871 questions total · 12pages · All types, answers revealed
Which TWO of the following are incident categories in an incident management programme?
Insider threat is a specific incident category.
Why this answer
Ransomware and insider threat are defined incident categories; phishing is a technique, not a category; vulnerability is a condition; theft is too broad.
In a security operations center (SOC), which function is PRIMARILY responsible for analyzing alerts and determining whether they represent actual security incidents?
Handles escalated alerts and incident analysis.
Why this answer
Tier 2 SOC analysts are primarily responsible for deep-dive analysis of alerts escalated from Tier 1, using threat intelligence, log correlation, and forensic techniques to determine if an alert represents a genuine security incident. They possess the technical expertise to differentiate false positives from true positives by examining raw packet captures, endpoint artifacts, and SIEM event details that Tier 1 analysts may lack the context or authority to investigate fully.
Exam trap
The trap here is that candidates often confuse the initial triage role of Tier 1 analysts with the confirmatory analysis role of Tier 2, mistakenly thinking Tier 1 determines incidents, whereas Tier 1 only filters and escalates.
How to eliminate wrong answers
Option A is wrong because Tier 1 SOC analysts perform initial triage and categorization of alerts, but they lack the advanced analytical skills and authority to confirm incidents; their role is to escalate suspicious alerts to Tier 2. Option B is wrong because the incident response manager coordinates the response plan, communication, and resource allocation after an incident is confirmed, not the initial analysis of alerts. Option D is wrong because the security architect designs and reviews security controls and infrastructure, but does not perform real-time alert analysis or incident validation in the SOC.
An organization has experienced a ransomware attack that has encrypted critical servers and is causing major business disruption. According to incident severity levels, which priority should this incident be assigned?
Correct. P1 incidents have major business impact and require immediate 24/7 response and executive notification.
Why this answer
A ransomware attack with major business impact is a critical incident (P1), requiring executive notification and 24/7 response.
During an incident investigation, the response team discovers that the attacker exploited a known vulnerability for which a patch was available but not applied. What should be the team's primary focus during the recovery phase?
Correct: Direct remediation of the vulnerability.
Why this answer
The primary goal of the recovery phase is to restore secure operations and prevent recurrence. Applying the missing patch directly remediates the exploited vulnerability, eliminating the attacker's entry point and hardening the system against future exploitation of that specific CVE. This aligns with the NIST SP 800-61 recovery step of 'removing artifacts and restoring systems to a secure state'.
Exam trap
The trap here is that candidates confuse the recovery phase with the post-incident activity phase, choosing 'lessons learned' (Option C) instead of the immediate technical fix required to restore a secure state.
How to eliminate wrong answers
Option B is wrong because the immediate priority is technical remediation, not HR actions; discipline is a separate organizational process that occurs after recovery and does not restore security. Option C is wrong because a lessons-learned meeting is part of the post-incident activity phase, not the recovery phase, and does not directly address the active vulnerability. Option D is wrong because reporting to law enforcement is a legal/compliance step that may run in parallel but does not fix the exploited vulnerability or restore system integrity.
When should an incident response transition to business continuity and disaster recovery (BC/DR) activation?
If MTD cannot be met, BC/DR plans are triggered to restore operations.
Why this answer
BC/DR is activated when the incident cannot be resolved within the maximum tolerable downtime (MTD).
An organization has a security program that is aligned with ISO 27001. During an internal audit, it is discovered that several controls are not being applied consistently across all departments. The MOST effective corrective action is to:
Why this answer
The core issue is inconsistent control application across departments, which indicates a lack of governance and oversight rather than a policy or awareness deficiency. Establishing a centralized security oversight function directly addresses this by creating a single authority to enforce, monitor, and standardize control implementation, ensuring alignment with ISO 27001 requirements for management commitment and resource allocation (Clause 5.1 and 7.1). This corrective action provides the necessary organizational structure to drive consistent execution, which is the most effective long-term solution.
Exam trap
The trap here is that candidates confuse the symptom (inconsistent application) with the root cause (lack of governance), leading them to choose awareness training or policy updates, which are tactical fixes rather than strategic corrective actions.
Why the other options are wrong
Policy likely exists; issue is execution.
Training addresses knowledge, not enforcement.
Risk assessment would identify gaps but not fix consistency.
Match each CISM domain to its focus area.
Drag a concept onto its matching description — or click a concept then click the description.
Establish and maintain a framework to align security with business objectives
Identify and manage information risk to achieve business objectives
Design and implement a security program to manage risk
Plan and manage the incident response process
Oversee and improve the security program's performance
Why these pairings
The CISM domains are: Governance (strategy alignment), Risk Management (risk identification and management), Program Development (design and implementation), and Incident Management (detection and response). Common confusions include swapping program development with governance and incident management with risk management.
After a supply chain attack, the incident response team identifies that a third-party vendor's compromised credentials were used to access the organization's network. Which incident category should this be classified under?
Incidents originating from a third-party vendor's environment are classified as supply chain incidents.
Why this answer
Supply chain incidents involve attacks through third-party vendors or partners, even if the initial vector is credential compromise.
BankOne has a mature security governance program but recently failed a regulatory audit because the board had not formally approved the risk appetite statement. The CISO argues that risk appetite is reviewed annually and was verbally approved. To prevent recurrence, what governance change is most effective?
Ensures documented, formal approval.
Why this answer
The core issue is the lack of formal, documented board approval of the risk appetite statement, which is a governance requirement. A formal board resolution, passed and recorded annually, creates an auditable record that satisfies regulatory scrutiny and ensures the board's explicit ownership of risk tolerance. This directly addresses the audit failure by moving from informal verbal approval to a legally binding, documented governance process.
Exam trap
The trap here is that candidates confuse operational improvements (like automating monitoring or reducing indicators) with governance-level fixes, failing to recognize that the audit failure was due to a lack of formal, documented board approval, not a deficiency in the monitoring or reporting process.
How to eliminate wrong answers
Option A is wrong because automating risk appetite monitoring addresses ongoing measurement and reporting, not the root cause of missing formal board approval; it does not create the required documentation of the board's decision. Option B is wrong because reducing the number of risk indicators would weaken the monitoring framework and does not solve the documentation or approval gap. Option C is wrong because while documenting approvals in minutes is better than verbal approval, it is less formal and auditable than a dedicated board resolution; minutes may not capture the specific language of the risk appetite statement or the board's explicit vote, and they can be challenged as insufficient for regulatory compliance.
Which TWO of the following are key considerations when managing an external forensics firm during an incident? (Select TWO)
Chain of custody ensures evidence integrity and admissibility.
Why this answer
Managing external forensics involves defining scope, ensuring proper evidence handling and chain of custody, maintaining confidentiality, and preserving attorney-client privilege.
