How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the CISM exam, each with detailed explanations and wrong-answer analysis.

How should I approach CISM scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Information Security Manager CISM questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Certified Information Security Manager CISM practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CISM

exam code

ISACA

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymulti select

Full question →

Which of the following are key components of an information security program? (Select TWO)

B
A network architecture diagram
Why wrong: This is a technical artifact, not a core program component.
D
An incident response log
Why wrong: This is an operational record, not a program component.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related CISM topic practice pages

Information Security Program practice questions

Information Security Risk Management practice questions

Information Security Governance practice questions

Incident Management practice questions

CISM fundamentals practice questions

CISM scenario practice questions

CISM troubleshooting practice questions

Practice scenarios

Which of the following are key components of an information security program? (Select TWO)

Which TWO of the following are primary objectives of information security governance? (Choose two.)

Which TWO of the following are best practices for preserving digital evidence during an incident? (Select exactly 2)

Which TWO of the following are key indicators of a potential insider threat incident? (Select exactly 2)

Which TWO actions are appropriate during the containment phase of an incident involving a malware outbreak on multiple workstations?

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Which TWO of the following are key responsibilities of an information security governance committee?

Which TWO of the following are key components of an effective incident response plan?

Which TWO of the following are indicators of a potential security incident?

Which of the following are key components of an Information Security Risk Management program? (Select TWO.)

Which of the following are key components of an information security risk management program? (Select TWO)

A security manager is presenting risk analysis results to the board. Which of the following should the manager include to effectively communicate risk? (Select THREE)

Which of the following are key components of an effective information security program? (Select TWO.)

An information security manager is evaluating the maturity of the organization's security program. Which of the following indicators suggest a high level of maturity? (Select TWO.)

Which THREE of the following are essential roles in an effective information security governance structure? (Choose three.)

Which TWO of the following are key components of an information security governance framework? (Choose two.)

Which THREE of the following are common challenges in incident response? (Select exactly 3)