How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 12 Refer to the Exhibit Practice Questions scenario questions for the CISM exam, each with detailed explanations and wrong-answer analysis.

How should I approach CISM scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Information Security Manager CISM questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Certified Information Security Manager CISM practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CISM

exam code

ISACA

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

Based on the exhibit, what is the MOST likely scenario?

Exhibit

Refer to the exhibit.

Exhibit:

Event Log Entry:
Time: 2023-10-05 14:23:17
Event ID: 4625
Source: Security
User: SYSTEM
Logon Type: 3
Account Name: jdoe
Account Domain: CORP
Failure Reason: Unknown user name or bad password.
Workstation Name: WS-001
IP Address: 192.168.1.50

Event Log Entry:
Time: 2023-10-05 14:24:05
Event ID: 4624
Source: Security
User: SYSTEM
Logon Type: 3
Account Name: jdoe
Account Domain: CORP
Workstation Name: WS-001
IP Address: 192.168.1.50

Event Log Entry:
Time: 2023-10-05 14:25:10
Event ID: 4648
Source: Security
User: jdoe
Logon Type: 2
Account Name: jdoe
Account Domain: CORP
Target Server: FILE-SRV-01
Additional Info: A logon was attempted using explicit credentials.
Workstation Name: WS-001
IP Address: 192.168.1.50

A
A user is performing a scheduled task that requires authentication.
Why it fails: A scheduled task authenticates non-interactively, so it cannot produce the interactive sign-in pattern shown in the exhibit. This option is tempting because scheduled tasks genuinely generate authentication events, and they would be the right answer if the log showed a service account signing in silently at a fixed interval.
B
A user forgot their password and successfully logged in after retrying.
Why it fails: A forgotten password followed by a successful retry would show repeated failed authentications from one account, then a success — not the exhibit's pattern. This option is tempting because password-reset lockouts are common helpdesk events, and retry-then-success genuinely fits a single-user mistake scenario, but the exhibit's evidence points elsewhere.
C
An attacker brute-forced the password and then used the credentials to access a file server.
Repeated failed authentications followed by a successful logon and subsequent file-server access match credential brute forcing: the attacker guesses the password, then uses the valid account to reach data. The sequence links authentication abuse directly to the file access.
D
A system administrator is testing password policies.
Why it fails: A password-policy test would generate lockout and reset events, not the exhibit's pattern of privileged role assignments followed by resource creation across subscriptions. Policy testing is legitimate when validating complexity, expiry or lockout thresholds in a lab tenant. Here the sequence indicates credential compromise and privilege escalation, not policy validation.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. An organization uses these firewall rules. After a breach, the IR team finds that the attacker gained access via SSH from an external IP. Which rule is most likely misconfigured?

Exhibit

Firewall Rule (inbound): allow tcp any any 22 (SSH) log
Firewall Rule (inbound): allow tcp 10.0.0.0/24 any 3389 (RDP) log
Firewall Rule (inbound): allow tcp any any 80 (HTTP) log
Firewall Rule (inbound): allow tcp any any 443 (HTTPS) log
Firewall Rule (inbound): allow tcp 10.0.0.0/24 any 3306 (MySQL) log

A
MySQL should be blocked entirely
Why it fails: The breach came through SSH, so the misconfigured rule is the one permitting SSH from external addresses; MySQL's exposure is unrelated to that access path. Blocking MySQL entirely is tempting as general hardening, but it would not have prevented this SSH intrusion.
B
RDP should not be allowed
Why it fails: RDP exposure is a separate risk and played no part in an SSH-based intrusion. Restricting RDP is tempting because remote-access services are frequent attack vectors, yet the exhibit's SSH rule is what actually allowed the external attacker in, so that rule is the misconfigured one.
C
HTTPS should be inspected
Why it fails: HTTPS inspection concerns content visibility, not the SSH access path the attacker used. It is tempting because deep packet inspection strengthens monitoring generally, but inspecting HTTPS would not have blocked the external SSH connection; the SSH rule itself is misconfigured.
D
SSH is allowed from any source instead of only internal
SSH exposed to any source lets external attackers authenticate directly, matching the breach path described. Restricting the rule to internal addresses only would have blocked the external SSH access the IR team observed, so this overly permissive source scope is the misconfiguration.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

Based on the exhibit, what is the most significant security gap in this configuration?

Exhibit

Refer to the exhibit.