A multinational financial services company is implementing a new regulatory requirement that mandates enhanced encryption for all customer data in transit. The organization currently uses TLS 1.2, but the regulation requires TLS 1.3. The risk owner for the data transmission system is the head of network operations, who believes the current controls are sufficient and argues that upgrading will cause significant downtime and cost. The information security manager has assessed the risk as high due to potential regulatory fines and reputational damage. The risk owner refuses to accept the risk and insists on deferring the upgrade. The organization has a risk appetite statement that accepts moderate residual risk only after explicit approval from the CRO. The escalation process involves the risk management committee. What is the BEST course of action for the information security manager?
This follows the governance process and ensures that the risk is evaluated at the appropriate level with authority to override the risk owner's stance.
Why this answer
Given the risk owner's refusal and the high residual risk exceeding appetite, the security manager should formally escalate to the risk management committee for a final decision, as per the established governance process. This ensures proper oversight and documentation.
A multinational corporation is implementing a risk-based approach to information security governance. The chief information security officer (CISO) has been asked to prioritize security initiatives based on business impact. Which of the following actions should the CISO take FIRST to align security governance with business objectives?
A BIA identifies critical business processes and their dependencies, enabling risk-based prioritization.
Why this answer
Conducting a business impact analysis (BIA) is the foundational step in a risk-based governance approach because it identifies critical business processes, their recovery time objectives (RTOs), and the specific security requirements needed to protect them. Without this analysis, the CISO cannot align security initiatives with business impact, as the BIA directly links security controls to the organization's most valuable assets and operational priorities.
Exam trap
The trap here is that candidates often confuse tactical security controls (like MFA or SIEM) with the strategic governance step of first understanding business impact, leading them to select a technically correct but sequentially premature answer.
How to eliminate wrong answers
Option A is wrong because enforcing MFA for all remote access is a tactical control that should be prioritized based on BIA findings, not implemented first without understanding which processes and data are most critical. Option B is wrong because implementing a compliance management tool addresses regulatory tracking but does not establish the business impact or risk prioritization needed to align security governance with business objectives. Option C is wrong because deploying a SIEM system centralizes log analysis for detection and response, but it is a reactive measure that should be scoped and prioritized after the BIA identifies which systems and data require monitoring.
Which THREE of the following are valid methods to identify information security risks? (Choose three.)
BIA identifies critical processes and potential impact, helping to prioritize risks.
Why this answer
A Business Impact Analysis (BIA) is a systematic process to identify and evaluate the potential effects of disruptions to critical business functions, thereby identifying information security risks by quantifying the impact of loss of confidentiality, integrity, or availability. It directly links business processes to the underlying IT assets and their security requirements, making it a valid risk identification method as per CISM domain guidance.
Exam trap
The trap here is that candidates often confuse penetration testing (a control validation activity) with risk identification, but CISM distinguishes that risk identification must occur before any testing, and penetration testing is a detective control, not a discovery method.
A company has a risk appetite that is 'low' for operational risks. A risk assessment recently identified that a high-speed trading platform has a residual risk rating of 'high' after controls are applied. The cost to further reduce the risk is $1 million, which exceeds the expected benefit. What is the most appropriate action for the risk owner?
Since controls are not cost-effective, acceptance is appropriate with proper approval.
Why this answer
The risk owner has determined that the cost to further reduce the residual risk ($1 million) exceeds the expected benefit, making additional controls economically unjustifiable. Since the company's risk appetite is 'low' for operational risks but the residual risk is 'high', the most appropriate action is to formally accept the residual risk with senior management sign-off, as this documents the decision and acknowledges the deviation from the stated risk appetite. This aligns with the CISM principle that risk acceptance is a valid treatment option when the cost of mitigation outweighs the benefit, provided it is approved at the appropriate level.
Exam trap
The trap here is that candidates confuse 'risk acceptance' with 'ignoring the risk' or assume that a low risk appetite always mandates mitigation, failing to recognize that formal acceptance with senior sign-off is a legitimate and required response when cost-benefit analysis shows mitigation is not justified.
How to eliminate wrong answers
Option B is wrong because adjusting the risk appetite to 'moderate' to align with the residual risk is a reactive and inappropriate approach; risk appetite should be set by the board based on strategic objectives, not changed to justify a single risk assessment outcome. Option C is wrong because transferring the risk via insurance does not reduce the residual risk rating; it only shifts the financial impact, and the high-speed trading platform's operational risk (e.g., latency, system failure) may not be fully insurable or cost-effective given the premium. Option D is wrong because approving additional controls regardless of cost violates the principle of cost-benefit analysis; the question explicitly states the cost exceeds the expected benefit, making this option economically unsound and contrary to risk management best practices.
An organization's information security program has been in place for two years. During a recent audit, several findings indicated that security controls are not consistently applied across business units. The CISO has been asked to improve the program. Which of the following should the CISO do FIRST?
A risk assessment provides the basis for prioritizing controls and ensuring consistent application based on risk.
Why this answer
Conducting a risk assessment first (Option C) is the correct initial step because it systematically identifies where controls are failing or missing across business units, quantifies the associated risks, and prioritizes remediation based on business impact. Without this foundational analysis, any subsequent actions—such as automation, policy updates, or new controls—would lack direction and could waste resources on low-priority areas. This aligns with the CISM program lifecycle, where risk assessment drives all other program improvements.
Exam trap
ISACA often tests the principle that a risk assessment must precede any control implementation or policy change, tempting candidates to jump to automation or enforcement actions without first understanding the specific gaps.
How to eliminate wrong answers
Option A is wrong because automating compliance monitoring without first understanding which controls are inconsistently applied and why would simply automate the detection of known gaps without addressing root causes or prioritizing fixes. Option B is wrong because updating the policy to mandate compliance does not address the underlying issue of inconsistent application; it only reiterates requirements without providing a mechanism to identify or remediate the specific gaps. Option D is wrong because implementing additional controls across all business units without a prior risk assessment could introduce unnecessary complexity, increase costs, and fail to target the actual weaknesses, potentially creating new compliance gaps.
A CISO is developing an information security governance framework for a financial institution. Which of the following is the PRIMARY purpose of such a framework?
Governance ensures that security investments and activities support the business strategy and deliver value.
Why this answer
The primary purpose of an information security governance framework is to align security initiatives with business objectives, ensuring that security investments and activities directly support the organization's strategic goals. For a financial institution, this alignment ensures that security governance drives value, manages risk in context of business priorities, and enables informed decision-making by leadership.
Exam trap
The trap here is that candidates often confuse the tactical goal of risk reduction (Option A) with the strategic purpose of governance, but CISM emphasizes that governance is about aligning security with business objectives, not just minimizing risk.
