Certified Information Security Manager (CISM) — Questions and Answers

Question 1: Which of the following is MOST important when communicating about a security incident to external stakeholders?

Delegating all external communication to the IT team
Waiting until the incident is fully resolved before communicating
Ensuring communications are timely, accurate, and legally reviewed (Correct answer)
Providing all technical details of the attack immediately

Correct answer: Ensuring communications are timely, accurate, and legally reviewed

External incident communications must be timely, factually accurate, and reviewed by legal counsel to manage liability and maintain stakeholder trust.

Question 2: Which of the following is MOST important when establishing a security program budget?

Matching the budget of industry peers
Justifying spend based on risk reduction and business value (Correct answer)
Allocating the maximum available IT budget to security
Prioritizing tool purchases over personnel costs

Correct answer: Justifying spend based on risk reduction and business value

Security budgets should be justified through demonstrated risk reduction and business value, enabling rational resource allocation decisions.

Question 3: After an incident is resolved, which activity is MOST important to improve future response?

Resetting all user passwords organization-wide
Conducting a post-incident review (lessons learned) (Correct answer)
Replacing all affected hardware immediately
Immediately patching all systems in the environment

Correct answer: Conducting a post-incident review (lessons learned)

A post-incident review (lessons learned) identifies what worked, what failed, and improvements to prevent recurrence and enhance future response capability.

Question 4: Which of the following is a KEY responsibility of a CISM when managing the security program lifecycle?

Conducting all penetration tests personally
Personally reviewing all access control logs daily
Approving every change request submitted to the IT team
Ensuring the program evolves in response to changing business and threat conditions (Correct answer)

Correct answer: Ensuring the program evolves in response to changing business and threat conditions

A CISM must ensure the security program continuously evolves to remain aligned with changing business objectives and an evolving threat environment.

Question 5: Which of the following is MOST important when establishing risk assessment criteria?

Aligning criteria with the organization's business objectives and risk appetite (Correct answer)
Using the same criteria as peer organizations in the industry
Adopting criteria from the most recent regulatory guidance
Selecting criteria that minimize the number of identified risks

Correct answer: Aligning criteria with the organization's business objectives and risk appetite

Risk assessment criteria must reflect the organization's specific business objectives and risk appetite to produce meaningful and actionable results.

Question 6: Which of the following is the BEST technique to catch an intruder who breaks into a network without doing any damage?

Implement vendor default settings
Establish minimum security baselines
Perform periodic penetration testing
Install a honeypot on the network (Correct answer)

Correct answer: Install a honeypot on the network

A honeypot is the best technique to catch an intruder who breaks in without doing damage because it's a deceptive system that attracts attackers and lets you observe their behavior without risking production assets. Security baselines, periodic penetration testing, and vendor defaults are preventive or testing measures, not active intruder-detection tools.

Question 7: A CISM is informed that regulatory requirements in the organization's industry have changed. The MOST appropriate response is to:

Notify the board only after all required changes are implemented
Outsource all compliance activities to a third-party firm
Wait until the next scheduled audit to assess the impact
Immediately conduct a gap analysis to identify required changes to controls and processes (Correct answer)

Correct answer: Immediately conduct a gap analysis to identify required changes to controls and processes

A prompt gap analysis identifies what the new requirements demand and where current controls fall short, enabling timely and prioritized remediation.

Question 8: The Federal Information Security Modernization Act (FISMA) PRIMARILY applies to:

All US companies with more than 100 employees
Financial institutions regulated by the Federal Reserve
US federal agencies and contractors that handle federal information (Correct answer)
Healthcare organizations billing Medicare or Medicaid

Correct answer: US federal agencies and contractors that handle federal information

FISMA applies to US federal agencies and contractors that handle federal information, requiring them to develop, document, and implement information security programs.

Question 9: Under the Sarbanes-Oxley Act (SOX), which of the following is a KEY information security requirement?

Mandatory security awareness training for all employees
Internal controls over financial reporting, including IT general controls (Correct answer)
Annual penetration testing of all public-facing systems
Encryption of all employee communications

Correct answer: Internal controls over financial reporting, including IT general controls

SOX requires organizations to establish and maintain internal controls over financial reporting, which includes IT general controls that protect the integrity of financial systems.

Question 10: A CISM is presenting a security governance roadmap to the CEO. The presentation should PRIMARILY focus on:

Number of security incidents detected last quarter
Security risk in terms of business impact and strategic alignment (Correct answer)
Technical vulnerability details and patch timelines
Specific firewall configurations and network diagrams

Correct answer: Security risk in terms of business impact and strategic alignment

Executive presentations should frame security governance in business terms, focusing on risk, impact, and alignment with organizational strategy.

Question 11: A CISM is tasked with reducing compliance costs while maintaining all required standards. The BEST approach is to:

Negotiate with regulators for reduced audit frequency
Implement a common controls framework to satisfy multiple requirements simultaneously (Correct answer)
Outsource all compliance functions to reduce internal headcount
Reduce the number of regulations the organization monitors

Correct answer: Implement a common controls framework to satisfy multiple requirements simultaneously

A common controls framework identifies controls that satisfy multiple regulatory requirements simultaneously, reducing redundancy and overall compliance costs.

Question 12: Unusual server communication between internal and external parties may be observed to:

Support a nonrepudiation framework in e-commerce
Record the trace of advanced persistent threats (Correct answer)
Evaluate the process resiliency of server operations
Verify the effectiveness of an intrusion detection system

Correct answer: Record the trace of advanced persistent threats

The most important feature of target attacks as seen in advanced persistent threats is that malware secretly sends information back to a command and control server. Therefore, monitoring of outbound server communications that do not follow predefined routes will be the best control to detect such security events.