Exhibit:
```
{
  "securityControls": {
    "firewall": {
      "state": "active",
      "rules": [
        {"action": "allow", "src": "any", "dst": "web-servers", "port": 443},
        {"action": "allow", "src": "web-servers", "dst": "db-servers", "port": 3306},
        {"action": "deny", "src": "any", "dst": "any", "port": "any"}
      ]
    },
    "intrusionDetection": {
      "state": "active",
      "signatures": ["critical", "high"],
      "action": "alert"
    },
    "vendorBaseline": "CIS Level 1"
  }
}
```
This JSON policy is for a web application environment. The db-servers network is considered internal.

A
The intrusion detection system is set to alert-only, so it cannot block attacks.
An IDS deployed in alert-only mode detects and logs malicious traffic but cannot drop or block it, leaving attacks unimpeded. This satisfies the stem's requirement by identifying the most significant gap: no preventive enforcement, only passive monitoring.
B
The vendor baseline is CIS Level 1, which may be too permissive.
Why it fails: CIS Level 1 is a recognised hardening baseline, so calling it too permissive misreads the exhibit; the actual gap is a concrete exposed service. It is tempting because baselines can be tuned, and questioning baseline strictness would be correct if the exhibit showed Level 1 settings contradicting a higher mandated profile.
C
The firewall allows inbound HTTPS from any source to web servers.
Why it fails: Inbound HTTPS from any source is normal for public web servers; the exhibit's real gap lies elsewhere. It is tempting because unrestricted source ranges look dangerous, and this would be the correct finding if the web servers were internal-only or if the exhibit showed no other exposure.
D
The database port 3306 is exposed to web servers without encryption.
Why it fails: Port 3306 exposure matters, but the exhibit's most significant gap is the unauthenticated or unrestricted access path, not the absence of encryption on an internal link. It is tempting because cleartext database traffic is a genuine weakness, and this would be correct if the exhibit showed credentials or data crossing an untrusted network.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

Refer to the exhibit. An information security manager reviews the risk register and sees that Risk ID R001 has a residual risk of High with a treatment of Accept. Which of the following best explains why this situation may indicate a governance failure?

Exhibit

Refer to the exhibit.

```
Risk Register Excerpt:
Risk ID: R001
Risk Description: Unauthorized disclosure of sensitive customer data due to weak encryption.
Inherent Risk: High
Control Effectiveness: Partially effective
Residual Risk: High
Risk Owner: CISO
Risk Treatment: Accept
```

A
The risk register should not contain risks with residual risk above low.
Why it fails: Registers legitimately hold High residual risks where treatment is pending or appetite permits; a blanket low-only rule is not a governance requirement. The actual failure is accepting High residual risk without documented authorisation at the level the risk-acceptance policy specifies.
B
The control effectiveness rating of 'Partially effective' is too vague.
Why it fails: Vague control-effectiveness wording is a documentation-quality issue, not a governance failure; a partially effective control can still be recorded precisely. The governance failure lies in accepting a High residual risk without the required authority or sign-off, which is what escalation and acceptance thresholds exist to enforce.
C
Accepting a high residual risk likely exceeds the board-approved risk appetite.
Accepting a high residual risk implies the organisation is tolerating exposure beyond the risk appetite the board approved. Unless the board explicitly sanctioned this acceptance, the decision exceeds delegated authority, indicating governance has failed to enforce its own limits.
D
The risk owner should be a business unit head, not the CISO.
Why it fails: Ownership by the CISO is acceptable where the CISO holds the relevant accountability; governance does not mandate a business unit head. The failure is that a High residual risk was accepted without appropriate senior authorisation, breaching the defined risk-appetite and acceptance-escalation process.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

Based on the exhibit, which role is missing from the governance policy that would be essential for enforcing accountability?

Exhibit

Refer to the exhibit.

```
$ cat governance_policy.json
{
  "policyName": "Information Security Governance Policy",
  "version": "2.0",
  "scope": "All business units and subsidiaries",
  "roles": {
    "board": "Approve risk appetite and review security performance quarterly",
    "ceo": "Provide strategic direction and resources",
    "ciso": "Develop and implement security program",
    "businessManagers": "Ensure compliance within their units",
    "internalAudit": "Independent assurance on governance effectiveness"
  },
  "processes": {
    "riskAssessment": "Annual risk assessment and quarterly updates",
    "strategyAlignment": "Annual review of security strategy with business strategy",
    "reporting": "Quarterly dashboard to board, monthly to management"
  }
}
```