How to eliminate wrong answers
Option A is wrong because minimizing risks to an acceptable level is an outcome of risk management, not the primary purpose of governance; governance sets the structure for risk management but focuses on strategic alignment. Option C is wrong because ensuring compliance with regulatory requirements is a tactical obligation, not the primary purpose; governance frameworks incorporate compliance but are broader, aiming to integrate security with business strategy. Option D is wrong because deploying the latest security technologies is an operational activity, not a governance purpose; governance defines policies and oversight, not specific technology choices.
You are the IT governance officer at a regional bank with 1,200 employees. The bank has a security policy that requires annual security awareness training for all staff. However, the compliance rate is only 60%. The board is concerned about regulatory risk and wants to improve compliance. The current training is a generic online module that takes 30 minutes to complete. Employees complain that the training is boring and not relevant to their roles. The training is managed by the HR department, which sends reminders but does not enforce consequences. Which of the following is the BEST course of action to improve training compliance and governance?
Addresses both relevance and enforcement, key governance components.
Why this answer
It addresses both the root cause (irrelevant training) and the governance gap (lack of enforcement). By redesigning training to be role-specific, employees see direct relevance, which improves engagement and retention. Mandating completion within the security governance framework and attaching consequences (e.g., access revocation) creates accountability, directly driving compliance from 60% toward the board's target.
Exam trap
The trap here is that candidates often mistake tracking (Option C) for enforcement, failing to recognize that governance requires both visibility and consequences to drive compliance.
How to eliminate wrong answers
Option A is wrong because outsourcing to a third-party provider does not fix the core issues of relevance or enforcement; it merely shifts the same generic content to another vendor, and without governance authority, compliance may remain low. Option B is wrong because increasing reminder frequency from monthly to weekly only amplifies a failed communication tactic; it does not address employee motivation or enforce consequences, so it is unlikely to move compliance beyond 60%. Option C is wrong because implementing an LMS to track completion provides visibility but no enforcement mechanism; without mandating completion and attaching consequences, tracking alone does not compel behavior change.
An incident response team is analyzing a phishing email that successfully compromised a user's credentials. Which TWO indicators of compromise (IOCs) should the team prioritize collecting? (Choose two.)
The IP address of the sending server is a critical IOC as it identifies the source infrastructure, enabling network-level blocking and threat intelligence correlation.
Why this answer
The correct options are B and C. The IP address of the sending server is a critical IOC because it identifies the source infrastructure used to deliver the phishing email, enabling network-level blocks and threat intelligence correlation. The malicious URL or attachment hash is another key IOC as it represents the payload that compromised the credentials, allowing for signature-based detection and blocking.
The other options (browser history, personal phone number, company website) are not primary IOCs from the phishing email itself.
Exam trap
The trap here is that candidates may confuse post-compromise artifacts (like browser history) with primary IOCs, or think that personal information (phone number) or the company's own website are relevant indicators, when in fact the core IOCs for a phishing email are the sender's IP and the malicious payload identifier.
Which of the following is the most important factor for ensuring the long-term success of an information security program?
Why this answer
Strong support from top management is the most important factor because it ensures the information security program receives adequate budget, organizational authority, and strategic alignment with business objectives. Without executive sponsorship, even the best technical controls can be undermined by resource constraints, policy non-compliance, or lack of cross-departmental cooperation. The CISM framework emphasizes that governance and leadership commitment are foundational to sustaining a security program over time.
Exam trap
The trap here is that candidates often mistake operational effectiveness (e.g., training or testing) for strategic success, overlooking that without top management support, no security initiative can be sustained or enforced across the organization.
Why the other options are wrong
Technology is a tool, not the foundation; it requires management support to be effective.
Training is important but not the most critical factor; without management support, training may lack resources.
Penetration testing is a tactical activity; it does not ensure program success without executive backing.
In a third-party risk management programme, what is the primary purpose of vendor tiering?
High-risk vendors get more scrutiny; low-risk may have lighter processes.
Why this answer
Vendor tiering categorizes vendors based on the criticality of services and data access to determine the appropriate level of due diligence and monitoring. This ensures resources are focused on high-risk vendors.
After an incident is contained and eradicated, the incident response team conducts a post-incident review. Which of the following is the PRIMARY objective of this review?
The review aims to find lessons learned and improve incident response processes.
Why this answer
The primary objective of a post-incident review is to identify process improvements that enhance the organization's incident response capabilities. This aligns with the CISM focus on continuous improvement, ensuring that lessons learned are captured and applied to prevent recurrence or improve future response efficiency.
Exam trap
The trap here is that candidates often confuse a secondary outcome (like updating policies) with the primary objective, failing to recognize that the review's core purpose is process improvement, not documentation or blame.
How to eliminate wrong answers
Option A is wrong because updating security policies is a possible outcome of the review, not the primary objective; the core goal is to analyze the incident response process itself for improvements. Option B is wrong because determining the financial impact is typically part of the containment and eradication phase or a separate forensic accounting activity, not the central purpose of the post-incident review. Option C is wrong because assigning blame is counterproductive and contrary to the 'no-blame' culture essential for effective incident response; the review focuses on systemic weaknesses, not individual fault.
A security manager is developing a security scorecard for the CISO. Which THREE of the following metrics are considered LEADING indicators?
Measures proactive vulnerability remediation.
Why this answer
Leading indicators predict future incidents. Patch compliance, access review completion, and phishing click rate are proactive measures.
Which of the following is the PRIMARY purpose of a security awareness program?
Behavior change directly reduces risks like phishing and social engineering.
Why this answer
The primary purpose is to change employee behavior to reduce human-related security risks, such as phishing susceptibility.
An organization's incident response plan includes playbooks for different incident types. Which playbook should be used for an incident involving unauthorized access to a user's account due to phishing?
Credential compromise covers phishing, password spraying, and account takeover.
Why this answer
Credential compromise incidents, such as account takeover via phishing, are handled by the credential compromise playbook.
A security architect is designing a defense-in-depth strategy. Which combination of controls best exemplifies this approach?
Correct. All four represent different layers: network, host, data, and human.
Why this answer
Defense-in-depth uses multiple layers of security. Firewall (network), antivirus (host), encryption (data), and security awareness (human) provide overlapping layers.
An organization is selecting security controls from NIST SP 800-53. Which TWO control families are most directly related to access control? (Select TWO)
Covers user identification and authentication mechanisms.
Why this answer
Access Control (AC) and Identification and Authentication (IA) are the primary families governing access management.
A security program lacks executive support. What is the best strategy to gain support?
Quantified risk connects security to business impact, gaining executive attention.
Why this answer
C is correct because executive stakeholders prioritize business outcomes over technical details. By quantifying risks in financial terms (e.g., potential loss exposure, ROI of mitigation), the security manager aligns with the organization's strategic language, making the case for investment compelling and actionable. This approach directly addresses the root cause—lack of perceived business value—rather than relying on technical arguments or fear.