Question 13: A new CISO is managing asset inventory processes at a financial services company. The company uses both on-premises and IaaS-based virtualization services. What method will efficiently identify all active assets?

Count all of the servers in each data center.
Obtain a list of all assets from the patch management platform.
Obtain a list of all assets from the security event and information management (SIEM) system.
Perform discovery scans on all networks. (Correct answer)

Correct answer: Perform discovery scans on all networks.

Even if none of these methods is perfect, the best initial step is to run discovery scans across all networks. Even so, network engineers must be consulted to ensure that discovery scans in on-premises and IaaS systems scan all known networks. Interviewing system engineers to understand virtual machine management systems and collect inventory data from them are further helpful approaches. It is erroneous to "get a list of all assets from the patch management platform," as patch management systems could not cover some assets in the organization's environment. It is erroneous to say, "Obtain a list of all assets from the patch management platform," as not all assets in the organization's environment may send log data to the SIEM. Because the company uses virtualization technology and IaaS-based platforms, counting servers in an on-premises data center will miss both virtual and IaaS-based assets; therefore, the instruction to "count all of the servers in each data center" is wrong.

Question 14: During a ransomware incident, the incident response team is deciding whether to pay the ransom. Who should make this decision?

The IT operations team lead
Executive management, in consultation with legal and security (Correct answer)
The threat intelligence vendor
The information security manager acting alone

Correct answer: Executive management, in consultation with legal and security

Ransom payment decisions involve legal, financial, reputational, and strategic implications requiring executive authority and legal counsel.

Question 15: How often should a Business Continuity Plan be tested at MINIMUM according to best practices?

Every five years or after a significant organizational change
Whenever new executive leadership joins the organization
At least annually, and after any significant change to the environment (Correct answer)
Only when required by a regulatory audit or compliance assessment

Correct answer: At least annually, and after any significant change to the environment

Best practices and most frameworks require BCP testing at least annually and after any significant changes to ensure the plan remains effective and current.

Question 16: An organization experiences a data breach involving personal information. Which regulatory requirement is MOST commonly triggered in the US?

Mandatory ransom payment disclosure to the IRS
Mandatory public stock disclosure within 24 hours
Federal requirement to notify all customers via certified mail
State data breach notification laws requiring timely consumer notification (Correct answer)

Correct answer: State data breach notification laws requiring timely consumer notification

All 50 US states have breach notification laws requiring organizations to notify affected individuals and sometimes regulators within defined timeframes.

Question 17: Which of the following BEST describes the purpose of a Recovery Time Objective (RTO)?

The target time within which a business process must be restored after disruption (Correct answer)
The cost to recover IT systems after a disaster
The frequency at which data backups are performed
The maximum acceptable data loss measured in time

Correct answer: The target time within which a business process must be restored after disruption

RTO defines how quickly a business process must be restored to avoid unacceptable consequences, driving recovery design and investment.

Question 18: A CISM discovers that an incident was caused by an unpatched vulnerability that had been known for 90 days. The ROOT CAUSE was most likely:

An inadequate firewall configuration
A failure in the vulnerability management program (Correct answer)
An insider threat by a disgruntled employee
An advanced nation-state threat actor

Correct answer: A failure in the vulnerability management program

A known vulnerability remaining unpatched for 90 days indicates a failure in the vulnerability management program's identification, prioritization, or remediation processes.

Question 19: Separation of duties in security governance is PRIMARILY intended to:

Speed up security approvals
Decrease the number of security staff needed
Reduce the risk of fraud and error by distributing responsibilities (Correct answer)
Automate compliance reporting

Correct answer: Reduce the risk of fraud and error by distributing responsibilities

Separation of duties distributes critical responsibilities so that no single person can complete a high-risk task alone, reducing the risk of fraud or error.

Question 20: Which of the following BEST describes 'inherent risk' in information security?

Risk that exists before any controls are implemented (Correct answer)
Risk remaining after controls are applied
Risk transferred to a third party via insurance
Risk associated with third-party vendors only

Correct answer: Risk that exists before any controls are implemented

Inherent risk is the level of risk that exists naturally before any controls or mitigations are put in place.

Question 21: An organization is considering purchasing cyber liability insurance. From a risk management perspective, this is an example of:

Risk avoidance
Risk transfer (Correct answer)
Risk acceptance
Risk mitigation

Correct answer: Risk transfer

Purchasing cyber liability insurance transfers the financial consequences of a security event to a third-party insurer.

Question 22: For a significant proposed purchase and new procedure for an organization, a risk assessment and business impact analysis (BIA) have been finished. The business department manager and the information security manager debate about who will be in charge of assessing the outcomes and identified risks. Which of the following would be the information security manager's BEST course of action?

Review of the risk assessment with executive management for final input (Correct answer)
Acceptance of the business manager’s decision on the risk to the corporation
Acceptance of the information security manager’s decision on the risk to the corporation
Create a new risk assessment and BIA to resolve the disagreement

Correct answer: Review of the risk assessment with executive management for final input

Executive management will be in the best position to consider the big picture and the trade-offs between security and functionality in the entire organization.

Question 23: Which of the following BEST describes the role of a CISM during a major security incident?

Personally performing technical forensics on affected systems
Writing all incident reports and post-mortem documentation
Providing strategic oversight, coordination, and communication (Correct answer)
Deciding whether to pay a ransom demand

Correct answer: Providing strategic oversight, coordination, and communication

During a major incident, the CISM's role is strategic — providing oversight, coordinating the response team, and managing communication with leadership.

Question 24: A CISM is reviewing an incident response plan (IRP). Which element is MOST critical to include?

Detailed technical specifications for all security tools
A list of all security software licenses
Defined escalation procedures and communication chains (Correct answer)
Annual training completion records for all staff

Correct answer: Defined escalation procedures and communication chains

Clearly defined escalation procedures and communication chains ensure that the right people are notified and empowered to act during an incident.

