How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the CISM exam, each with detailed explanations and wrong-answer analysis.

How should I approach CISM scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Information Security Manager CISM questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Certified Information Security Manager CISM practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CISM

exam code

ISACA

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related CISM topic practice pages

Information Security Governance practice questions

Incident Management practice questions

Information Security Programme practice questions

Information Security Program practice questions

Information Security Risk Management practice questions

CISM fundamentals practice questions

CISM scenario practice questions

CISM troubleshooting practice questions

Practice scenarios

An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)

Which THREE of the following are typical roles in an incident response team?

Which TWO of the following are incident categories in an incident management programme?

An organization is implementing an identity and access management (IAM) program. Which THREE of the following are key components of a mature IAM program?

An organization is designing a policy exception management process. Which THREE elements are critical for this process to be effective?

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Which THREE of the following are challenges in implementing information security governance in a decentralized organization?

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Which THREE of the following are appropriate members of a crisis management team (CMT) for a major cybersecurity incident? (Select three.)

Which THREE of the following are common challenges in incident response? (Select exactly 3)

Which TWO actions are essential during the detection and analysis phase of incident response?

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)

An information security manager is developing a security program for a multinational organization. Which of the following should be considered when defining the program scope? (Select THREE)

Which of the following are key components of an information security program's strategic plan? (Select two.)

Which THREE are valid sources for threat intelligence that can be used during incident response? (Choose three.)

Which THREE of the following are common challenges when implementing a risk management program in an organization? (Choose three.)

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

A security manager is measuring the security culture of the organization. Which three metrics are most appropriate?

An organization is updating its security governance framework. Which three elements are essential for ensuring board-level oversight?