Exam trap
ISACA CISM tests the misconception that technical demonstrations or fear-based tactics (like regulatory threats) are more effective than business-aligned communication, when in reality, executives require risk expressed in financial terms to justify resource allocation.
How to eliminate wrong answers
Option A is wrong because hiring a consultant may provide expertise but does not inherently build executive buy-in; it can even be seen as an external cost without demonstrated internal alignment. Option B is wrong because quick-win improvements, while visible, often address low-impact risks and can create a false sense of security, failing to address the systemic lack of executive engagement. Option D is wrong because threatening regulatory fines introduces a negative, adversarial tone that can damage trust and collaboration; executives may view it as coercion rather than a partnership in risk management.
During a data breach investigation, an organization engages an external forensics firm. To preserve attorney-client privilege, which of the following is the BEST practice?
This helps ensure that findings are covered by attorney-client privilege.
Why this answer
Engaging the forensics firm under the direction of legal counsel is the best practice because it extends attorney-client privilege to the investigation. When counsel directs the work, communications and findings are protected as work product, preventing disclosure in litigation. This is a foundational principle in incident response legal strategy.
Exam trap
The trap here is that candidates confuse confidentiality (NDA) with legal privilege, or assume operational independence (reporting to CISO) is acceptable, when only attorney-directed engagement preserves privilege under evidentiary rules.
How to eliminate wrong answers
Option B is wrong because having the forensics firm work independently to maintain objectivity would break the privileged relationship; independent work without legal direction creates discoverable evidence. Option C is wrong because a non-disclosure agreement only protects confidentiality, not legal privilege; it does not shield the investigation from being subpoenaed. Option D is wrong because having the forensics firm report directly to the CISO bypasses legal counsel, making the investigation subject to discovery as ordinary business records.
Which TWO of the following are primary responsibilities of the board of directors with regard to information security governance? (Select exactly two.)
Governance responsibility.
Why this answer
The board of directors is responsible for ensuring that the information security strategy aligns with business goals, objectives, and regulatory requirements. This is a governance-level duty that sets the strategic direction and ensures security investments support the organization's mission, rather than being a tactical or operational task.
Exam trap
The trap here is that candidates confuse governance (board-level strategic oversight) with management (operational execution), leading them to select tactical activities like vulnerability scanning or control implementation as board responsibilities.
An organization is updating its incident response playbook after a ransomware attack. Which of the following should be included as a key step in the ransomware playbook?
Isolation prevents further encryption and spread of ransomware.
Why this answer
Ransomware playbooks should include isolating infected systems to prevent spread, as containment is a priority.
During an audit of the information security program, the auditor identifies that several critical systems are not included in the incident response plan. Which of the following are the MOST appropriate actions for the security manager to take? (Select TWO.)
Updating the plan directly closes the gap identified in the audit.
Why this answer
The incident response plan must be a living document that covers all critical systems to ensure a coordinated and effective response during a security incident. Excluding critical systems from the plan creates a blind spot that could lead to delayed containment, increased damage, or non-compliance with regulatory requirements. Updating the plan to include these systems is a direct corrective action that aligns with the CISM principle of maintaining an up-to-date incident response capability.
Exam trap
The CISM exam often tests the misconception that accepting risk or implementing compensating controls is a valid substitute for updating the incident response plan, when in fact the plan must be comprehensive and inclusive of all critical assets to be effective.
An organization is updating its information security program to align with business objectives. Which of the following is the PRIMARY benefit of integrating security risk management into the strategic planning process?
Integration ensures that security resources are allocated to risks most critical to business objectives.
Why this answer
Integrating security risk management into strategic planning ensures that security investments are directly tied to the organization's business priorities and risk appetite. This alignment allows for optimal allocation of resources to protect the most critical assets and processes, rather than spending on generic or low-priority controls. The primary benefit is that security becomes a business enabler, not a cost center, by focusing on what matters most to the organization's objectives.
Exam trap
The trap here is that candidates often confuse operational benefits (like incident reduction or compliance) with the strategic, business-alignment benefit that is the core purpose of integrating risk management into planning.
How to eliminate wrong answers
Option B is wrong because reducing the number of security incidents is an operational outcome of effective controls, not the primary strategic benefit of integrating risk management into planning; incidents can still occur despite alignment. Option C is wrong because increasing employee awareness is a tactical training or communication activity, not a strategic planning outcome, and it does not directly tie security to business goals. Option D is wrong because ensuring compliance with regulatory requirements is a baseline necessity and a tactical obligation, but it is not the primary benefit of strategic integration; compliance alone does not guarantee alignment with business objectives or optimized investment.
A multinational corporation has just detected a ransomware attack that encrypted critical files on a file server. The incident response team has been activated. Which of the following should be the FIRST action taken by the team?
Isolation stops the ransomware from spreading and limits damage.
Why this answer
The first priority in ransomware incident response is containment to prevent the encryption from spreading to other systems. Isolating the affected file server from the network (e.g., disabling the network interface or disconnecting the cable) stops the ransomware from communicating with its command-and-control server and encrypting additional shares. This aligns with the NIST SP 800-61 containment strategy and ensures that the incident response team can safely preserve forensic evidence before any remediation.
Exam trap
The trap here is that candidates often choose 'Restore from backup' first because it seems like a direct fix, but CISM emphasizes containment before eradication or recovery to limit damage and preserve forensic integrity.
How to eliminate wrong answers
Option A is wrong because restoring from backup before containment risks re-encrypting the restored files if the ransomware is still active on the network, and it may overwrite forensic evidence. Option B is wrong because rebooting the file server does not clear encryption—ransomware encrypts files at rest using asymmetric cryptography, and a reboot simply restarts the OS without reversing the encryption; it may also trigger the ransomware to encrypt additional data on startup. Option D is wrong because notifying law enforcement is a secondary step that should occur after containment and evidence preservation, and premature notification can delay critical containment actions.
Which TWO of the following are key components of an effective incident response plan?
This ensures decision-making authority is defined.
Why this answer
A clear chain of command and escalation procedures ensure that during an incident, decision-making authority and notification paths are predefined, reducing confusion and enabling rapid, coordinated response. This aligns with NIST SP 800-61 incident response guidelines, which emphasize the need for defined roles and communication hierarchies to avoid delays or missteps in critical situations.
Exam trap
ISACA often tests the distinction between the plan's structural components (like chain of command and communication plans) and operational tools or overly rigid scripts, tempting candidates to select automatic tools or exhaustive scripts as key components when they are not foundational to the plan's design.
A government agency is criticized for poor security governance after a data breach. An external review finds that security policies are not aligned with agency's mission. The director wants to implement a governance framework that ties security to strategic objectives. Which framework is most suitable?
Specifically designed for governance and linking security to business objectives.