Question 25: Which of the following is the PRIMARY purpose of containment in incident response?

To document lessons learned from the incident
To restore affected systems to normal operation
To permanently remove the root cause of the incident
To limit the scope and impact of an ongoing incident (Correct answer)

Correct answer: To limit the scope and impact of an ongoing incident

Containment limits the spread and impact of an active incident while preserving evidence and buying time for eradication and recovery.

Question 26: Which metric BEST demonstrates the effectiveness of an information security awareness training program?

Reduction in security incidents caused by human error (Correct answer)
Number of training modules available
Number of employees who completed training
Cost of delivering the training program

Correct answer: Reduction in security incidents caused by human error

Outcome-based metrics like reduced human-error incidents directly measure whether training changed behavior, not just participation.

Question 27: During an active ransomware incident, the FIRST priority of the CISM should be to:

Pay the ransom to restore operations as quickly as possible
Activate the incident response plan and isolate affected systems (Correct answer)
Issue a public statement to customers and stakeholders
Replace all encrypted systems with new hardware

Correct answer: Activate the incident response plan and isolate affected systems

Activating the incident response plan and isolating affected systems are the immediate priorities to contain the ransomware and prevent further spread.

Question 28: Who is responsible for making sure that data is categorized and that particular security precautions are taken?

Senior Management (Correct answer)
The custodian
The end user
The security Officer

Correct answer: Senior Management

Routine administration of all aspects of security is delegated, but top management must retain overall accountability.

Question 29: IT risk management initiatives are MOST successful when they:

Communicated to all employees
Conducted by the IT department
Treated as distinct process
Integrated within business processes (Correct answer)

Correct answer: Integrated within business processes

IT risk management is most successful when integrated within business processes, because the people who own the processes have the context and authority to make risk decisions that stick. Keeping it confined to the IT department or treating it as a separate process isolates it from where risk actually occurs, and merely communicating it to employees doesn't embed it into operations.

Question 30: A CISM is developing a security roadmap. The roadmap should be aligned to:

The organization's strategic business plan and risk tolerance (Correct answer)
The IT department's annual budget cycle
The latest cybersecurity threat intelligence reports
Industry peer benchmarks and best practices only

Correct answer: The organization's strategic business plan and risk tolerance

A security roadmap must align to the organization's strategic business plan and risk tolerance to ensure security investments support business goals.

Question 31: In the context of CISM, what is the CORRECT formula for calculating risk?

Risk = Vulnerability − Control
Risk = Threat × Asset Value
Risk = Threat + Vulnerability + Impact
Risk = Likelihood × Impact (Correct answer)

Correct answer: Risk = Likelihood × Impact

Risk is calculated as the product of the likelihood that a threat event will occur and the impact it would have on the organization.

Question 32: A CISM is evaluating third-party vendors. Which risk is MOST relevant to this activity?

Reputational risk
Liquidity risk
Market risk
Supply chain and third-party risk (Correct answer)

Correct answer: Supply chain and third-party risk

Third-party vendors introduce supply chain and vendor risk, where weaknesses in vendor security posture can compromise the organization's own security.

Question 33: Which of the following is MOST critical to the long-term success of an information security program?

Ongoing executive sponsorship and adequate resourcing (Correct answer)
Use of the latest security technologies
100% employee compliance with all policies
Elimination of all third-party relationships

Correct answer: Ongoing executive sponsorship and adequate resourcing

Sustained executive sponsorship and adequate resources are the most critical success factors for a security program's long-term effectiveness.

Question 34: When aligning information security strategy with business objectives, the security manager should PRIMARILY focus on:

Ensuring compliance with all regulations
Enabling business goals while managing risk to acceptable levels (Correct answer)
Eliminating all identified vulnerabilities
Implementing the latest security technologies

Correct answer: Enabling business goals while managing risk to acceptable levels

Security strategy must support business objectives by balancing risk management with operational enablement rather than simply enforcing controls.

Question 35: What is the FIRST step in the incident response lifecycle according to best practices?

Recovery
Containment
Preparation (Correct answer)
Eradication

Correct answer: Preparation

Preparation is the first phase of incident response, involving developing plans, training teams, and establishing capabilities before incidents occur.

Question 36: Which of the following BEST describes the role of a CISM in supporting a regulatory examination?

Personally answering all examiner questions without consulting legal counsel
Limiting examiner access to only the IT department
Delaying the examination until all identified gaps are remediated
Coordinating the organization's response and ensuring requested evidence is complete and accurate (Correct answer)

Correct answer: Coordinating the organization's response and ensuring requested evidence is complete and accurate

The CISM coordinates the examination response, ensuring examiners receive complete, accurate evidence while collaborating with legal, compliance, and business teams.

Question 37: An organization's board of directors is MOST responsible for which security governance activity?

Conducting vulnerability assessments
Setting risk appetite and oversight (Correct answer)
Writing security policies
Managing security operations

Correct answer: Setting risk appetite and oversight

The board of directors is responsible for setting the organization's risk appetite and providing oversight of the overall security posture.

Question 38: A Business Impact Analysis (BIA) primarily helps an organization:

Select vendors for offsite data storage solutions
Determine which employees are essential during a disaster
Identify security vulnerabilities in critical systems
Prioritize recovery efforts based on criticality and financial impact (Correct answer)

Correct answer: Prioritize recovery efforts based on criticality and financial impact

A BIA prioritizes recovery efforts by quantifying the financial, operational, and reputational impact of disruptions to each business function.

Question 39: An organization wants to validate its incident response capabilities. Which approach provides the MOST realistic assessment?

