
Exam trap
The trap here is that candidates often confuse activity or compliance metrics (like baseline compliance or incident counts) with effectiveness metrics, failing to recognize that the board needs a direct measure of whether controls actually work, not just that they exist or are followed.
How to eliminate wrong answers
Option A is wrong because compliance with a security baseline measures adherence to a standard, not the actual effectiveness of the security program; a system can be compliant yet still be vulnerable if the baseline is outdated or insufficient. Option B is wrong because the number of security incidents reported per month is a lagging indicator that can be influenced by reporting culture and detection capabilities, not a direct measure of control effectiveness. Option C is wrong because mean time to detect (MTTD) measures detection speed, not whether controls prevent or mitigate events; a short MTTD does not indicate that controls are achieving their intended outcomes.
An organization is updating its incident response plan after a major incident. Which post-incident activity should be performed to ensure the plan reflects lessons learned?
Directly incorporating lessons learned into the plan is essential.
Why this answer
Updating the IR plan and playbooks based on lessons learned is the definitive post-incident activity that directly incorporates findings from the after-action review into the operational documentation. This ensures the plan reflects actual gaps or improvements identified during the incident, making it actionable for future events. Without this update, the plan remains static and fails to evolve with the organization's threat landscape.
Exam trap
The trap here is that candidates confuse 'revising the IR policy' (a high-level governance document) with 'updating the IR plan and playbooks' (the operational, detailed documentation that directly incorporates lessons learned), leading them to choose the broader, less actionable option.
How to eliminate wrong answers
Option B is wrong because sharing indicators of compromise with an ISAC is a threat intelligence sharing activity that supports broader community defense, not a post-incident activity to update the organization's own IR plan. Option C is wrong because revising the IR policy is a higher-level governance change that typically occurs less frequently and is not the immediate step for capturing specific operational lessons learned from a single incident. Option D is wrong because conducting a tabletop exercise is a proactive testing activity used to validate the plan, not a post-incident activity to document and apply lessons learned from a real incident.
During the eradication phase of an incident response, which action is MOST critical to ensure the threat is fully removed?
Only way to guarantee removal of persistent threats.
Why this answer
Reimaging all affected systems from known-good backups is the most critical action during the eradication phase because it ensures complete removal of the threat, including any rootkits, persistence mechanisms, or hidden malware that may survive simple file deletion or signature-based scans. This approach eliminates the risk of residual compromise, as the system is restored to a trusted state from a verified backup, which is essential for environments where the integrity of the operating system and applications cannot be guaranteed after an incident.
Exam trap
The trap here is that candidates often choose to delete malware files or update antivirus signatures because they focus on the immediate threat removal, but fail to recognize that these actions cannot guarantee complete eradication of deeply embedded or persistent malware, which is why reimaging is the definitive step in the eradication phase.
How to eliminate wrong answers
Option A is wrong because simply deleting malware files does not remove registry entries, scheduled tasks, or other persistence mechanisms that may re-infect the system, and it fails to address potential rootkits that hide files from the operating system. Option B is wrong because resetting passwords is a containment and recovery action that addresses credential compromise, but it does not remove the threat itself; the attacker's backdoor or malware may still be present on the system. Option C is wrong because updating antivirus signatures is a preventive measure that helps detect known threats, but it does not guarantee removal of unknown or polymorphic malware, and it cannot clean systems that have been deeply compromised at the kernel level.
Which TWO of the following are key components of an information risk management program, as defined by ISACA? (Select exactly two.)
Risk appetite defines the amount of risk the organization is willing to accept, essential for risk management.
Why this answer
Options B and D are correct. Risk appetite and tolerance (B) define the organization's willingness to accept risk, and a risk assessment methodology (D) provides the structured approach to identify, analyze, and evaluate risks. Business continuity planning (A) is a separate domain focused on incident recovery, not a core component of risk management.
Data classification (C) is part of information security governance, not risk management program components. Vulnerability scanning (E) is a technical control activity, not a program-level component.
Which document should be created FIRST when establishing an information security program?
Why this answer
The information security policy is the foundational document that establishes management's intent, direction, and support for the security program. It defines the scope, objectives, and responsibilities, and all other security documents (risk assessments, incident response plans, BCPs) derive their authority and alignment from this policy. Without an approved policy, subsequent activities lack governance and executive backing.
Exam trap
ISACA often tests the sequence of program development, and the trap here is that candidates mistake a risk assessment (Option B) as the first step because it seems logical to 'know your risks first,' but the policy must precede it to define the risk management framework and governance.
Why the other options are wrong
Risk assessment is informed by policy.
Incident response is a later operational plan.
BCP is related but separate and typically follows policy.
A company is assessing the risk of a critical system outage. The system has a maximum tolerable downtime (MTD) of 2 hours, but the current recovery time objective (RTO) is 4 hours. What is the most appropriate risk treatment?
Reducing RTO to below MTD is the correct mitigation.
Why this answer
The current RTO of 4 hours exceeds the MTD of 2 hours, meaning the system cannot be restored within the maximum tolerable downtime, resulting in unacceptable business impact. Reducing the RTO to 1 hour through process automation brings recovery time well within the MTD, effectively mitigating the risk to an acceptable level. This aligns with the risk management principle of applying controls to close the gap between RTO and MTD.
Exam trap
The trap here is that candidates mistakenly think accepting risk is valid when RTO is shorter than MTD, but the question presents the opposite scenario (RTO > MTD), making acceptance inappropriate; ISACA often tests this precise reversal to catch those who confuse RTO and MTD relationships.