A
External auditor
Why it fails: External auditors give independent opinion on financial statements and controls for third parties; they hold no authority to enforce accountability inside the organisation's governance policy. Tempting because external audit does evaluate governance, and it would be correct if the question concerned independent attestation rather than assigning enforcement responsibility.
B
Internal audit function
Why it fails: Internal audit provides independent assurance to the board, not operational ownership of controls, so it cannot enforce accountability within the governance policy. It is tempting because audit does assess control effectiveness, and it would be the right answer if the stem asked who verifies that accountability mechanisms operate as designed.
C
A role with authority to enforce compliance and impose consequences
A role empowered to enforce compliance and impose consequences supplies the missing accountability mechanism: governance requires an owner who can compel adherence and sanction non-compliance. Without enforcement authority, policies remain advisory, so responsibility cannot be assigned or demonstrated. This satisfies the stem's demand for accountability enforcement within the governance policy.
D
Chief compliance officer
Why it fails: The chief compliance officer monitors adherence to policy but does not own enforcement of accountability for the governance process. Accountability requires an owner role, such as data owner or governance sponsor, who is answerable for decisions. Compliance officers suit independent oversight and reporting.

Full breakdown with real-world context →

Question 6easymultiple choice

Full question →

Given the exhibit, what is the MOST significant governance gap in the described architecture?

Exhibit

Refer to the exhibit.

```
NETWORK ARCHITECTURE DESCRIPTION
- Internet edge: Firewall cluster (active-active) with IPS
- DMZ: Web servers, external-facing applications
- Internal network segregated into VLANs by business unit
- Management network for system administrators
- Security Operations Center (SOC) monitors all traffic
- Remote access via VPN with multi-factor authentication
- Data centers: Tier 3 physical security and environmental controls
```

A
Weak authentication for remote access
Why it fails: Remote-access authentication is a technical control weakness, not the governance gap the exhibit describes, which concerns oversight and decision rights rather than credential strength. It is tempting because weak authentication is a common finding, and would be correct where the scenario asks for the most significant technical vulnerability in remote access.
B
No defined security governance board or oversight mechanism
Without a governance board or oversight mechanism, no one owns risk decisions, policy approval or accountability across the architecture. This absence is the foundational gap: technical controls may exist, but nothing directs or validates them.
C
Insufficient physical security in data centers
Why it fails: Physical data-centre controls sit outside the governance architecture depicted in the exhibit, which concerns logical access and data-flow oversight, so this misdirects attention from the actual gap. It is tempting because physical security is a genuine governance domain, and would be the correct focus where an assessment covers facility controls, environmental protection or site access.
D
Lack of intrusion detection for internal traffic
Why it fails: Internal intrusion detection addresses threat monitoring rather than the governance gap the exhibit exposes, which concerns accountability and control ownership across the architecture. It is tempting because internal traffic visibility is a legitimate security control, and would be the right answer where the scenario's deficiency is detection coverage inside the trusted network.

Full breakdown with real-world context →

Question 7mediummultiple choice

Full question →

According to the exhibit, which role is responsible for conducting forensic analysis?

Exhibit

Refer to the exhibit.
[Incident Response Plan Roles]
Role: Incident Manager - Coordinates response
Role: Technical Lead - Performs analysis
Role: Communication Lead - Handles communications
Role: Legal Counsel - Provides legal guidance

A
Incident Manager
Why it fails: The incident manager coordinates response, communication and escalation, not evidence collection or technical examination. That role suits orchestrating containment and recovery across teams; forensic analysis demands specialist investigators who preserve chain of custody and examine artefacts.
B
Technical Lead
The Technical Lead conducts the forensic analysis, gathering and examining evidence to determine how the incident occurred. This role owns the hands-on investigation, distinguishing it from the Incident Response Manager, who coordinates, and the Communications Lead, who handles messaging.
C
Legal Counsel
Why it fails: Legal counsel interprets obligations, preserves privilege and advises on disclosure, but does not perform technical evidence acquisition or examination. That role suits regulatory and contractual guidance during incidents; forensic analysis requires trained investigators handling chain of custody and artefact examination.
D
Communication Lead
Why it fails: Forensic analysis requires evidence-handling and investigative expertise, which the Communication Lead's remit of stakeholder messaging and breach notification does not include. It is tempting because that role coordinates incident information flows, and would be correct where the scenario asked who drafts external communications during incident response.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Ansible explanation →

Refer to the exhibit. During a ransomware incident, the response team discovers that the backup server is also encrypted. Which phase of the playbook is MOST impacted?

Exhibit

Refer to the exhibit.