Performing a full simulation (red team) exercise without prior notice (Correct answer)
Reviewing incident response documentation for completeness
Conducting tabletop exercises with the security team
Interviewing key personnel about their incident response roles

Correct answer: Performing a full simulation (red team) exercise without prior notice

Unannounced red team exercises provide the most realistic test of actual incident response capability under realistic conditions.

Question 40: The Payment Card Industry Data Security Standard (PCI DSS) applies to organizations that:

Issue credit cards directly to consumers
Process payroll for more than 500 employees
Store, process, or transmit cardholder data (Correct answer)
Operate in the financial services sector only

Correct answer: Store, process, or transmit cardholder data

PCI DSS applies to any organization that stores, processes, or transmits payment card data, regardless of industry or size.

Question 41: Which of the following BEST describes the purpose of a Business Impact Analysis (BIA)?

To calculate the cost of deploying new security technologies
To assess employee compliance with security policies
To determine critical business processes and the impact of their disruption (Correct answer)
To identify all network vulnerabilities in the organization

Correct answer: To determine critical business processes and the impact of their disruption

A BIA identifies critical business processes, their dependencies, and the potential impact of disruption, which informs risk prioritization and continuity planning.

Question 42: It is possible to monitor unusual server traffic between internal and external parties to:

Evaluate the process resiliency of server operations
Support a nonrepudiation framework in e-commerce
Verify the effectiveness of an intrusion detection system
Record the trace of advanced persistent threats (Correct answer)

Correct answer: Record the trace of advanced persistent threats

Monitoring abnormal server communication from inside the organization to external parties can serve the purpose of recording the trace of advanced persistent threats (APTs).

Question 43: Which of the following BEST describes the concept of 'privacy by design' in a compliance context?

Obtaining user consent before collecting any personal data
Embedding privacy protections into systems and processes from the beginning of development (Correct answer)
Storing personal data in geographically restricted data centers
Encrypting all databases containing personal information

Correct answer: Embedding privacy protections into systems and processes from the beginning of development

Privacy by design integrates data privacy protections into systems, processes, and products from inception, rather than adding them as afterthoughts.

Question 44: Which of the following BEST describes the relationship between information security policy and procedures?

Policies and procedures are interchangeable documents
Procedures are written by executives; policies by technical staff
Policies define what must be done; procedures describe how to do it (Correct answer)
Procedures define what must be done; policies describe how to do it

Correct answer: Policies define what must be done; procedures describe how to do it

Policies establish high-level requirements and intent, while procedures provide step-by-step instructions for implementing those requirements.

Question 45: A CISM is establishing notification procedures for data breach incidents. Under US regulations, breach notification timing is MOST influenced by:

The organization's public relations strategy
The organization's internal investigation timeline
The type of security tools used to detect the breach
State breach notification laws and applicable federal regulations (Correct answer)

Correct answer: State breach notification laws and applicable federal regulations

US data breach notification requirements are governed by state laws and federal sector-specific regulations, which define mandatory notification timelines.

Question 46: During a security incident, who is PRIMARILY responsible for declaring an incident a 'major incident'?

The external auditor assigned to the organization
The system administrator who detected the anomaly
The help desk technician who received the initial report
A designated incident manager or crisis management team (Correct answer)

Correct answer: A designated incident manager or crisis management team

A designated incident manager or crisis management team, with appropriate authority, is responsible for formally declaring and escalating major incidents.

Question 47: Which of the following is an example of a detective information security control?

Multi-factor authentication for system access
Intrusion detection system (IDS) alerting on suspicious activity (Correct answer)
Firewall blocking unauthorized traffic
Data encryption at rest

Correct answer: Intrusion detection system (IDS) alerting on suspicious activity

Detective controls like IDS identify and alert on events that have occurred or are occurring, enabling response without preventing the activity itself.

Question 48: A CISM is conducting a risk assessment and discovers a high likelihood threat with low potential impact. This risk should be:

Immediately escalated to the board
Evaluated in the context of the organization's risk appetite (Correct answer)
Automatically mitigated regardless of cost
Transferred to a third-party insurer

Correct answer: Evaluated in the context of the organization's risk appetite

All risks, regardless of their individual dimensions, must be evaluated against the organization's defined risk appetite before determining the appropriate response.

Question 49: A CISM is developing a security governance framework. Which document should serve as the TOP-LEVEL foundation?

Information security policy (Correct answer)
Risk register
Security procedures
Security standards

Correct answer: Information security policy

The information security policy is the top-level document that establishes management's intent and provides the foundation for all other security standards and procedures.

Question 50: A security manager is presenting the value of information security to the board. Which approach is MOST effective?

Present security metrics tied to business risk and financial impact (Correct answer)
Explain the technical architecture of security controls
Demonstrate technical vulnerability details from the last penetration test
Show the number of security incidents blocked last quarter

Correct answer: Present security metrics tied to business risk and financial impact

Board-level communication requires translating security activities into business risk and financial terms that resonate with executives.

Question 51: What distinguishes a hot site from a warm site in disaster recovery?

A hot site has fully operational systems with current data, while a warm site has equipment but requires setup time (Correct answer)
A hot site is located in a different country, while a warm site is domestic
A hot site supports only critical systems, while a warm site supports all systems
A hot site is owned by the organization, while a warm site is leased from a vendor

Correct answer: A hot site has fully operational systems with current data, while a warm site has equipment but requires setup time

A hot site is fully equipped and operational with current data, enabling near-immediate failover, whereas a warm site has hardware but requires configuration and data restoration before use.

Question 52: What is the MOST important reason for involving business unit leaders in Business Continuity Plan development?

To reduce the workload on the information security team during planning
To accurately identify critical processes, dependencies, and acceptable recovery targets (Correct answer)
To ensure IT recovery time objectives align with budgetary constraints
To satisfy regulatory requirements that mandate cross-functional participation

Correct answer: To accurately identify critical processes, dependencies, and acceptable recovery targets

Business unit leaders have the knowledge to identify which processes are truly critical and what recovery targets are operationally acceptable, making their involvement essential for a realistic and effective BCP.