How to eliminate wrong answers
Option B is wrong because transferring risk via business interruption insurance does not address the fundamental issue that the system cannot be restored within the MTD; insurance compensates for financial loss but does not prevent operational impact or data loss during the outage. Option C is wrong because accepting the risk is only appropriate when the RTO is shorter than the MTD, but here the RTO (4 hours) is longer than the MTD (2 hours), creating an unacceptable risk exposure. Option D is wrong because avoiding the risk by replacing the system is an extreme and costly measure that is not necessary when a less disruptive mitigation (reducing RTO) can achieve compliance with the MTD.
Which of the following are key components of an effective information security program? (Select TWO.)
Why this answer
A risk management framework is a key component because it provides a structured, repeatable process for identifying, assessing, and mitigating information security risks. It ensures that security investments and controls are aligned with business objectives and risk appetite, rather than being ad hoc or technology-driven. Without a risk management framework, an information security program lacks the foundational governance to prioritize threats and allocate resources effectively.
Exam trap
The trap here is that candidates often mistake operational components (like a SOC or advanced tools) or compliance outcomes as foundational pillars, whereas CISM emphasizes that governance through a risk management framework and the human element via security awareness are the true core components of a sustainable program.
Why the other options are wrong
Tools are important but not a key component; the program must include processes and people.
Size is not a key component; effectiveness matters more.
Compliance is a goal, not a component of the program itself.
Which component of an incident response programme provides detailed step-by-step instructions for handling a specific type of incident?
Playbooks provide detailed procedures tailored to each incident type, such as ransomware or data breach.
Why this answer
Playbooks are specific to incident types (e.g., ransomware) and provide step-by-step guidance, whereas the IR plan is a high-level document and policy sets overall intent.
Which TWO of the following are PRIMARY goals of incident management according to industry best practices?
Timely restoration is a primary objective.
Why this answer
The primary goal of incident management is to restore normal service operations as quickly as possible, minimizing the impact on business operations. This aligns with ITIL and NIST best practices, which prioritize rapid containment and recovery over other activities like documentation or investigation.
Exam trap
The trap here is that candidates often confuse 'documentation' or 'compliance' as primary goals, but ISACA CISM emphasizes that operational restoration and business disruption minimization are the top priorities, with documentation being a supporting process that must not delay recovery.
Which role is primarily responsible for designing and reviewing an organization's security architecture?
Correct. The security architect designs the security architecture.
Why this answer
The security architect designs and reviews security architecture to ensure it aligns with business requirements and security standards.
A CISO is developing key risk indicators (KRIs) for the security programme. Which TWO of the following are lagging indicators? (Select TWO.)
Breaches are outcomes of past failures.
Why this answer
Lagging indicators measure past performance or outcomes. Number of data breaches and mean time to respond (MTTR) are outcome and efficiency metrics that reflect past events. Patch compliance and phishing click rate are leading indicators.
A multinational organization must comply with GDPR, CCPA, and PCI DSS. Which approach is MOST effective for managing these overlapping requirements?
A unified framework streamlines compliance and reduces redundancy.
Why this answer
A unified compliance framework reduces duplication and ensures consistent control application across regulations.
Which of the following BEST describes the role of a security architect in a security program?
Architects focus on design and integration.
Why this answer
The security architect designs security structures and ensures controls are integrated into systems and networks.
During the detection and analysis phase of incident response, which two activities are essential? (Choose two.)
Correct: Critical for detection.
Why this answer
Options A and E are correct because identifying indicators of compromise and determining the scope of the incident are key activities during the detection and analysis phase. Option C (notifying regulatory bodies) occurs later, typically after containment and eradication. Restoration (B) and patching (D) are part of the recovery phase.
In a security awareness program, which training approach is most appropriate for software developers?
Correct. Developers should be trained on secure coding to prevent vulnerabilities.
Why this answer
Developers need secure coding training to address vulnerabilities in code they write. Role-based training ensures relevance and effectiveness.
An organization's board of directors wants to ensure that security activities align with business objectives. Which governance practice best supports this alignment?
Correct: Roadmap explicitly aligns with business objectives.
Why this answer
A security strategy that directly references business goals ensures that security investments and initiatives support organizational priorities.
Which of the following is the PRIMARY responsibility of the board of directors regarding information security governance?
The board provides strategic direction and oversight, ensuring alignment with business goals.
Why this answer
The board is responsible for ensuring that information security is aligned with business objectives and that adequate resources are allocated.
During a P1 incident involving a ransomware attack, the crisis management team has been activated. The communications lead is drafting an all-staff internal communication. Which of the following should be INCLUDED in this communication?
This provides actionable guidance to mitigate further spread.
Why this answer
Internal communications during an incident should provide clear guidance to employees on actions they need to take, such as not connecting devices, while avoiding speculation or blame.
Which of the following best describes a key benefit of a centralized information security governance model?
Centralization ensures uniformity.
Why this answer
Centralized models provide consistent application of controls and policies across the organization.
A company's security program includes a set of controls based on a risk assessment. During an audit, several controls are found to be ineffective. What should the security manager do first?
Identifies systemic gaps; allows effective remediation.
Why this answer
When controls are found ineffective, the security manager must first conduct a root cause analysis to identify why the controls failed. This aligns with the CISM's emphasis on corrective action based on understanding the underlying failure, such as misconfigured firewall rules, outdated signature databases, or improper access control lists (ACLs). Without this analysis, any subsequent remediation (like implementing compensating controls or increasing testing frequency) may address symptoms rather than the actual cause, leading to recurring failures.
Exam trap
The trap here is that candidates often jump to 'implement compensating controls' (Option D) as a quick fix, but CISM emphasizes that the first step must always be to understand the failure through root cause analysis before selecting any corrective action.