Why this answer
COBIT is designed for governance and alignment with enterprise goals. Option A is a management system. Option B is operational.
Option D is industry-specific.
A financial institution uses CIS Controls v8 and must prioritize implementation. The organization has limited resources and high exposure to ransomware. Which implementation group should be addressed FIRST?
IG1 includes basic cyber hygiene controls that prevent common attacks like ransomware.
Why this answer
IG1 consists of essential controls (e.g., inventory, malware defenses) that address the most common attacks, including ransomware.
Which TWO of the following are appropriate actions to take during the detection phase of incident management?
Once an incident is suspected, the team should be mobilized.
Why this answer
During detection, the team activates the incident response team and collects/analyzes logs to confirm the incident. Root cause analysis occurs later, evidence preservation is during containment, and rebuilding is recovery.
A security operations center (SOC) analyst receives an alert from the SIEM indicating a potential command and control (C2) communication. The alert is based on a signature that matches known C2 traffic. What is the MOST appropriate next step?
Correlation with other logs confirms if it's a true positive.
Why this answer
Verifying the alert by checking other log sources (e.g., firewall, DNS) reduces false positives before escalating. Escalating immediately (B) may waste resources if the alert is a false positive. Blocking the IP address at the firewall (A) could be premature if the traffic is legitimate.
Running a full antivirus scan on all endpoints (D) is a reactive step that does not address the immediate investigation of the alert.
An organization is required to notify regulators of a material cybersecurity incident within 4 business days. Which regulation imposes this requirement?
SEC rules mandate 4 business day notification for material incidents.
Why this answer
The SEC's proposed rules (now final) require publicly traded companies to report material cybersecurity incidents on Form 8-K within 4 business days of determining materiality. This is a specific U.S. securities regulation, not a privacy or payment card standard, and it directly mandates the 4-business-day notification window for material incidents.
Exam trap
A common trap on the ISACA CISM exam is confusing the SEC's 4-business-day requirement for material incident reporting with other notification timelines (e.g., GDPR's 72-hour breach notification), leading candidates to incorrectly apply privacy regulations to securities reporting obligations.
How to eliminate wrong answers
Option A is wrong because the CCPA requires notification to California residents within the most expedient time possible without undue delay, but it does not specify a fixed 4-business-day window for regulatory notification. Option C is wrong because the GDPR requires notification to the supervisory authority within 72 hours (approximately 3 business days) of becoming aware of a personal data breach, not 4 business days. Option D is wrong because PCI DSS requires notification to the acquiring bank and card brands as soon as possible, but it does not impose a specific 4-business-day regulatory notification requirement.
An organization is redesigning its information security program to better align with business objectives. The CISO reports to the CIO, but business leaders feel security decisions are too IT-centric. Which reporting structure would best address this concern?
Direct reporting to the CEO or Board ensures security is independent and aligned with business objectives.
Why this answer
Reporting to the CEO or Board gives the CISO independence from IT and better alignment with business strategy.
After a data breach, the CISO reviews the security program. The breach exploited a known vulnerability in a legacy system that was deemed 'acceptable risk' two years ago. What should the CISO do to improve the program?
Ensures that risk acceptance stays current with evolving threats and business context.
Why this answer
Risk acceptance is not a one-time decision; it must be periodically reassessed to account for changes in the threat landscape, business context, or compensating controls. The breach exploited a known vulnerability that was accepted two years ago, indicating the risk environment has shifted (e.g., new exploit code, increased attacker interest). Implementing a periodic reassessment process ensures that accepted risks are re-evaluated against current threats and vulnerabilities, allowing the organization to either renew acceptance, apply mitigations, or retire the system.
Exam trap
The trap here is that candidates confuse risk acceptance with a permanent decision, failing to recognize that accepted risks must be periodically re-evaluated as part of a continuous risk management process.
How to eliminate wrong answers
Option A is wrong because a blanket annual upgrade policy is impractical for legacy systems that may lack vendor support or compatible upgrades, and it does not address the root cause of failing to reassess risk. Option B is wrong because immediately disconnecting the legacy system may disrupt critical business operations without a planned migration or compensating control, and it is a reactive rather than programmatic improvement. Option D is wrong because requiring immediate remediation of all legacy systems is often infeasible due to cost, operational dependencies, or lack of patches, and it ignores the risk management principle of prioritizing based on current risk appetite.
A company's IDS alerts on a potential breach. The incident response team is called. What should they do immediately?
Correct: Verification confirms the alert and assessment determines the extent.
Why this answer
The immediate priority upon receiving an IDS alert is to verify the alert's validity and assess the scope of the potential breach. This ensures the incident response team does not waste resources on false positives and can accurately determine the affected systems, data, and network segments before taking containment actions. Verification typically involves correlating the IDS signature with actual packet captures, logs, and system telemetry to confirm malicious activity.
Exam trap
The trap here is that candidates confuse 'immediate response' with 'containment' and choose a drastic action like disconnecting cables, forgetting that verification and scope assessment must precede any containment to avoid destroying evidence and causing unnecessary downtime.
How to eliminate wrong answers
Option B is wrong because disconnecting all network cables is a drastic, uncontrolled containment action that can cause unnecessary business disruption, destroy volatile evidence (e.g., active network connections, memory-resident malware), and may violate legal hold requirements. Option C is wrong because notifying law enforcement is a secondary step that occurs after the incident is confirmed, scoped, and legal counsel is consulted; premature notification can compromise internal investigation and evidence handling. Option D is wrong because reimaging affected systems destroys all forensic evidence (logs, malware binaries, registry artifacts) and prevents root cause analysis, which is critical for preventing recurrence and meeting compliance obligations.
A healthcare organization is merging with another entity and must integrate their IT systems. During due diligence, it is discovered that the acquired company has a high number of unpatched critical vulnerabilities in its electronic health record (EHR) system. The merger timeline is aggressive and the integration team wants to proceed as planned. As the risk manager, what is the best course of action?
Delay remediates the root cause before exposure increases.
Why this answer
Delaying integration until the critical vulnerabilities are patched is the most prudent action to prevent exploitation during and after integration. Proceeding with compensating controls may not be sufficient given the criticality, and accepting the risk could lead to a major breach. Insurance does not prevent the breach.
An organization is implementing a security champions program to improve application security. Which THREE of the following are key success factors for such a program?
Authority to block releases gives them real influence.
Why this answer
Security champions need dedicated time, training, and management support to be effective. Champions act as liaisons between security and development.
An organization plans to implement ISO/IEC 27001 to formalize its information security management system. Which step is most critical to ensure successful implementation?
Top management involvement provides necessary resources and authority for the ISMS.