Question 53: A manufacturing company's CISO, Linda, is developing a new cyber-risk governance procedure. What should Linda do initially to ensure the success of this process?

Charter a security steering committee consisting of IT, security, and business leaders (Correct answer)
Develop a RACI matrix that defines executive roles and responsibilities
Develop a risk management process similar to what is found in ISO/IEC 27001
Charter a security steering committee consisting of IT and cybersecurity leaders

Correct answer: Charter a security steering committee consisting of IT, security, and business leaders

The best course of action is to establish a chartered information security steering group with representatives from business, IT, and security leaders. Business executives need to get involved and participate in discussions and decisions if security governance is to be successful. It is false to say that you should "develop a RACI matrix that outlines executive roles and responsibilities" since, while vital, a RACI matrix is only a small component of a formalized information security steering committee. It is erroneous to say, "Charter a security steering group made up of leaders in IT and cybersecurity." A security steering committee must also have business leaders on it. Because security governance, which is more than risk management, is the topic of this question, it is erroneous to say that you should "develop a risk management process comparable to what is found in ISO/IEC 27001."

Question 54: A security manager examines the logs of numerous devices to ascertain how a security breach on the business network happened. Which of the following BEST makes it easier to compare and analyze these logs?

Domain name server
Time server (Correct answer)
Proxy server
Database server

Correct answer: Time server

A time server best enables log comparison because synchronized, consistent timestamps across all devices are required before events from different sources can be sequenced and correlated. DNS, database, and proxy servers serve other functions and do nothing to ensure the time alignment needed to reconstruct the order of a breach.

Question 55: Which of the following is a KEY output of a mature information security governance program?

Security metrics aligned to business objectives (Correct answer)
Elimination of all third-party vendors
Zero security incidents
100% patch compliance

Correct answer: Security metrics aligned to business objectives

A mature governance program produces meaningful security metrics that are tied to and measured against business objectives, demonstrating value to leadership.

Question 56: When assigning ownership of information assets, the MOST appropriate owner is typically:

The system administrator
The external auditor
The IT security team
The business unit manager responsible for the asset (Correct answer)

Correct answer: The business unit manager responsible for the asset

Business unit managers, as the primary users and beneficiaries of information assets, are the most appropriate owners with accountability for their protection.

Question 57: Which statement BEST describes the relationship between RTO and MTD?

RTO and MTD are interchangeable terms used by different frameworks
RTO must always be shorter than MTD to ensure recovery occurs before irreversible harm (Correct answer)
RTO defines the data loss threshold while MTD defines the downtime threshold
MTD is determined by IT and RTO is determined by business units independently

Correct answer: RTO must always be shorter than MTD to ensure recovery occurs before irreversible harm

RTO must be set shorter than MTD to ensure systems are recovered before the maximum tolerable period of disruption is breached, avoiding irreversible business impact.

Question 58: An information security manager wants to verify that security controls are operating as intended. Which activity is MOST appropriate?

Hiring additional security analysts
Purchasing additional security software licenses
Updating the information security policy
Conducting a control effectiveness audit or assessment (Correct answer)

Correct answer: Conducting a control effectiveness audit or assessment

Control effectiveness audits verify that implemented controls are functioning correctly and actually reducing risk as designed.

Question 59: An organization accepts a residual risk. What does this mean?

The risk has been fully eliminated through controls
The risk assessment was incomplete
The remaining risk after controls are applied is deemed tolerable (Correct answer)
The risk has been transferred to an insurer

Correct answer: The remaining risk after controls are applied is deemed tolerable

Residual risk is what remains after controls are applied; accepting it means management finds the remaining exposure within tolerance.

Question 60: A CISM is establishing data classification as part of the security program. The PRIMARY benefit is to:

Ensure appropriate controls are applied based on data sensitivity (Correct answer)
Enable the IT team to delete unnecessary data
Reduce the cost of data storage across the organization
Comply with all applicable data protection regulations automatically

Correct answer: Ensure appropriate controls are applied based on data sensitivity

Data classification ensures that protective controls are proportionate to data sensitivity, so critical data receives stronger protection than non-sensitive data.

Question 61: When building a security program, which of the following activities should be performed on a CONTINUOUS basis?

Employee onboarding security briefings only
Annual policy review and update cycle
Monitoring of controls effectiveness and emerging threats (Correct answer)
Initial risk assessment only

Correct answer: Monitoring of controls effectiveness and emerging threats

Continuous monitoring of control effectiveness and the threat landscape ensures the security program remains relevant and effective as conditions change.

Question 62: What authentication technique stops authentication replay?

Hypertext Transfer Protocol basic authentication
Wired equivalent privacy encryption usage
Challenge/response mechanism (Correct answer)
Password hash implementation

Correct answer: Challenge/response mechanism

A challenge/response mechanism defeats replay attacks because the server issues a unique, one-time challenge each session, so a captured response is useless the next time. Password hashes, HTTP basic auth, and WEP all rely on static or reusable secrets that an attacker can intercept and replay.

Question 63: Which governance structure BEST ensures accountability for information security across the organization?

Centralized IT helpdesk
Defined roles and responsibilities with clear ownership (Correct answer)
Annual security audits by external firms
Automated vulnerability scanning tools

Correct answer: Defined roles and responsibilities with clear ownership

Clearly defined roles and responsibilities with assigned ownership ensure accountability and enable effective governance across the organization.

Question 64: Which framework is MOST commonly used to establish information security governance in US enterprises?

CVE
OWASP Top 10
PCI DSS
COBIT (Correct answer)

Correct answer: COBIT

COBIT (Control Objectives for Information and Related Technologies) is widely used for IT and information security governance in enterprises.