---
Incident Response Playbook: Ransomware
Phase 1: Identification - Confirm ransomware via user reports and endpoint alerts.
Phase 2: Containment - Disconnect affected systems from the network. Do not power off.
Phase 3: Eradication - Remove malware using approved tools; reimage if necessary.
Phase 4: Recovery - Restore data from clean backups; verify integrity.
Phase 5: Post-Incident - Conduct lessons learned.
---

A
Phase 5: Post-Incident
Why it fails: Post-incident activity covers lessons learned and reporting, which can still proceed; encrypted backups do not prevent that review. It is tempting because losing backups is a significant finding worth documenting, but the immediate operational impact is the inability to restore data, which falls in the recovery phase.
B
Phase 3: Eradication
Why it fails: Eradication removes malware and rebuilds systems, but encrypted backups do not block that step; recovery is what fails because restore points are unavailable. It is tempting because eradication sounds like the phase handling compromised infrastructure, yet the backup loss specifically defeats restoration, making recovery the impacted phase.
C
Phase 2: Containment
Why it fails: Containment limits spread and isolates affected systems, which remains achievable even when backups are encrypted. It is tempting because backup compromise widens the incident scope, but containment actions do not depend on restore capability; recovery does, since restoration is impossible without intact backups.
D
Phase 4: Recovery
Recovery depends on restoring data from backups, so an encrypted backup server removes the primary restoration path. This directly undermines Phase 4, forcing reliance on offline or immutable copies and delaying service restoration after the ransomware incident.

Full breakdown with real-world context →

Question 9hardmultiple choice

Full question →

Based on the exhibit, what is the MOST likely issue?

Exhibit

Refer to the exhibit.

Exhibit:

Firewall Log:
Date Time Source IP Destination IP Port Protocol Action
2023-10-05 10:00:00 10.0.0.15 203.0.113.5 443 TCP ALLOW
2023-10-05 10:01:00 10.0.0.15 203.0.113.5 443 TCP ALLOW
2023-10-05 10:02:00 10.0.0.15 203.0.113.5 443 TCP ALLOW
... (repeated every minute)
2023-10-05 12:00:00 10.0.0.15 203.0.113.5 443 TCP ALLOW

IDS Alert:
Signature: ET TROJAN Win32/Malicious Beacon
Source IP: 10.0.0.15
Destination IP: 203.0.113.5
Time: 2023-10-05 10:00:00
Severity: High

A
A system is infected with malware that is beaconing to a command and control server.
Regular, periodic outbound connections to the same external address typify malware beaconing, where infected hosts poll a command-and-control server for instructions. The consistent timing and destination distinguish it from ordinary user traffic or one-off downloads.
B
A user is streaming video from a legitimate site.
Why it fails: Streaming video from a legitimate site is ordinary business traffic and does not by itself indicate a security incident, so it fails to explain the exhibit's suspicious pattern. It is tempting because bandwidth spikes and media streams can resemble exfiltration; in a policy-compliance scenario, unauthorised streaming would be the finding.
C
A software update is being downloaded from an external site.
Why it fails: Downloading a software update from an external site is expected patching behaviour and does not account for the exhibit's anomalous traffic pattern. It is tempting because external downloads can carry malware; where the exhibit shows an unsanctioned update mechanism or blocked vendor, that download would be the issue.
D
A network scan is being performed from the internal IP.
Why it fails: An internal network scan is routine administrative activity and does not match the exhibit's external-origin indicators, so it cannot be the most likely issue. It is tempting because port scanning signatures look malicious; in a scenario showing reconnaissance from an internal host, a scan would be the correct interpretation.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

Refer to the exhibit. An audit reveals that 20% of privileged accounts were approved by the same manager without secondary review. Which control deficiency is MOST relevant to this finding?

Exhibit

Access Control Policy:
- Users must be provisioned within 24 hours of request.
- Access reviews are conducted quarterly.
- Privileged accounts require manager approval.
- Default deny for all new accounts.
- Audit logs retained for 90 days.

A
Segregation of duties
One person approving without oversight is a segregation of duties deficiency.
B
Access review frequency
Why it fails: Quarterly reviews are stated; the issue is approval process.
C
Provisioning delay
Why it fails: The finding does not mention timing issues.
D
Audit log retention
Why it fails: Log retention is not relevant to the approval finding.

Full breakdown with real-world context →

Question 11easymultiple choice

Full question →

Refer to the exhibit. The security analyst observes these alerts. What is the MOST likely sequence of events?