How to eliminate wrong answers
Option B is wrong because increasing the frequency of control testing does not fix the underlying failure; it only detects the same failure more often, wasting resources without addressing the root cause (e.g., a flawed SIEM correlation rule or a misapplied patch). Option C is wrong because reporting findings and accepting risk prematurely bypasses the obligation to first investigate and remediate the control failure; risk acceptance is a decision made after understanding the failure's impact and likelihood, not as an immediate first step. Option D is wrong because implementing compensating controls immediately may introduce new complexity or false sense of security without knowing why the original controls failed (e.g., adding a WAF without fixing a broken IDS rule could leave other attack vectors open).
A company's information security manager notices that several business units have implemented shadow IT systems that bypass the central security governance. Which of the following governance strategies would most effectively address this issue in the long term?
This balances security with business agility and maintains governance visibility.
Why this answer
Establishing a formal exception process with risk acceptance allows business units to innovate while maintaining security governance. This approach addresses shadow IT by integrating it into formal oversight rather than punishing or ignoring it. Option A is incorrect because penalizing non-compliant units may drive shadow IT further underground, reducing visibility.
Option B is incorrect because deploying a CASB is a technical control that helps discover and manage shadow IT, but it does not address the root governance issue of why business units bypass central IT. Option C is incorrect because a strict prohibition policy is difficult to enforce and may hinder business agility, leading to further shadow IT.
During a P1 incident, the incident response manager is preparing an executive sitrep. Which of the following should be included to preserve legal privilege?
This helps assert attorney-client privilege.
Why this answer
Involving legal counsel in communications can help preserve attorney-client privilege. The sitrep should avoid speculation and include legal counsel input.
Based on the exhibit, which of the following is the MOST likely attack vector?
The logs show signs of root-level access.
Why this answer
The exhibit shows a user account with administrative privileges being used from an unusual geographic location at an anomalous time, followed by lateral movement to a domain controller. This pattern indicates that the initial access was gained through a compromised account, which was then leveraged for privilege escalation to move laterally and access sensitive systems. The attack vector is the misuse of valid credentials, not an injection or social engineering attack.
Exam trap
ISACA often tests the distinction between the initial infection vector (e.g., phishing) and the attack vector used for lateral movement (e.g., compromised credentials), leading candidates to confuse the method of initial access with the method of privilege escalation.
How to eliminate wrong answers
Option A is wrong because SQL injection attacks target web application databases by inserting malicious SQL queries, and the exhibit shows no evidence of web application logs or database error messages; instead, it shows authentication events and lateral movement. Option C is wrong because a phishing email with a malicious attachment would typically result in malware execution or credential harvesting, but the exhibit shows direct use of a legitimate account without any indication of a phishing campaign or attachment download. Option D is wrong because a denial of service attack aims to overwhelm resources and disrupt availability, whereas the exhibit shows successful authentication and lateral movement, indicating an active compromise rather than a service disruption.
A security program manager is selecting metrics to report to the board. Which THREE metrics provide the BEST indication of the program's effectiveness?
Compliance with security baseline shows control implementation and reduces risk.
Why this answer
Percentage of systems compliant with baseline (Option C) directly measures the organization's adherence to security configuration standards, which is a leading indicator of control effectiveness. A high compliance rate reduces the attack surface and demonstrates that foundational security controls are properly implemented, making it a key metric for board-level reporting on program success.
Exam trap
The trap here is confusing input metrics (budget spent) or reactive metrics (incident count) with outcome-based metrics that directly measure control effectiveness, leading candidates to overlook that compliance and training are proactive indicators of program maturity.
An information security manager is designing a metrics program to report to the board. Which of the following metrics would be MOST meaningful to the board?
Why this answer
The board is primarily concerned with strategic risk posture and business impact. Percentage of systems with critical vulnerabilities directly quantifies the organization's exposure to high-severity threats, enabling informed risk acceptance or remediation decisions. This metric aligns with the board's fiduciary duty to oversee risk management, unlike operational details such as incident counts or training completions.
Exam trap
The trap here is that candidates confuse operational metrics (e.g., patch time, training completions) with strategic risk indicators, assuming the board wants to see activity volume rather than residual risk exposure.
Why the other options are wrong
Lagging indicator; board prefers leading indicators of risk.
Operational detail; not strategic.
Activity metric, not outcome.
Which of the following is the BEST example of a board-level security metric?
This metric helps the board understand the return on security investments and the value of preventing losses.
Why this answer
Board-level metrics should reflect impact on business objectives and financial performance. Investment vs. loss avoidance directly ties security spending to business value.
After a phishing attack, an organization's incident response team identifies that the attacker gained access to an email account and sent internal spear-phishing emails. What is the BEST immediate containment action?
Immediately disabling the account stops further abuse.
Why this answer
Disabling the compromised account immediately stops the attacker from using the authenticated session to send further internal spear-phishing emails. This containment action directly cuts off the attacker's foothold within the email system, preventing lateral movement and further compromise of other users. It is the fastest way to halt the ongoing attack without disrupting the entire user base.
Exam trap
The trap here is that candidates often choose 'Reset all user passwords' thinking it is a comprehensive security measure, but it fails to immediately terminate the attacker's active session and can cause operational chaos, whereas disabling the compromised account is the precise, immediate containment step required in incident response.
How to eliminate wrong answers
Option B is wrong because resetting all user passwords is a broad, disruptive action that does not immediately stop the attacker's active session; the attacker could continue sending emails until the password change propagates, and it may cause unnecessary downtime for legitimate users. Option C is wrong because the attacker is using a legitimate internal email account, so blocking an external IP address at the firewall does not prevent the attacker from sending emails from within the organization's own mail server. Option D is wrong because increasing email filtering rules is a preventive measure that does not stop an already-compromised account from being used; the attacker can bypass filters by sending emails internally, which often bypass external filtering rules.