Question 65: Which of the following BEST supports a 'security by design' approach in program development?

Integrating security requirements into the project lifecycle from inception (Correct answer)
Relying on vendors to build security into their products
Performing security assessments only after systems are deployed
Purchasing security add-ons for existing systems after deployment

Correct answer: Integrating security requirements into the project lifecycle from inception

Security by design integrates security requirements early in the system development lifecycle, reducing cost and complexity compared to retrofitting controls later.

Question 66: A risk treatment option that involves sharing risk with another party, such as through outsourcing, is BEST described as:

Risk mitigation
Risk avoidance
Risk transfer (Correct answer)
Risk acceptance

Correct answer: Risk transfer

Risk transfer shifts the financial or operational burden of a risk to a third party, such as an insurer or outsourced provider.

Question 67: A security manager is asked to measure the return on security investment (ROSI). Which component is ESSENTIAL to calculate ROSI?

Total hours spent on security awareness training
Number of security certifications held by staff
Annualized Loss Expectancy (ALE) before and after implementing controls (Correct answer)
Number of security policies published this year

Correct answer: Annualized Loss Expectancy (ALE) before and after implementing controls

ROSI is calculated by comparing ALE before and after control implementation against the cost of those controls, quantifying the financial value of the investment.

Question 68: Which US federal law PRIMARILY governs the protection of personal health information in the healthcare industry?

Gramm-Leach-Bliley Act (GLBA)
Children's Online Privacy Protection Act (COPPA)
Health Insurance Portability and Accountability Act (HIPAA) (Correct answer)
Sarbanes-Oxley Act (SOX)

Correct answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA establishes federal standards for protecting the privacy and security of individually identifiable health information in the US healthcare industry.

Question 69: An organization wants to ensure its security governance program remains effective over time. The BEST mechanism is:

Outsourcing all security functions to a managed provider
Implementing a zero-trust network architecture
One-time security policy review at program launch
Continuous monitoring and periodic program reviews (Correct answer)

Correct answer: Continuous monitoring and periodic program reviews

Continuous monitoring and periodic reviews ensure the governance program adapts to changing threats, business needs, and regulatory requirements.

Question 70: An information security manager discovers that a business unit is using an unapproved cloud service to store sensitive customer data. What is the BEST first action?

Block network access to the cloud provider
Conduct a risk assessment of the cloud service (Correct answer)
Immediately shut down the service
Report the business unit to executive management

Correct answer: Conduct a risk assessment of the cloud service

A risk assessment determines the actual exposure before taking disruptive action, enabling an informed and proportional response.

Question 71: What presents the biggest challenge when putting a data classification scheme into practice?

Difficulty with industry regulators
Implementing and tuning DLP agents on servers and endpoints
Training end users on data handling procedures (Correct answer)
Understanding the types of data in use

Correct answer: Training end users on data handling procedures

The most difficult challenge associated with implementing a data classification program is ensuring that workers understand and are willing to comply with data handling procedures. By comparison, automation is simpler primarily because it is deterministic. "Difficulty with industry regulators" is incorrect because regulators are not typically as concerned with data classification as they are with the protection of relevant information. "Understanding the types of data in use" is incorrect because, although it can be a challenge understanding the data in use in an organization, user compliance is typically the biggest challenge. "Implementing and tuning DLP agents on servers and endpoints" is incorrect because implementing and tuning agents are not usually as challenging as end user behavior training.

Question 72: In risk management, which of the following BEST defines a 'vulnerability'?

The financial loss resulting from a security incident
A malicious actor targeting the organization
A weakness that can be exploited by a threat to cause harm (Correct answer)
The probability that a risk event will occur

Correct answer: A weakness that can be exploited by a threat to cause harm

A vulnerability is a weakness or gap in controls that a threat could exploit to compromise assets or operations.

Question 73: What distinguishes a Recovery Point Objective (RPO) from a Recovery Time Objective (RTO)?

Both measure the same thing but apply to different departments
RPO measures acceptable data loss in time; RTO measures recovery speed (Correct answer)
RPO measures recovery speed; RTO measures data loss tolerance
RPO applies to hardware; RTO applies to software

Correct answer: RPO measures acceptable data loss in time; RTO measures recovery speed

RPO defines the maximum tolerable data loss window (e.g., last 4 hours of transactions), while RTO defines how quickly systems must be back online.

Question 74: The PRIMARY goal of the 'lessons learned' phase of incident response is to:

Update insurance claims after the incident
Finalize forensic evidence for law enforcement
Identify improvements to prevent or better handle future incidents (Correct answer)
Assign blame to responsible employees

Correct answer: Identify improvements to prevent or better handle future incidents

Lessons learned translate incident experience into actionable improvements in controls, processes, and plans to reduce future risk.

Question 75: What is the PRIMARY difference between a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?

A BCP is strategic and a DRP is not required if a BCP exists
A BCP focuses on keeping business operations running, while a DRP focuses on restoring IT systems (Correct answer)
A DRP covers all business functions while a BCP covers only IT functions
A BCP is for natural disasters while a DRP is for cyber incidents

Correct answer: A BCP focuses on keeping business operations running, while a DRP focuses on restoring IT systems

A BCP focuses on maintaining critical business operations during a disruption, while a DRP specifically addresses the recovery of IT systems and data.

Question 76: Which of the following is a KEY benefit of integrating compliance and security program activities?

The organization can focus exclusively on regulatory requirements rather than threats
Duplication of effort is reduced and security controls serve multiple purposes simultaneously (Correct answer)
Compliance integration eliminates the need for external audits
Compliance activities can replace security risk assessments entirely

Correct answer: Duplication of effort is reduced and security controls serve multiple purposes simultaneously

Integrating compliance and security reduces duplication by using shared controls, frameworks, and assessments to meet both security and regulatory objectives efficiently.