Why this answer
ISO/IEC 27001 requires top management to demonstrate leadership and commitment (Clause 5.1) as the foundation for the entire ISMS. Without executive buy-in, resources, authority, and cross-functional support are lacking, making risk assessments, policies, and training ineffective. The standard mandates management approval for the information security policy and ensures alignment with business objectives, which is the most critical success factor.
Exam trap
The trap here is that candidates often choose 'Conduct a comprehensive risk assessment' because it is the technical heart of ISO 27001, but CISM emphasizes that governance and management commitment must precede any technical or operational activities for the ISMS to be sustainable.
How to eliminate wrong answers
Option A is wrong because while a comprehensive risk assessment is required (Clause 6.1), it cannot be effectively performed or acted upon without prior top management commitment to allocate resources and enforce remediation. Option C is wrong because developing detailed information security policies is an operational step that follows management's strategic direction and approval; policies without executive sponsorship often lack enforcement and become shelfware. Option D is wrong because training all employees on security awareness is important for culture (Clause 7.3), but it is a downstream activity that depends on management establishing the ISMS framework and providing the necessary budget and authority.
An organization is conducting a root cause analysis after an insider threat incident. Which of the following tools is MOST appropriate for identifying the underlying management governance failure?
5 Whys helps trace the chain of causation to management and governance issues.
Why this answer
The 5 Whys technique is a simple but effective method to drill down from technical cause to process failure to management failure.
A financial services firm has a mature information security program but is struggling to demonstrate the value of security investments to the board. Which metric would BEST communicate the effectiveness of the security program in business terms?
Directly ties security program effectiveness to financial impact.
Why this answer
The reduction in average cost per security incident directly translates security program outcomes into financial terms that resonate with the board. This metric demonstrates the program's effectiveness by quantifying the monetary value of improved prevention, detection, and response capabilities, aligning with the CISM focus on governance and business alignment.
Exam trap
The trap here is that candidates often choose a technical or operational metric (like time to patch or alert volume) because it seems directly measurable, but the CISM exam emphasizes that the board cares about business impact and financial outcomes, not technical details.
How to eliminate wrong answers
Option A is wrong because the number of security alerts triaged per day is an operational metric that measures activity volume, not effectiveness or business value; a high volume could indicate poor tuning or false positives, not a mature program. Option C is wrong because time to patch critical vulnerabilities is a technical compliance metric that measures remediation speed, not the overall security program's effectiveness in reducing business risk or cost. Option D is wrong because the percentage of systems with endpoint protection installed is a coverage metric that does not reflect the actual performance of the security controls or their impact on incident costs; it ignores detection efficacy, response quality, and business outcomes.
An organization is subject to GDPR and experiences a data breach involving personal data. What is the maximum timeframe to notify the supervisory authority?
GDPR mandates notification within 72 hours.
Why this answer
GDPR requires notification within 72 hours of becoming aware of the breach.
After a data breach involving personal data of EU residents, the incident manager must ensure compliance with GDPR notification requirements. Within how many hours must the organization notify the relevant supervisory authority of the breach?
GDPR requires notification within 72 hours of awareness.
Why this answer
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
Which TWO of the following are indicators of a potential security incident?
May indicate malware or unauthorized activity.
Why this answer
Multiple unexpected system reboots (B) are a strong indicator of a potential security incident because they may result from malware, kernel-level exploits, or denial-of-service attacks that crash the operating system. Unusual outbound network traffic from a server (E) often indicates data exfiltration, command-and-control (C2) communication, or a compromised service sending sensitive data to an external host. Both behaviors deviate from baseline operations and warrant immediate investigation under the Incident Management domain.
Exam trap
ISACA often tests the distinction between operational issues (like low disk space) and true security incident indicators, trapping candidates who confuse performance alerts with signs of compromise.
Which control selection framework includes implementation groups (IG1, IG2, IG3) that help organizations prioritize controls based on their risk profile?
CIS Controls v8 uses IG1, IG2, IG3 for prioritization.
Why this answer
CIS Controls v8 organizes controls into Implementation Groups (IG1, IG2, IG3) to guide prioritization. NIST SP 800-53 uses families, and ISO 27001 uses Annex A controls.
An organization's security monitoring system detects multiple failed login attempts from an internal IP address to a critical database server. The attempts are occurring every few seconds. What is the FIRST step the incident response team should take?
Verification prevents unnecessary actions and confirms the incident.
Why this answer
The first step is to verify if the activity is legitimate or malicious to avoid false positives and understand the context.
A security analyst detects unusual outbound network traffic from a database server to an unknown IP address. The traffic uses encrypted connections on port 443. Which type of attack is MOST likely occurring?
Encrypted outbound traffic to an unknown IP is a classic sign of data exfiltration.
Why this answer
The encrypted outbound traffic on port 443 (HTTPS) from a database server to an unknown IP is a classic indicator of data exfiltration. Attackers often use encrypted channels to bypass network security controls, as the contents of the traffic cannot be inspected by DLP or IDS/IPS systems. The database server is a high-value target for sensitive data, making this the most likely attack scenario.
Exam trap
The trap here is that candidates may confuse the encrypted traffic on port 443 with legitimate database replication or backup traffic, but the unknown destination IP and unusual outbound pattern from a database server are key red flags for exfiltration, not a normal administrative function.
How to eliminate wrong answers
Option B is wrong because SQL injection is an initial access or data manipulation technique that typically generates database query errors or unexpected SQL traffic, not encrypted outbound connections to unknown IPs. Option C is wrong because ransomware usually involves file encryption and ransom notes, often using known C2 servers or SMB/HTTP for propagation, not stealthy encrypted outbound data streams from a database server. Option D is wrong because a denial of service attack aims to overwhelm resources with high-volume traffic, not stealthy encrypted connections on a single port to an unknown IP.
Refer to the exhibit. A company implements this data classification scheme. Which risk is most likely introduced by this scheme?
Without an 'Internal' label, internal data may be labeled Public, exposing it unintentionally.
Why this answer
The classification scheme shown in the exhibit (likely a simple three-tier model: Public, Internal, Confidential) fails to include a distinct 'Restricted' or 'Highly Confidential' tier for the most sensitive data. This forces all non-public data into the 'Internal' bucket, which is then handled with the same baseline controls as moderately sensitive information. The primary risk is under-classification of truly sensitive internal data, leading to inadequate access controls and potential exposure.
Exam trap
The trap here is that candidates often focus on the administrative burden of over-classification (Option A) instead of recognizing that the missing high-sensitivity tier creates a dangerous gap where sensitive data is under-classified and exposed.
How to eliminate wrong answers
Option A is wrong because over-classification would increase administrative burden, but the scheme's lack of a high-sensitivity tier actually encourages under-classification, not over-classification. Option C is wrong because the ability to audit data access depends on logging and monitoring controls, not on the classification labels themselves; the scheme does not inherently prevent auditing. Option D is wrong because inconsistent handling of confidential data is a symptom of a poorly defined scheme, but the most direct and likely risk introduced by this specific gap (missing a high tier) is under-classification of internal data, not inconsistency in handling.
