Certified Information Security Manager CISM (CISM) — Questions 601–675

Strategic alignment of security with business objectives (Option C) is essential because an information security governance framework must ensure that security initiatives directly support and enable the organization's mission and goals. Without this alignment, security becomes a siloed cost center rather than a strategic enabler, leading to misallocated resources and reduced executive sponsorship. This principle is foundational to the CISM governance domain, where security is viewed as a business function, not just a technical discipline.

Having a pre-existing retainer agreement reduces time to engage and ensures terms are already in place.

Mean time to detect (MTTD) directly measures the speed of threat detection, a key indicator of detection capability.

When a control is implemented but the risk level remains unchanged, the risk manager must first re-assess the risk and control effectiveness to determine why the control failed to reduce the risk. This aligns with the CISM risk management process, which mandates that controls be evaluated for proper design and operation before any escalation or acceptance decisions are made. Without this re-assessment, the organization cannot know whether the control is misconfigured, insufficient, or simply not addressing the correct threat vector.

Federated governance (Option C) is the correct choice because it establishes a global security framework with mandatory standards (e.g., ISO 27001 controls, encryption baselines like AES-256) while delegating implementation and oversight to regional units. This structure balances consistency with local legal requirements (e.g., GDPR in Europe, PIPL in China) and operational needs, avoiding the rigidity of full centralization or the fragmentation of full decentralization.

Security analysts are responsible for alert triage and investigation.

The audit/risk committee is responsible for oversight of risk management and control, including security.

Root cause analysis should continue to identify why the password policy was not enforced or why it was inadequate, which is a process failure.

A risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.

Benchmarking against industry standards (0.2-0.5% of revenue) and showing the gap provides a compelling case.

Leading indicators predict future performance; patch compliance measures proactive risk reduction.

After recovering from a ransomware attack and restoring systems from backups, the most critical step is to test the restored systems for both functionality and security. This ensures that the backups are clean (free of malware), that system integrity is verified, and that no residual threats remain before returning to normal operations. Without this validation, the organization risks re-infection or operational failures that could undermine the entire recovery effort.

Aligning the information security program with business objectives is primarily aimed at gaining management buy-in and support. When security initiatives are directly tied to business goals, management is more likely to understand their value and provide the necessary resources and authority. Regulatory compliance (A) is a requirement but not the primary reason; technical controls (B) are a means to an end; cost reduction (C) may be a secondary benefit but not the main driver.

A communication plan is essential because it defines how the incident response team will coordinate internally and notify external stakeholders such as regulators, law enforcement, customers, and the media. Without a predefined communication plan, critical updates may be delayed or mishandled, leading to regulatory penalties or reputational damage. This aligns with NIST SP 800-61 and CISM best practices for incident management.

Budget authority is a fundamental element of a security governance charter because it establishes the financial resources and spending power necessary to implement and maintain the security program. The charter must define who has the authority to approve security-related expenditures, ensuring that governance bodies can enforce policies and fund initiatives without organizational friction.

Security champions serve as liaisons, promoting security practices and facilitating communication between security and development teams.

Disabling the user account immediately stops any ongoing misuse of the compromised credentials, preventing the attacker from accessing additional resources. Option A is correct.

The BC/DR plan typically specifies a designated authority, such as the CEO or a crisis management team, to declare a disaster when MTD is breached.

Level 4 (Managed) involves quantitative measurement and control of processes.

An insider threat is the correct category because it specifically involves harm caused by individuals within the organization, whether through malicious intent (e.g., data exfiltration, sabotage) or accidental actions (e.g., misconfiguration, phishing click). This aligns with the CISM definition of insider threats as incidents originating from employees, contractors, or trusted partners who have authorized access to information systems.

The crisis management team is typically activated by the incident response manager or a designated authority when an incident has major business impact. The CMT includes senior executives like CEO, CFO, CISO, GC, and Communications lead.

The first step in incident response is to investigate and confirm the alert (triage) to avoid acting on false positives.

The first step in incident response is to verify and validate the alert. Contacting the server owner to confirm whether the outbound traffic is authorized prevents unnecessary disruption and false positives. This aligns with the NIST SP 800-61 incident response lifecycle, where identification and initial triage precede containment or escalation.

Lessons learned meetings are designed to identify strengths and weaknesses in the incident response process and to implement improvements.

An incident response plan must include a list of external contacts such as law enforcement, legal counsel, and regulatory bodies. This ensures that when a security incident occurs, the organization can quickly notify the appropriate authorities and comply with legal and regulatory requirements, such as breach notification laws under GDPR or HIPAA.