Question 77: A CISM is establishing a vendor risk management program. The MOST critical first step is to:

Identify and inventory all third-party relationships and their data access levels (Correct answer)
Deploy security monitoring tools on all vendor networks
Conduct on-site audits of all vendors annually
Require all vendors to sign a confidentiality agreement

Correct answer: Identify and inventory all third-party relationships and their data access levels

Identifying and inventorying all third-party relationships and their level of access provides the foundation for assessing and managing vendor risk effectively.

Question 78: A CISM is implementing a security control framework. Which of the following is MOST important when selecting a framework?

It should align with the organization's risk profile and industry requirements (Correct answer)
It must be the most recently published framework available
It should be the most widely adopted framework globally
It must be mandated by a government agency

Correct answer: It should align with the organization's risk profile and industry requirements

Framework selection should be based on alignment with the organization's specific risk profile, regulatory environment, and industry context.

Question 79: A CISM wants to ensure the security program addresses emerging threats. The BEST approach is to:

Conduct a one-time threat landscape study at program launch
Wait for incidents to occur before updating the program
Subscribe to threat intelligence feeds and integrate findings into risk management (Correct answer)
Rely exclusively on annual penetration testing results

Correct answer: Subscribe to threat intelligence feeds and integrate findings into risk management

Integrating threat intelligence feeds into ongoing risk management ensures the program continuously adapts to the evolving threat landscape.

Question 80: When a compliance requirement conflicts with a security best practice, a CISM should FIRST:

Escalate immediately to the CEO for a final decision
Implement the security best practice and ignore the compliance requirement
Follow the compliance requirement without any additional security measures
Analyze whether the compliance baseline is sufficient or whether compensating controls are needed (Correct answer)

Correct answer: Analyze whether the compliance baseline is sufficient or whether compensating controls are needed

When compliance and best practice conflict, the CISM should analyze whether the compliance baseline provides adequate security or whether additional compensating controls are required.

Question 81: Which of the following BEST describes the relationship between IT governance and information security governance?

Information security governance is a subset of IT governance (Correct answer)
They are identical and interchangeable
IT governance reports to information security governance
They operate independently with no overlap

Correct answer: Information security governance is a subset of IT governance

Information security governance is a subset of IT governance, which itself is a component of overall corporate governance.

Question 82: Which of the following MOST accurately describes a 'compensating control' in a regulatory compliance context?

A duplicate of an existing control added for extra protection
An alternative control implemented when the primary required control cannot be met (Correct answer)
A financial payment made to regulators in lieu of implementing required controls
A technical control that replaces the need for security policies

Correct answer: An alternative control implemented when the primary required control cannot be met

A compensating control is an alternative measure that provides equivalent protection when the specifically required control cannot be implemented due to technical or business constraints.

Question 83: When performing information risk assessments, which approach provides the MOST objective results?

Copying results from a prior year's assessment
Combining quantitative data with qualitative expert judgment (Correct answer)
Using only automated scanning tools
Relying solely on staff interviews

Correct answer: Combining quantitative data with qualitative expert judgment

A hybrid approach leverages measurable data for objectivity while using expert judgment to address gaps that tools and metrics cannot fully capture.

Question 84: A reciprocal agreement for disaster recovery means:

An organization contracts a third party to provide guaranteed backup facilities
A vendor agrees to provide replacement hardware within an agreed timeframe
Two organizations agree to host each other's operations in the event of a disaster (Correct answer)
An insurance provider agrees to cover all recovery costs after a declared disaster

Correct answer: Two organizations agree to host each other's operations in the event of a disaster

A reciprocal agreement is an arrangement between two organizations to provide backup processing capacity for each other if one experiences a disaster.

Question 85: What is Annual Loss Expectancy (ALE) used for in quantitative risk assessment?

To calculate the number of incidents per year
To determine the cost of deploying a new firewall
To estimate the expected financial loss from a risk over a year (Correct answer)
To measure employee productivity loss from security training

Correct answer: To estimate the expected financial loss from a risk over a year

ALE (ALE = SLE × ARO) estimates the expected annual financial loss from a specific risk, used to justify security investments through cost-benefit analysis.

Question 86: During a risk assessment, an organization identifies a threat with a high likelihood but low impact. What is the MOST appropriate risk treatment?

Avoid the risk by discontinuing the related activity
Accept the risk due to low impact
Implement controls proportional to the risk level (Correct answer)
Transfer the risk through cyber insurance

Correct answer: Implement controls proportional to the risk level

Controls should be implemented proportional to the overall risk level, balancing likelihood and impact considerations.

Question 87: Which factor MOST influences the priority of information security risk treatment?

The opinion of the IT department
The age of the affected systems
The cost of available security technologies
The likelihood and potential business impact of the risk (Correct answer)

Correct answer: The likelihood and potential business impact of the risk

Risk prioritization is driven by the combination of likelihood and business impact, ensuring the most critical risks receive attention first.

Question 88: Who is responsible for making sure that data is categorized and that particular security precautions are taken?

Senior management (Correct answer)
The end user
The security officer
The custodian

Correct answer: Senior management

Senior management is accountable for ensuring that information is categorized and that specific protective measures are taken. As the highest level of management within an organization, senior management holds the ultimate responsibility for information security and the protection of organizational assets. This includes establishing policies and procedures for information classification and ensuring that appropriate protective measures are implemented.

Question 89: Which of the following BEST illustrates an effective security governance reporting structure?

CISO reports to both the CEO and board with regular updates (Correct answer)
Security reports are shared only within the IT department
Security metrics are reported only after incidents occur
CISO reports to the CTO only

Correct answer: CISO reports to both the CEO and board with regular updates

Effective governance requires the CISO to report to senior leadership and the board regularly, ensuring visibility and accountability at the highest levels.