A large financial institution is maturing its information security program and wants to move from a reactive to a proactive posture. Which of the following initiatives would best support this transition?
Threat intelligence provides actionable information to prevent attacks before they occur.
Why this answer
Establishing a threat intelligence unit directly supports a proactive posture by enabling the organization to anticipate and prepare for emerging threats based on adversary tactics, techniques, and procedures (TTPs). Unlike reactive measures, this initiative shifts focus from responding to incidents to preventing them by sharing actionable indicators across the enterprise, aligning with the CISM goal of maturing the security program toward proactive risk management.
Exam trap
The trap here is that candidates often confuse proactive security with reactive vulnerability management or detection improvements, mistakenly selecting bug bounty programs or SOC staffing increases because they seem forward-looking, when in fact only threat intelligence directly addresses the proactive shift by focusing on adversary behavior and prevention.
How to eliminate wrong answers
Option A is wrong because deploying an automated compliance monitoring tool is primarily a reactive or detective control that ensures adherence to existing policies and regulations, not a proactive initiative that anticipates or prevents threats. Option B is wrong because implementing a bug bounty program is a reactive vulnerability discovery mechanism that relies on external researchers to find flaws after deployment, rather than proactively analyzing adversary behavior to prevent attacks. Option D is wrong because increasing the number of SOC analysts enhances incident detection and response capabilities, which is still a reactive function focused on handling alerts and incidents as they occur, not on proactively identifying and mitigating threats before they materialize.
A CISO is evaluating security metrics for reporting to the board. Which TWO of the following are leading indicators?
Leading indicator of user awareness.
Why this answer
Leading indicators are proactive measures. Phishing click rate predicts future breaches, and patch compliance indicates current vulnerability posture. Breach count and MTTD are lagging, and number of security tools is not a performance metric.
A retail company's security governance includes a policy that all software must be approved by a security committee. This delays critical business applications. The CIO complains. How should the CISO adjust governance?
Speeds up low-risk approvals while maintaining security.
Why this answer
A risk-based approval process with expedited paths allows the security committee to focus on high-risk software while fast-tracking low-risk or critical business applications. This balances security governance with business agility, addressing the CIO's complaint without compromising security. It aligns with CISM's emphasis on aligning security with business objectives through risk management.
Exam trap
The trap here is that candidates may choose automation (Option D) thinking it solves delays, but without risk-based triage, automation just accelerates a flawed process that still treats all software equally, failing to address the CIO's core concern about critical business applications being delayed.
How to eliminate wrong answers
Option A is wrong because increasing meeting frequency does not address the root cause of delay; it merely adds more meetings without streamlining the approval process, which could still bottleneck critical applications. Option C is wrong because removing the approval requirement entirely eliminates governance, exposing the company to unvetted software that could introduce vulnerabilities or compliance violations. Option D is wrong because automating the current approval process without changing its criteria would still require committee review for every submission, merely speeding up the same bottleneck rather than differentiating based on risk.
A CISO wants to present a high-level security status to the board using a one-page dashboard. Which of the following metrics is MOST appropriate for this audience?
Leading indicators that show risk trends and control effectiveness.
Why this answer
Leading indicators like phishing click rate and patch compliance are actionable and forward-looking, suitable for board-level oversight.
A company's security program includes a policy that all employees must use strong passwords and change them every 90 days. However, the recent internal audit shows that 60% of employees have passwords that do not meet the strength requirements. What is the most effective corrective action?
Technical enforcement (e.g., complexity rules) ensures compliance.
Why this answer
Implementing technical controls, such as password complexity requirements and automated enforcement, ensures compliance without relying solely on user behavior. Option A is wrong because manual audits detect non-compliance but do not prevent it. Option B is wrong because training alone is insufficient to enforce policy.
Option D is wrong because extending the password change interval does not address the root cause of weak passwords.
Which of the following is the primary purpose of a Key Risk Indicator (KRI)?
KRIs indicate potential risk changes.
Why this answer
A Key Risk Indicator (KRI) is a metric used to provide an early warning signal that a risk exposure is approaching or exceeding acceptable thresholds. Unlike lagging indicators that report on past events, KRIs are forward-looking, enabling proactive risk mitigation before a risk materializes into a loss.
Exam trap
The trap here is that candidates often confuse KRIs with KPIs or KCIs, mistakenly thinking KRIs measure past performance or control effectiveness, when in fact KRIs are specifically designed to provide leading indicators of changing risk exposure.
How to eliminate wrong answers
Option B is wrong because reporting on past incidents and losses is the function of a Key Performance Indicator (KPI) or a loss event metric, not a KRI, which is forward-looking. Option C is wrong because measuring the effectiveness of security controls is the role of a Key Control Indicator (KCI) or control effectiveness metric, not a KRI, which focuses on risk exposure. Option D is wrong because demonstrating compliance with regulations is typically achieved through compliance audits and control testing, not through KRIs, which are designed to signal changes in risk levels rather than adherence to regulatory requirements.
Match each security control type to its example.
Drag a concept onto its matching description — or click a concept then click the description.
Firewall blocking unauthorized traffic
Intrusion detection system alerting on anomalies
Restoring system from backup after breach
Security warning banners on login
Additional authentication for legacy systems
Why these pairings
The correct matches are: Preventive controls prevent incidents (e.g., firewall), Detective controls identify incidents (e.g., IDS), Corrective controls fix issues (e.g., backup/restore), and Deterrent controls discourage attacks (e.g., warning signs). Options E and F are common confusions where definitions are swapped.
A security team detects lateral movement within the network using PowerShell scripts. Which TWO actions are MOST effective to contain the threat?
Prevents further use of PowerShell for lateral movement.
Why this answer
Disabling PowerShell remoting (WinRM) on all systems is a highly effective containment action because it directly cuts off the primary channel used for lateral movement via PowerShell scripts. Attackers frequently abuse WinRM (port 5985/5986) and PowerShell's `Invoke-Command` or `Enter-PSSession` to move laterally, so disabling this service blocks that specific attack vector without requiring immediate system isolation.
Exam trap
CISM emphasizes the distinction between containment and remediation. The trap here is that candidates confuse 'isolating affected systems' (which is correct) with 'applying patches' (which is remediation, not containment), or they mistakenly think memory forensics is a containment action when it is actually part of the investigation phase.
Which role within a security team is primarily responsible for designing and reviewing security architectures to ensure alignment with business requirements and security standards?
Security architects design and review security solutions and architectures.
Why this answer
The security architect designs and reviews the security architecture, ensuring it meets business needs and security requirements. Other roles focus on operations, analysis, or awareness.