Which of the following is the FIRST step in the security policy development lifecycle?
Gap analysis determines what policies are needed.
Why this answer
A gap analysis identifies current state vs. desired state, which is necessary before drafting policy.
Which of the following are key components of an information security program? (Select TWO)
Why this answer
A set of security policies and standards is a key component because it establishes the governance framework that defines acceptable use, access control, and compliance requirements for the entire organization. Without documented policies and standards, the security program lacks the authoritative baseline to enforce controls or measure effectiveness. These documents are the foundation for all other security activities, including training, audits, and incident response.
Exam trap
The trap here is that candidates often confuse operational artifacts (like network diagrams or logs) with programmatic components, failing to recognize that the core of an information security program is the governance and risk management framework, not the technical outputs or diagrams.
Why the other options are wrong
This is a technical artifact, not a core program component.
This is an operational record, not a program component.
An organization's information security program has been operational for two years. The security manager is asked to propose changes to improve effectiveness. Which approach should the manager take first?
Why this answer
Before making any changes, the security manager must first understand the current state of the program. A maturity assessment (e.g., using the CMMI or COBIT framework) evaluates the effectiveness, gaps, and capability levels of existing processes and controls. This baseline ensures that subsequent improvements are targeted and justified, rather than arbitrary or misaligned with the organization's actual needs.
Exam trap
ISACA often tests the principle that assessment must precede action; the trap here is that candidates may jump to implementing controls or revising policies as a quick fix, ignoring the foundational step of measuring current maturity to ensure changes are evidence-based and effective.
Why the other options are wrong
This may introduce unnecessary controls without understanding existing gaps.
Training is important but not the first step; assessment should precede resource allocation.
Policy revision may be needed, but first understand the program's strengths and weaknesses.
Arrange the steps for deploying a security patch to critical servers in a production environment.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Patch management involves identification, testing, backup, deployment, and verification.
During a P1 (critical) incident involving a ransomware attack that has encrypted critical systems, the incident manager needs to provide updates to executives. What is the recommended frequency for situation reports (sitreps)?
Hourly sitreps are standard for P1 incidents to provide timely updates.
Why this answer
For P1 incidents, hourly sitreps keep executives informed of rapidly evolving situations.
Arrange the steps for performing a vulnerability scan on a network segment.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Vulnerability scanning requires authorization, configuration, execution, analysis, and prioritization.
During a security incident, the incident response team discovers that an attacker used a previously unknown vulnerability (zero-day) in a widely used software. Which action should the team take to address this vulnerability in the short term?
Virtual patching blocks exploit attempts while waiting for a permanent fix.
Why this answer
A virtual patch via an IPS provides immediate, temporary protection against a zero-day vulnerability by inspecting traffic for exploit patterns or anomalous behavior and blocking malicious payloads before they reach the vulnerable software. This buys time for the organization to assess the risk and plan a permanent fix without disrupting operations, as the IPS can be updated with signatures or rules specific to the newly discovered vulnerability.
Exam trap
The trap here is that candidates often confuse 'short-term' with 'permanent' solutions, mistakenly choosing D (vendor patch) as the immediate action, when in fact the correct short-term response is to implement a compensating control like a virtual patch to reduce risk while awaiting the vendor's official fix.
How to eliminate wrong answers
Option B is wrong because recompiling the software with additional security controls is not feasible for a zero-day vulnerability in a widely used commercial or third-party application, as the source code is typically unavailable and recompilation would require extensive development, testing, and deployment time, making it impractical for short-term response. Option C is wrong because immediately disabling the software across the organization would cause significant operational disruption and is an overly drastic measure that should only be considered if the vulnerability is actively exploited and no other mitigation exists, not as a first short-term action. Option D is wrong because deploying a vendor patch as soon as it becomes available is a long-term remediation step, not a short-term action; the vendor patch may take days or weeks to develop and test, leaving the organization exposed in the interim.
An organization's incident response plan includes a call tree. During an incident, the primary contact is unreachable. What should happen?
Correct: The call tree is designed with alternates.
Why this answer
A call tree is designed to ensure rapid, sequential notification during an incident. If the primary contact is unreachable, the plan should automatically move to the next person in the call tree to maintain the speed and reliability of the notification process. This avoids delays that could compromise incident response SLAs.
Exam trap
The trap here is that candidates may think waiting or escalating is safer, but the core of incident management is to maintain the notification chain without delay, so moving to the next person in the call tree is the correct action per standard incident response frameworks.
How to eliminate wrong answers
Option A is wrong because escalating to senior management bypasses the call tree's purpose of rapid, tiered notification and may overload management with routine notifications. Option B is wrong because using a different communication method like email does not solve the unreachability of the primary contact and can introduce delays or missed notifications. Option C is wrong because waiting for the primary to become available violates the incident response principle of timely action and could allow the incident to escalate.
Which of the following is a leading indicator of security program effectiveness?
Correct. Phishing click rate is a leading indicator that measures current user susceptibility.
Why this answer
Leading indicators are proactive measures that predict future performance. Phishing click rate is a leading indicator because it measures current user behavior that can be improved before an incident occurs.
Which TWO of the following are key components of a risk assessment report according to best practices? (Choose two.)
Risk scenarios with assessments are central to a risk assessment report.
Why this answer
Risk scenarios with likelihood and impact ratings are a core component of a risk assessment report because they provide a structured narrative of how a threat could exploit a vulnerability, enabling the organization to prioritize risks based on quantitative or qualitative measures. This aligns with ISACA's best practices for risk communication, ensuring decision-makers understand the potential business impact.