After implementing initial controls (spam filtering and user awareness training), the organization must evaluate the residual risk—the risk that remains after controls are applied. This step is required by the CISM risk management process to determine whether the residual risk level is acceptable or if additional controls are needed. Option B correctly follows the risk assessment lifecycle: identify risk, apply controls, assess residual risk, then decide on further action.

The percentage of employees who correctly identify a phishing email in simulations directly measures the behavioral outcome of the awareness program. A high detection rate indicates that employees are applying the training to recognize social engineering tactics, such as spoofed sender addresses or malicious links, which is a key performance indicator (KPI) for program effectiveness.

A risk appetite framework (Option B) is the correct governance approach because it explicitly defines the level of risk the organization is willing to accept in pursuit of innovation, allowing the board to balance patient data protection with strategic growth. This framework provides a decision-making boundary for security controls, ensuring that innovation initiatives are not stifled by overly restrictive measures while still maintaining compliance with healthcare regulations like HIPAA and HITECH.

The simultaneous logon from two geographically impossible locations indicates a classic credential theft and replay attack, likely using a pass-the-hash or token theft technique. Disabling the account and resetting the password immediately stops the attacker's access, which is the highest priority in incident response. A forensic investigation must follow to identify the attack vector (e.g., Kerberos ticket theft, LSASS dump) and assess the scope of compromise, as the absence of other indicators does not rule out lateral movement or persistence.

The exhibit shows multiple failed authentication attempts (Event ID 4625) from a single user account within a short time window, followed by a successful logon (Event ID 4624) and then an access event to a file share (Event ID 5140). This pattern of rapid, repeated failures culminating in a single success is characteristic of a brute-force attack, where the attacker guesses the password and then uses the compromised credentials to access a file server.

Data classification starts with defining categories, then procedures, training, labeling, and monitoring.

Volatile data, such as the contents of RAM, is lost when a system is powered off. The first priority during incident response is to capture this data because it contains running processes, network connections, encryption keys, and malware that exist only in memory. Collecting RAM first ensures that this critical evidence is preserved before any other actions that might alter the system state.

Security champions act as liaisons within development teams, promoting security best practices and improving collaboration.

A legal hold is essential because it suspends the normal data retention and deletion policies, ensuring that potentially relevant evidence is preserved from alteration or destruction. This is a foundational step in the e-discovery process and directly supports the admissibility of evidence by demonstrating that the organization took proactive steps to prevent spoliation.

Regulatory notifications must include a description of the incident, data involved, and mitigation steps, while avoiding speculation.

NIST SP 800-61 (Computer Security Incident Handling Guide) is the definitive U.S. government standard for incident response processes, covering preparation, detection, containment, eradication, and recovery. It provides detailed, step-by-step guidance for building an incident response plan, making it the primary reference for aligning with industry best practices.

Key risk indicators (KRIs) provide a forward-looking, quantifiable measure of risk exposure tied directly to critical assets, which is essential for the board to understand the effectiveness of governance and risk management. Unlike operational or tactical data, KRIs enable informed strategic decisions about risk appetite and resource allocation, aligning with the CISM focus on governance over management.

Performing a root cause analysis (RCA) is the next best action because it systematically identifies the underlying vulnerability or control weakness that allowed the account compromise. Without understanding how the attacker gained access—whether through phishing, credential stuffing, or a software vulnerability—simply disabling the account does not prevent recurrence. The RCA will inform targeted remediation, such as patching, policy changes, or implementing multi-factor authentication (MFA).

The roadmap must align security initiatives with the organization's strategic business objectives to ensure relevance and support.

When mitigation cost exceeds potential loss, risk acceptance is appropriate if the risk is within the organization's risk appetite. Alternatively, risk transfer (e.g., insurance) could be considered, but acceptance is often the primary choice when the cost-benefit is negative.

Root cause analysis should identify technical, process, and management failures.

P2 incidents require management notification and a response during business hours.

The 'internal processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of the operational workflows that deliver the security program. Mean time to detect (MTTD) and mean time to respond (MTTR) directly measure the performance of the incident response process, which is a core internal process. This metric reflects how quickly the organization can identify and contain threats, making it the most appropriate choice for this perspective.

Governance requires that the organization retains ultimate responsibility for security outcomes, even when functions are outsourced. Without the ability to maintain oversight and accountability, the company cannot ensure that its security posture aligns with business risk tolerance and regulatory compliance requirements. This is a fundamental principle of information security governance, as the board and senior management cannot delegate accountability.