Which THREE of the following are responsibilities of the board of directors regarding information security governance?
The board ensures the strategy aligns with business goals.
Why this answer
The board of directors is responsible for high-level governance, including approving the information security strategy to ensure alignment with business objectives. This strategic oversight ensures that security initiatives support organizational goals and comply with regulatory requirements, rather than involving hands-on technical execution.
Exam trap
The trap here is confusing governance (board-level strategic oversight) with management (operational execution), leading candidates to select hands-on tasks like incident response or vulnerability scanning as board responsibilities.
An organization maintains evidence handling procedures for incident response. A forensic investigator needs to collect a hard drive from a compromised server. Which of the following is the MOST critical step to ensure admissibility in court?
Chain of custody proves evidence hasn't been tampered with.
Why this answer
Chain of custody documentation is essential for evidence integrity and admissibility.
The SIEM alerts on this traffic. What should the incident analyst do FIRST?
Isolating the host is the first step in incident response to contain the threat and prevent further compromise. This aligns with the containment phase of the NIST SP 800-61 lifecycle.
Why this answer
The SIEM alert indicates suspicious traffic, and the first priority in incident response is containment to prevent further damage or lateral movement. Isolating the host (Option A) immediately stops the potential threat from communicating with the network, allowing for a safe forensic investigation. This aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized before eradication or recovery.
Exam trap
ISACA CISM emphasizes that containment (isolating the host) must precede any investigative or remediation steps like blocking IPs or verifying destinations, as candidates may mistakenly prioritize analysis over immediate action.
How to eliminate wrong answers
Option B is wrong because accepting the traffic as normal without investigation ignores the SIEM alert, which is a failure of the detection and analysis phase; the alert indicates a potential security event that requires verification. Option C is wrong because blocking the IP at the firewall is a reactive measure that may disrupt legitimate services if the IP is spoofed or shared (e.g., via a CDN), and it does not address the compromised host itself, which could still be used for other malicious activities. Option D is wrong because checking if the destination is a legitimate CDN is a secondary step that should occur after containment; the immediate priority is to stop the threat, not to validate the destination, as the alert could indicate a command-and-control (C2) channel using a legitimate CDN as a front.
Which is a key component of an information security program?
Policies establish the governance framework for the program.
Why this answer
A security policy is the foundational component of an information security program because it defines the organization's strategic direction, governance structure, and high-level principles for protecting information assets. Unlike specific technologies (encryption, firewalls, antivirus), the policy establishes the rules, roles, and responsibilities that drive the selection and implementation of all security controls. Without a policy, technical measures lack context, authority, and alignment with business objectives.
Exam trap
CISM often tests the distinction between governance (policy) and operational controls (technology), trapping candidates who confuse a tactical tool like a firewall or antivirus with the strategic program component that defines the security program's scope and authority.
How to eliminate wrong answers
Option A is wrong because encryption technology is a specific technical control that protects data confidentiality, but it is not a program-level component; it is a tool deployed under the policy's guidance. Option B is wrong because a firewall is a network security device that filters traffic based on rules, but it is an operational control, not a strategic program component. Option C is wrong because antivirus software is a host-based endpoint protection tool that detects and removes malware, but it is a tactical solution, not a governance element of the security program.
Refer to the exhibit. Given the exhibit, which type of incident is MOST likely occurring?
The user's behavior—accessing and exfiltrating sensitive data—is characteristic of an insider threat.
Why this answer
The exhibit shows a user logging in from an unusual location, attempting unauthorized access, and then exfiltrating sensitive data. This pattern is indicative of an insider threat, as it involves a legitimate user performing malicious actions. Option C (Insider threat) is correct.
Based on the exhibit, what is the most significant security gap in this configuration?
Without prevention, attacks may succeed before manual response.
Why this answer
The intrusion detection system (IDS) is configured in alert-only mode, meaning it can only generate alerts and cannot take action to block or drop malicious traffic. This is a significant security gap because, unlike an intrusion prevention system (IPS), an IDS operates out-of-band and relies on manual intervention or separate security controls to stop attacks, leaving the network vulnerable during the response delay.
How to eliminate wrong answers
Option B is wrong because CIS Level 1 is a foundational baseline that focuses on essential security controls with minimal operational impact; it is not inherently 'too permissive' and is widely recommended as a starting point for hardening. Option C is wrong because allowing inbound HTTPS (TCP/443) from any source to web servers is a standard and necessary configuration for public-facing web services, provided the web servers are properly hardened and patched. Option D is wrong because exposing database port 3306 (MySQL) to web servers without encryption is a risk, but it is less significant than the IDS being unable to block attacks; database traffic can be encrypted with TLS or SSH tunneling, and the web server is a trusted internal component in many architectures.
A CISO is presenting a security metrics dashboard to the board. Which TWO metrics are most appropriate for board-level reporting? (Select TWO.)
Demonstrates ROI and is strategic.
Why this answer
Board-level metrics should focus on strategic outcomes such as incident response and financial impact.
An organization is updating its incident response plan after a lessons learned meeting. Which of the following is the primary purpose of updating the plan based on lessons learned?
Updating the IR plan with changes identified in lessons learned helps prevent similar incidents and improve response.
Why this answer
The primary purpose is to incorporate improvements to prevent recurrence and improve response effectiveness.
A security metrics program should include key performance indicators (KPIs) for board reporting. Which metric is most appropriate for executive oversight?
MTTD is a strategic metric for board visibility.
Why this answer
Mean time to detect is a high-level metric that reflects security effectiveness.
TechStart, a cloud-based startup, has rapidly grown from 50 to 500 employees. It lacks a formal security governance structure. The CEO asks the CISO to develop one. The CISO finds that the company's culture values speed over compliance. The board expects a governance framework within three months. What is the most practical approach?
This balances speed with essential governance.
Why this answer
The most practical approach because it balances the need for governance with the company's culture of speed. Starting with a lean governance model allows the organization to quickly establish controls for critical assets and meet compliance requirements without overwhelming the team. Option A is too heavy; a full COBIT implementation would be disruptive and counter to the culture.
Option B is risky as it postpones governance, potentially leading to non-compliance. Option D focuses only on technical controls, ignoring the broader governance framework needed.
Which THREE of the following are incident severity levels defined in a typical incident management program? (Select three.)
P3 has limited impact and standard response.
Why this answer
Common severity levels include P1 (critical), P2 (high), P3 (medium), and P4 (low). P0 is not standard; P5 is not used.
An incident response team is conducting an exercise to test its playbook for a ransomware incident. Which of the following is the PRIMARY benefit of such an exercise?
Plan validation and improvement are key objectives.
Why this answer
Exercises validate the effectiveness of the plan and identify gaps before a real incident.
Practice CISM by domain
Target a specific domain to shore up weak areas.