Exam trap
The trap here is that candidates often confuse the risk assessment report's output (risk scenarios and treatment recommendations) with inputs or supporting data (vendor ratings, control testing details, asset inventory), leading them to select options that are part of the process but not the final report.
A company is implementing a risk management program and needs to identify the most critical assets. Which of the following is the BEST approach to prioritize assets for risk assessment?
Assessing business impact directly ties to criticality and is the best method for prioritization.
Why this answer
The best approach to prioritize assets for risk assessment is to assess the business impact of each asset's compromise because risk management focuses on the potential harm to business objectives, not on financial cost or technical vulnerabilities. Business impact analysis (BIA) evaluates criticality based on factors like revenue loss, regulatory penalties, and operational downtime, directly aligning asset priority with organizational risk appetite.
Exam trap
The trap here is that candidates often confuse 'asset value' with 'purchase cost' (Option A) or mistake technical severity (Option C) for business criticality, failing to recognize that risk management prioritization must be driven by business impact analysis, not by financial or technical metrics alone.
How to eliminate wrong answers
Option A is wrong because purchase value does not reflect the asset's criticality to business operations; a low-cost server hosting a critical database may have far higher impact than an expensive but non-essential workstation. Option C is wrong because vulnerability scan findings indicate technical weaknesses but ignore the business context; a high-severity vulnerability on a low-impact asset may be less urgent than a medium-severity vulnerability on a mission-critical system. Option D is wrong because historical incident reports only show past events, which may not capture emerging threats or changes in asset criticality, and can lead to reactive rather than proactive prioritization.
A financial institution is implementing a new online banking platform. The risk assessment identified that the authentication module has a high likelihood of exploitation due to weak password policies. The risk owner has decided to implement multi-factor authentication (MFA) to reduce the risk. This is an example of which risk response strategy?
MFA reduces the likelihood or impact of the risk, which is the definition of risk mitigation.
Why this answer
Implementing multi-factor authentication (MFA) reduces the likelihood or impact of a security risk by adding additional authentication factors (e.g., something you know, something you have, something you are) beyond a weak password. This directly aligns with risk mitigation, which seeks to decrease the residual risk to an acceptable level through controls. The decision does not eliminate the risk entirely (avoidance), accept it without action, or transfer it to a third party.
Exam trap
The trap here is that candidates confuse 'risk mitigation' with 'risk avoidance' because both involve implementing controls, but avoidance means eliminating the activity or technology entirely, whereas mitigation reduces but does not eliminate the risk.
How to eliminate wrong answers
Option A is wrong because risk avoidance would mean not implementing the online banking platform or removing the authentication module entirely, which is not the case. Option C is wrong because risk acceptance would involve acknowledging the risk and taking no further action, whereas MFA is an active control. Option D is wrong because risk transfer would involve shifting the financial impact of the risk to another party (e.g., via insurance or outsourcing), not implementing a technical control like MFA.
Which TWO elements are key components of a security culture measurement program?
Indicates user awareness and behavior.
Why this answer
Phishing simulation click rates and training completion rates are common quantitative measures of security culture.
A CISO is designing the security organization for a financial services firm. Which reporting structure is most likely to ensure the independence and authority of the information security function?
Provides independence and authority, aligning security with business strategy.
Why this answer
Reporting to the CEO or board provides independence from operational pressures, allowing the CISO to enforce security without conflict of interest. Reporting to the CIO can create conflicts, as security may be subordinated to IT goals. Reporting to legal or risk committees may lack operational authority.
After a data breach, the risk manager discovers that the risk assessment for the affected system had not been updated for two years. The organization's risk management policy requires annual reviews. Which of the following is the MOST significant consequence of this noncompliance?
An outdated risk assessment misrepresents current risks, impairing decision-making.
Why this answer
C is correct because the primary purpose of a risk assessment is to provide an accurate, current risk profile that informs security decisions and resource allocation. When the assessment is two years out of date, the organization lacks visibility into new threats, vulnerabilities, and changes in the threat landscape, leading to uninformed decisions that can result in security gaps and increased exposure. This directly undermines the risk management process, making it the most significant consequence of noncompliance with the annual review policy.
Exam trap
The trap here is that candidates often focus on tangible, immediate consequences like fines or audit findings, but CISM emphasizes that the most significant impact of noncompliance is the erosion of the risk management process itself—specifically, the inability to make informed decisions based on an accurate risk profile.
How to eliminate wrong answers
Option A is wrong because increased audit findings are a secondary outcome of noncompliance, not the most significant consequence; audits may flag the missing review, but the core harm is the degraded decision-making capability. Option B is wrong because regulatory fines for noncompliance depend on specific legal or contractual requirements (e.g., GDPR, PCI DSS), and while possible, they are not guaranteed and are less impactful than the systemic failure to maintain an accurate risk profile. Option D is wrong because higher insurance premiums may result from a poor risk posture, but they are a financial consequence that follows from the underlying inaccurate risk profile, not the primary risk management failure itself.
An organization is required to report a material cybersecurity incident to the SEC within 4 business days (proposed rule). However, the incident is still under investigation. What is the BEST course of action?
This complies with the deadline while managing accuracy.
Why this answer
Regulatory deadlines must be met even if information is incomplete; disclose what is known and update later.
An organization is developing a new information security program and wants to ensure it aligns with business objectives. Which of the following is the MOST critical first step?
Aligning with business strategy ensures security enables rather than hinders the business.
Why this answer
Identifying business strategy and risk appetite is the most critical first step because the information security program must be designed to support the organization's objectives and operate within the risk tolerance defined by leadership. Without this alignment, subsequent security controls and investments may conflict with business goals or fail to address the risks the organization is willing to accept. This ensures that security is a business enabler rather than a technical silo.