The security scorecard with overall risk level is the most appropriate metric for a one-page executive summary because it provides a high-level, aggregated view of the organization's security posture. Executives need a concise, actionable summary that distills complex security data into a single risk indicator, enabling quick decision-making without technical details.

Supply chain incidents require specific procedures for vendor coordination, technical response, and communication.

Data privacy regulations (e.g., GDPR, CCPA, LGPD) base their notification requirements on the residency or location of the affected data subjects, not on where the breach originated or where the company's executives sit. The incident response team must map the affected PII to the specific jurisdictions whose laws impose breach notification duties, making the location of the affected individuals the primary driver for determining which regulatory bodies to inform.

Developers need specialized training on secure coding practices to reduce vulnerabilities in applications.

A security champions programme embeds security advocates within development teams to promote secure practices, improve communication, and embed security into daily work, rather than incident response or policy enforcement.

Legal hold prevents spoliation of evidence; it must be issued before any remediation that could alter data.

Phishing click rate is a leading indicator because it predicts future incidents by measuring current behavior.

Risk level, calculated as likelihood multiplied by impact, is the primary factor for prioritizing remediation because it quantifies the overall exposure to the organization. While regulatory requirements, likelihood alone, or ease of remediation are important considerations, they do not capture the combined effect of both probability and consequence, which is essential for effective risk management in an information security program.

Translating risk into potential financial impact (Option C) is the best approach because it aligns risk with business objectives, enabling senior management to make cost-benefit decisions. Financial quantification, such as Annualized Loss Expectancy (ALE), provides a common language that executives understand, directly supporting informed decision-making on risk treatment options.

CIS Controls v8 defines Implementation Groups (IG1, IG2, IG3) that prioritize controls based on organizational maturity, starting with the most foundational and critical controls.

Security champions act as liaisons in development teams, promoting security practices and facilitating communication with the security team.

The IR plan should include pre-established contacts and procedures; contacting the ISP and mitigation service should follow the plan's escalation process.

The first step in incident response is to validate the alert. The analyst must verify that the traffic is indeed anomalous and not legitimate (e.g., a large backup or software update) by examining logs and packet captures. Premature action without verification could disrupt business operations or destroy forensic evidence.

Preserving evidence includes creating forensic images and issuing legal holds to prevent spoliation. Disconnecting systems without imaging and rebooting can destroy evidence.

The configuration indicates that the standard playbook will be executed, the incident response team will be notified, and containment actions will be automatically applied. Priority override is set to false, so no override occurs. Therefore, option A correctly describes the expected behavior.

Lessons learned meetings aim to identify what happened, what worked well, and what didn't, and to develop recommendations for improvement. Sharing IoCs with ISACs is a separate activity, not a meeting objective.

A risk-based prioritization framework directly maps security initiatives to the organization's risk appetite, ensuring that investments target the most critical business risks. This aligns with the CISM principle that governance must link security activities to business objectives through risk management, not through arbitrary cost-cutting or blanket compliance.

A is correct because effective incident response requires structured communication procedures to coordinate with internal stakeholders (e.g., management, legal, PR) and external parties (e.g., law enforcement, regulators, customers). Without predefined communication channels, critical updates may be delayed or mishandled, increasing organizational risk.

The exhibit shows an access control list (ACL) that denies all traffic from any source to the 10.0.0.0/8 network. Since the ACL is applied inbound on the internet-facing interface, any traffic originating from the internet destined for the internal network 10.0.0.0/8 is implicitly denied by the explicit deny statement. Therefore, option B is correct: all traffic from the internet to the internal network is denied.

Unusual outbound network traffic is a key indicator of a data breach because it often signals data exfiltration, where an attacker is transferring stolen data to an external command-and-control (C2) server or a cloud storage endpoint. This traffic may involve unexpected protocols (e.g., DNS tunneling, HTTPS to unknown IPs) or large volumes of data leaving the network at odd hours, which can be detected by network traffic analysis tools like NetFlow or intrusion detection systems (IDS).

The CISO is responsible for developing and implementing the security program, reporting to executive leadership.

After isolating affected systems, the next priority is to contain the incident by identifying and isolating any additional compromised systems to prevent further spread, and to notify law enforcement as required by legal and regulatory obligations. This aligns with the Incident Response (IR) process, specifically the Containment, Eradication, and Recovery phases, where containment must precede any recovery attempts to avoid re-infection.

The security architect designs the overall security structure, including policies, technologies, and controls. Other roles focus on operations, analysis, or governance.

Leading indicators are proactive and predictive. Phishing click rate (user behavior) and patch compliance (vulnerability management) are leading indicators.