Exhibit

Refer to the exhibit.

---
Incident Log:
[2025-03-20 08:15:23] ALERT: Multiple failed logins for user 'jsmith' from IP 10.0.0.45
[2025-03-20 08:16:01] ALERT: Successful login for user 'jsmith' from IP 10.0.0.45
[2025-03-20 08:20:45] ALERT: Unusual outbound connection from host 10.0.0.45 to 198.51.100.10:4444
[2025-03-20 08:22:30] ALERT: Large data transfer from host 10.0.0.45 to 198.51.100.10
---

A
Insider threat: jsmith intentionally exfiltrated data
Why it fails: Failed logins suggest compromise, not intentional action.
B
Attacker compromised jsmith's credentials, established C2, and exfiltrated data
Pattern matches credential compromise, C2, and exfiltration.
C
Network scan from 10.0.0.45 triggered false positives
Why it fails: Data transfer indicates exfiltration, not scan.
D
Malware downloaded on jsmith's workstation and exfiltrated data
Why it fails: No download alert; failed logins indicate credential attack.

Full breakdown with real-world context →

Question 12easymultiple choice

Full question →

Refer to the exhibit. A security manager notices that several contractors have been granted access to a financial system without documented exceptions. Based on the policy, what is the most likely governance deficiency?

Exhibit

Refer to the exhibit.

```
Policy: Access Control
Effective Date: 2024-01-01
Review Date: 2024-12-31
Owner: CISO
Scope: All employees and contractors

Statement: Access to internal systems must be granted based on the principle of least privilege. Exceptions must be approved by the data owner and documented.
```

A
The policy does not specify quarterly review of access rights.
Why it fails: Quarterly review frequency is a recertification control; the stem describes access granted without documented exceptions, so the gap is exception documentation, not review cadence. It is tempting because periodic reviews are real governance requirements, and would be correct if reviews were skipped.
B
The data owner did not approve the exceptions.
Why it fails: The data owner typically approves access, but the stem's deficiency is the absence of documented exceptions, not a missing approval signature. It is tempting because owner authorisation is a genuine control, and would be the answer if exceptions existed but lacked owner sign-off.
C
Contractors should not have any access to financial systems.
Why it fails: A blanket prohibition on contractor access misreads the policy, which permits access where documented exceptions exist; the deficiency is the missing documentation, not the contractor status itself. It is tempting as a strict security stance, and would be correct only if the policy explicitly barred all contractor access.
D
Lack of documentation for approved exceptions.
Contractors holding financial system access without documented exceptions means the exception approval process is not being evidenced, so approvals cannot be audited or reviewed. The deficiency is the missing documentation trail, not the access itself.

Full breakdown with real-world context →

These CISM practice questions are part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style CISM questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related CISM topic practice pages

Information Security Governance practice questions

Incident Management practice questions

Information Security Programme practice questions

Information Security Program practice questions

Information Security Risk Management practice questions

CISM fundamentals practice questions

CISM scenario practice questions

CISM troubleshooting practice questions

Practice scenarios

Based on the exhibit, what is the MOST likely scenario?

Exhibit

Refer to the exhibit. An organization uses these firewall rules. After a breach, the IR team finds that the attacker gained access via SSH from an external IP. Which rule is most likely misconfigured?

Exhibit

Based on the exhibit, what is the most significant security gap in this configuration?

Exhibit

Refer to the exhibit. An information security manager reviews the risk register and sees that Risk ID R001 has a residual risk of High with a treatment of Accept. Which of the following best explains why this situation may indicate a governance failure?

Exhibit

Based on the exhibit, which role is missing from the governance policy that would be essential for enforcing accountability?

Exhibit

Given the exhibit, what is the MOST significant governance gap in the described architecture?

Exhibit

According to the exhibit, which role is responsible for conducting forensic analysis?

Exhibit

Refer to the exhibit. During a ransomware incident, the response team discovers that the backup server is also encrypted. Which phase of the playbook is MOST impacted?

Exhibit

Based on the exhibit, what is the MOST likely issue?

Exhibit

Refer to the exhibit. An audit reveals that 20% of privileged accounts were approved by the same manager without secondary review. Which control deficiency is MOST relevant to this finding?

Exhibit

Refer to the exhibit. The security analyst observes these alerts. What is the MOST likely sequence of events?

Exhibit

Refer to the exhibit. A security manager notices that several contractors have been granted access to a financial system without documented exceptions. Based on the policy, what is the most likely governance deficiency?

Exhibit