Exam trap
The trap here is that candidates often mistake conducting a comprehensive risk assessment (Option D) as the first step, but without a defined risk appetite and business strategy, the assessment lacks the context needed to evaluate risk severity and prioritize remediation effectively.
How to eliminate wrong answers
Option A is wrong because developing a security awareness training program is an operational control that should be implemented only after the program's strategic direction, risk appetite, and governance structure are defined; starting with training assumes a baseline of security culture that does not yet exist. Option C is wrong because designing security architecture based on industry frameworks (e.g., NIST, ISO 27001) without first understanding the business strategy and risk appetite can lead to over-engineering or misalignment, wasting resources on controls that do not address the organization's specific risk profile. Option D is wrong because conducting a comprehensive risk assessment requires a predefined risk appetite and business context to determine which risks are acceptable and which require mitigation; without this, the assessment lacks the criteria to prioritize findings effectively.
Which THREE of the following are best practices for handling evidence during an incident investigation?
Documentation ensures reproducibility and legal admissibility.
Why this answer
Documenting all actions taken during evidence collection ensures the integrity and admissibility of evidence in legal proceedings. This documentation, often referred to as a 'paper trail' or 'audit log,' must include timestamps, personnel involved, tools used, and any deviations from standard procedures. Without this, the chain of custody is weakened, and the evidence may be challenged as unreliable or tampered with.
Exam trap
The trap here is that candidates may confuse 'analyze evidence directly on live systems' (Option C) as acceptable for speed, but CISM emphasizes preservation of evidence integrity over expedience, and 'store evidence in its original location' (Option E) may seem logical but violates the principle of securing evidence in a controlled chain of custody.
A CISO is evaluating metrics for an executive security report. Which TWO of the following are lagging indicators?
Measures past detection performance.
Why this answer
Lagging indicators reflect past incidents or performance. Breach count and mean time to detect (MTTD) are outcome-based metrics that show what has already happened.
An organization's incident response team has contained a ransomware incident. What is the NEXT step according to the incident management program?
Eradication and recovery follow containment in the incident response lifecycle.
Why this answer
After containment, the next priority is eradication of the threat to remove all traces of the malware and restore systems securely.
Which host should be prioritized for risk mitigation based on the vulnerability scan results?
Highest count of critical and high vulnerabilities.
Why this answer
Host 192.168.10.35 is prioritized because it has the highest number of critical vulnerabilities (e.g., CVE-2023-XXXX with CVSS 9.8) and is exposed to the internet, increasing the likelihood of exploitation. Risk mitigation prioritization is based on the combination of vulnerability severity, asset criticality, and threat exposure, not just vulnerability count.
Exam trap
The trap here is that candidates often assume all vulnerabilities should be treated equally or that the host with the most vulnerabilities is always the highest priority, ignoring the criticality of the asset and the exploitability of the vulnerabilities.
How to eliminate wrong answers
Option A is wrong because 192.168.10.25 has fewer critical vulnerabilities and is isolated on a private subnet, reducing its risk exposure. Option C is wrong because risk mitigation should be prioritized based on risk level, not equal treatment; hosts with higher risk (e.g., internet-facing with critical CVEs) require immediate attention. Option D is wrong because 192.168.10.30, despite having some vulnerabilities, has a lower CVSS score average and is not internet-facing, making it a lower priority than 192.168.10.35.
During incident response, a forensic investigator needs to collect evidence from a compromised server. Which action BEST preserves evidence integrity?
Hard power loss freezes volatile memory and stops all processes.
Why this answer
Pulling the power cord (Option C) is the best action because it immediately halts all system processes and prevents any further writes to the disk, preserving the exact state of the storage media at the time of incident. This method avoids the risk of the operating system altering metadata, logs, or file timestamps during a graceful shutdown, which could compromise forensic integrity. It also ensures that volatile memory (RAM) content is lost, but for disk-based evidence, this is the standard approach to maintain a pristine bit-for-bit copy.
Exam trap
The trap here is that candidates often choose a graceful shutdown (Option A) thinking it is safer, but CISM emphasizes that any OS-level action can alter evidence, and the hard power-off is the only way to guarantee the disk is frozen in its current state.
How to eliminate wrong answers
Option A is wrong because a graceful shutdown triggers the OS to write cached data, update logs, and modify file system metadata (e.g., last access times), which can destroy or alter evidence. Option B is wrong because a network-based image requires the server to be running and communicating over the network, which can change volatile data and risks contamination from network traffic or remote manipulation. Option D is wrong because copying files to an external drive modifies file metadata (e.g., access timestamps) and may skip hidden or locked files, failing to capture the full disk image needed for forensic analysis.
What is the primary function of a Security Operations Center (SOC)?
SOC analysts monitor alerts and respond to incidents.
Why this answer
A SOC is responsible for monitoring, detecting, and responding to security incidents.
Which THREE are key performance indicators (KPIs) for an information security program?
Training coverage indicates program reach.
Why this answer
The percentage of employees trained is a key performance indicator (KPI) because it directly measures the effectiveness of the security awareness program, which is a critical control to reduce human error—the leading cause of breaches. A high training completion rate correlates with lower phishing susceptibility and improved incident reporting, making it a leading indicator of program maturity.
Exam trap
The trap here is that candidates confuse lagging indicators (like incident counts) with leading KPIs, or mistake financial metrics (budget variance) for security performance measures, when the CISM exam focuses on metrics that directly assess control effectiveness and program maturity.
A security manager is selecting controls for a new application. Which TWO controls are most important to include in a defense-in-depth strategy? (Select TWO)
Restricts access to authorized users only.
Why this answer
Defense-in-depth requires multiple layers; input validation prevents injection attacks, and access control ensures least privilege.
A multinational corporation is migrating its on-premises data center to a hybrid cloud environment. The organization processes highly sensitive financial data subject to strict regulatory requirements (e.g., GDPR, SOX). During the risk assessment, the information security manager discovers that the cloud service provider (CSP) stores data in multiple geographic regions, some of which do not meet the organization's data residency requirements. Additionally, the CSP's encryption key management is not fully under the organization's control, and the incident response plan does not include specific procedures for cloud-based breaches. The organization's risk appetite is low, and the board has mandated that all risks must be mitigated to an acceptable level. Which of the following is the BEST course of action?
This directly mitigates the identified risks and aligns with the organization's low risk appetite.
Why this answer
It directly addresses the root causes: data residency non-compliance and lack of control over encryption keys. Requiring dedicated hardware security modules (HSMs) and restricting data storage to approved regions through contractual terms ensures that the organization retains control over key management and meets regulatory requirements. This aligns with the low risk appetite and the board's mandate to mitigate risks to an acceptable level.
Option B (accept the risk) is incorrect because it contradicts the board's mandate to mitigate all risks, and certifications alone do not guarantee compliance.
Option C (cancel migration) is too drastic and costly; the organization can achieve compliance with the CSP rather than abandoning the cloud migration.
Option D (transfer risk via insurance) does not achieve regulatory compliance; fines may still be imposed regardless of insurance coverage.
Exam trap
Candidates may mistakenly believe that accepting risk is viable when the CSP has strong certifications, but the board's mandate requires mitigation, not acceptance.
Refer to the exhibit. The security analyst observes these alerts. What is the MOST likely sequence of events?
Pattern matches credential compromise, C2, and exfiltration.
Why this answer
The correct sequence is that an attacker compromised jsmith's credentials, established command-and-control (C2) communication, and then exfiltrated data. The alerts show a brute-force or credential-stuffing attempt from an external IP (10.0.0.45) against jsmith's account, followed by an outbound C2 beacon (e.g., DNS or HTTP) from jsmith's workstation, and finally a large data transfer to an external destination. This matches the typical kill chain: initial access via compromised credentials, persistence via C2, and data exfiltration as the final objective.
Exam trap
ISACA often tests the distinction between a network scan and a targeted credential attack; the trap here is that candidates see the same source IP (10.0.0.45) and assume it's a scan, but the specific sequence of authentication failures followed by C2 and exfiltration indicates a successful compromise, not a reconnaissance scan.
How to eliminate wrong answers
Option A is wrong because the alerts show an external IP (10.0.0.45) initiating the authentication attempts, not an internal user acting maliciously; insider threat would show internal anomalies like abnormal access times or data transfers to internal shares, not external C2 beacons. Option C is wrong because a network scan from 10.0.0.45 would generate multiple connection attempts to various ports/IPs, not a targeted credential attack against a single user followed by C2 traffic and data exfiltration; the specific sequence of authentication failures, beaconing, and data transfer indicates a targeted compromise, not a scan. Option D is wrong because malware downloaded on jsmith's workstation would typically show a file download event (e.g., HTTP GET to a malicious URL) before C2 activity, but the first alert is authentication failures, suggesting credential compromise occurred before any malware delivery; the sequence starts with credential attacks, not download events.
Order the steps for a risk assessment process according to ISACA's risk management framework.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Risk assessment starts with identification, then analysis, evaluation, treatment, and continuous monitoring.
In the context of incident management, which of the following is the PRIMARY purpose of conducting lessons learned meetings within two weeks of incident resolution?
Continuous improvement of the IR program is key.
Why this answer
The main goal is to improve future incident response by identifying what worked and what didn't.
During a security incident, the incident response team discovers that an attacker has exfiltrated data via an encrypted tunnel over HTTPS. Which log source is MOST likely to provide evidence of the exfiltration?
Proxy logs can show all HTTPS traffic, including destinations and data sizes.
Why this answer
Proxy logs are the most likely source because they can record the full URL and HTTP headers of HTTPS requests, including the destination host and path, even though the payload is encrypted. Since the attacker exfiltrated data over an encrypted tunnel, the proxy log can show the outbound connection to the command-and-control server or data storage endpoint, providing evidence of the exfiltration activity.
Exam trap
The trap here is that candidates often choose firewall logs or IDS logs because they think network-level logs will show the exfiltration, but they forget that HTTPS encryption hides the application-layer details, making proxy logs (with SSL inspection) the only reliable source for evidence of the exfiltration.
How to eliminate wrong answers
Option A is wrong because web server access logs only record requests to the web server itself, not outbound connections from internal hosts to external servers, so they would not capture the exfiltration traffic. Option B is wrong because firewall logs typically record source/destination IPs and ports but not the full URL or application-layer details, and HTTPS encryption hides the payload, making it difficult to identify data exfiltration from firewall logs alone. Option C is wrong because intrusion detection system (IDS) logs rely on signature or anomaly detection, and encrypted HTTPS traffic often bypasses IDS inspection unless SSL/TLS decryption is in place, which is not assumed in this scenario.
Which THREE of the following are critical success factors for implementing an information security program?
Focuses resources on highest risk.
Why this answer
A risk-based approach (B) is critical because it ensures that security controls are prioritized based on the actual threats and vulnerabilities facing the organization, rather than applying controls uniformly. This aligns resources with the highest risks, optimizing the cost-benefit ratio of the security program and directly supporting business resilience.
Exam trap
The trap here is that candidates often confuse 'compliance' with 'security,' assuming that meeting regulatory standards (like PCI DSS or HIPAA) automatically ensures a robust security posture, when in fact compliance is a baseline, not a success factor for an effective program.
An organization wants to ensure its information security program is aligned with business objectives. Which of the following is the BEST approach?
Direct participation ensures security strategies reflect business priorities.
Why this answer
Involving business stakeholders in the security steering committee ensures that security initiatives are directly aligned with business objectives, as stakeholders provide input on risk tolerance, regulatory requirements, and strategic goals. This collaborative governance model allows the security program to prioritize resources and controls based on business impact, rather than operating in isolation. It is the most effective approach because it integrates security decision-making with business planning, which is a core principle of the CISM framework.
Exam trap
The trap here is that candidates often choose a technical or operational control (like vulnerability scans or incident response) because they seem directly related to security, but CISM emphasizes that strategic alignment with business objectives requires governance-level involvement, not just technical activities.
How to eliminate wrong answers
Option A is wrong because implementing a security incident response plan is a reactive operational measure that addresses how to handle breaches, not how to align the security program with business objectives. Option B is wrong because performing regular vulnerability scans is a technical assessment activity that identifies system weaknesses but does not involve business input or strategic alignment. Option D is wrong because conducting annual security awareness training is a compliance and education activity that reduces human risk but does not directly link security program governance to business goals.
Which of the following is the BEST reporting structure for a CISO to ensure independent oversight and alignment with business strategy?
This provides independence and direct alignment with business strategy.
Why this answer
Reporting to the CEO or board ensures the CISO has the authority and independence to influence security strategy without conflicting priorities from IT operations.
A multinational corporation is assessing the risk of data breaches from third-party vendors. The CISM is tasked with selecting a risk treatment strategy. The organization has a low risk appetite for data breaches. Which strategy should be prioritized?
Avoidance eliminates the risk entirely, fitting low appetite.
Why this answer
Given the organization's low risk appetite for data breaches, the most appropriate strategy is to avoid the risk entirely by not engaging vendors that cannot meet security requirements. This aligns with the principle that when risk exceeds the acceptable threshold, avoidance is the prioritized treatment. Avoidance eliminates the risk source, whereas other strategies like mitigation or transfer still retain some residual risk that may be unacceptable.
Exam trap
The trap here is that candidates often default to mitigation (audits) as the standard response, failing to recognize that when risk appetite is explicitly low, avoidance is the mandated first-line strategy per ISACA's risk treatment hierarchy.
How to eliminate wrong answers
Option A is wrong because mitigation through regular vendor audits reduces but does not eliminate the risk; residual risk remains, which conflicts with a low risk appetite. Option C is wrong because transferring risk via cyber insurance does not reduce the likelihood or impact of a breach; it only provides financial compensation, leaving the organization exposed to reputational and operational harm. Option D is wrong because acceptance is only appropriate when residual risk falls within the risk appetite; here, the low appetite makes acceptance unacceptable.
An organization uses CIS Controls v8. They are a small business with limited cybersecurity resources. Which implementation group (IG) should they prioritize?
IG1 is the foundational set suitable for small businesses.
Why this answer
IG1 is the basic set of cyber hygiene controls designed for organizations with limited resources.
Which control framework is most appropriate for an organization that wants a prioritized set of controls based on implementation groups (IG1, IG2, IG3)?
CIS Controls v8 organizes controls into Implementation Groups (IG1, IG2, IG3) for prioritization.
Why this answer
CIS Controls v8 explicitly defines implementation groups to help organizations prioritize controls based on their risk profile and resources.
A security administrator reports that the VPN tunnel to the remote peer (10.1.1.1) intermittently fails. Which of the following is the most likely cause?
NAT traversal (NAT-T) is needed when a VPN endpoint is behind a NAT device. Improper configuration can cause intermittent failures as packets may be dropped during translation.
Why this answer
The intermittent failure suggests NAT traversal is not properly configured. NAT traversal (NAT-T) is used to encapsulate VPN traffic (ESP) in UDP to traverse NAT devices. If the remote peer is behind a NAT device and NAT-T is not correctly enabled or configured, packets may be dropped, causing intermittent tunnel failures.
How to eliminate wrong answers
Option B is wrong because mismatched IKE phase 1 parameters (e.g., encryption, hash, DH group) would cause a persistent failure to establish the tunnel, not intermittent drops. Option C is wrong because an expired digital certificate would result in a complete authentication failure during IKE phase 1 or 2, not intermittent connectivity. Option D is wrong because an incorrect access-list 101 would either permit or deny traffic consistently, leading to a permanent failure to match interesting traffic, not intermittent tunnel drops.
A financial institution is developing an information security program based on the COBIT framework. The board has requested a balanced scorecard to communicate program effectiveness. Which of the following metric categories would best align with the 'Internal Processes' perspective?
This measures process effectiveness.
Why this answer
The 'Internal Processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of internal operational processes. The percentage of security incidents detected within defined SLAs directly measures the performance of the security monitoring and incident response processes, which are core internal processes in a COBIT-based information security program.
Exam trap
In this CISM question, the trap is that candidates confuse 'Internal Processes' with 'Learning and Growth' (training hours) or 'Financial' (cost metrics), failing to recognize that SLAs directly measure the operational effectiveness of security processes themselves in a COBIT-based program.
How to eliminate wrong answers
Option A is wrong because 'Cost of security incidents as a percentage of revenue' is a financial metric, aligning with the 'Financial' perspective, not 'Internal Processes'. Option C is wrong because 'Number of security training hours per employee' is a learning and growth metric, measuring human capital development, not internal process efficiency. Option D is wrong because 'Customer satisfaction survey scores on data protection' is a customer perspective metric, focusing on external stakeholder perception, not internal operational processes.
Practice CISM by domain
Target a specific domain to shore up weak areas.