Question 90: A risk assessment reveals that a control is more expensive than the risk it mitigates. A CISM should RECOMMEND:

Escalating to law enforcement immediately
Outsourcing the entire IT function
Implementing the control anyway for compliance purposes
Accepting the risk if it falls within the risk appetite (Correct answer)

Correct answer: Accepting the risk if it falls within the risk appetite

When a control's cost exceeds the risk value it addresses, accepting the risk is appropriate if it aligns with the organization's defined risk appetite.

Question 91: Which of the following BEST describes 'forensic preservation' during incident response?

Deleting all logs to protect sensitive information
Immediately restoring affected systems to minimize downtime
Notifying law enforcement before any investigation begins
Collecting and preserving evidence in a manner that maintains its integrity for investigation (Correct answer)

Correct answer: Collecting and preserving evidence in a manner that maintains its integrity for investigation

Forensic preservation involves collecting evidence using documented, integrity-preserving methods to support investigation and potential legal proceedings.

Question 92: A CISM wants to ensure that information security governance is integrated into organizational decision-making. The BEST approach is to:

Deploy a SIEM platform organization-wide
Establish a security steering committee with cross-functional representation (Correct answer)
Mandate security training for all new hires
Require IT sign-off on all purchases

Correct answer: Establish a security steering committee with cross-functional representation

A cross-functional security steering committee embeds security governance into broader organizational decision-making processes across business units.

Question 93: What is the MAIN benefit of having a documented chain of custody during incident investigation?

It speeds up the technical recovery of affected systems
It satisfies cyber insurance policy documentation requirements
It replaces the need for forensic tool certifications
It ensures evidence integrity and admissibility in legal or regulatory proceedings (Correct answer)

Correct answer: It ensures evidence integrity and admissibility in legal or regulatory proceedings

A chain of custody documents who handled evidence, when, and how, ensuring its integrity is maintained for use in legal or regulatory proceedings.

Question 94: A succession plan within business continuity primarily addresses:

Planning for the acquisition of a competitor following a market disruption
Scheduling the rotation of staff across different recovery teams
Designating backup personnel who can assume critical roles if key individuals are unavailable (Correct answer)
The order in which IT systems are restored after a disaster

Correct answer: Designating backup personnel who can assume critical roles if key individuals are unavailable

A succession plan ensures that backup personnel are identified and trained to assume critical roles if primary individuals are unavailable during a crisis.

Question 95: When developing a security governance program, a CISM should FIRST:

Purchase security tools and technologies
Conduct a gap analysis of current controls
Hire additional security staff
Understand the organization's business strategy and objectives (Correct answer)

Correct answer: Understand the organization's business strategy and objectives

Understanding the business strategy ensures that the security governance program is aligned with and supports organizational goals from the outset.

Question 96: A Recovery Time Objective (RTO) of four hours means:

Data must be restored to within four hours of the last backup
The business can tolerate four hours of data loss before operations are impacted
Recovery teams must assemble within four hours of an incident
The system must be fully functional within four hours of a disaster declaration (Correct answer)

Correct answer: The system must be fully functional within four hours of a disaster declaration

RTO specifies the maximum acceptable time to restore a system or process to operational status after a disruption is declared.

Question 97: Which action BEST preserves digital evidence during an incident investigation?

Reinstalling the operating system and restoring from backup
Rebooting the affected system to clear malware
Deleting suspicious files to stop the attack immediately
Creating a forensic image of the system before any changes (Correct answer)

Correct answer: Creating a forensic image of the system before any changes

A forensic image captures the exact state of storage at the time of the incident, preserving evidence integrity for analysis or legal proceedings.

Question 98: Maximum Tolerable Downtime (MTD) is best described as:

The time between the last backup and the occurrence of a disaster
The time required to fully restore all IT systems after a disaster
The average time between system failures in a production environment
The longest period a business function can be unavailable before causing irreversible harm (Correct answer)

Correct answer: The longest period a business function can be unavailable before causing irreversible harm

MTD (also called Maximum Tolerable Period of Disruption) defines the upper limit of downtime beyond which the organization faces unacceptable consequences.

Question 99: Which metric BEST demonstrates the effectiveness of an information security governance program to senior leadership?

Number of software vulnerabilities patched
Ratio of security incidents to business risk tolerance (Correct answer)
Percentage of employees completing security awareness training
Number of firewall rules implemented

Correct answer: Ratio of security incidents to business risk tolerance

Comparing security incidents against defined business risk tolerance gives leadership meaningful insight into how well the governance program is performing relative to strategic objectives.

Question 100: Which of the following poses the BIGGEST risk to an enterprise resource planning (ERP) system's security?

Operating system security patches have not been applied (Correct answer)
User ad hoc reporting is not logged
Database security defaults ti ERP settings
Network traffic is through a single switch

Correct answer: Operating system security patches have not been applied

Missing operating system security patches pose the biggest risk because every application, including the ERP, depends on the OS layer, so an unpatched OS exposes the widest attack surface. A single switch, unlogged ad hoc reporting, and default database settings are concerns but far narrower in scope than a vulnerable underlying operating system.

Question 101: What should a risk management strategy's main goal be?

Identify credible risks and reduce them to an acceptable level (Correct answer)
Eliminate credible risks
Determine the organization's risk appetite
Identify credible risks and transfer them to an external party

Correct answer: Identify credible risks and reduce them to an acceptable level

The main goal of a risk management strategy is to identify risks, then reduce those risks to levels that upper management can accept. The phrase "determine the organization's risk appetite" is erroneous because, while crucial and necessary for a risk management program to operate correctly, determining risk appetite is not the fundamental goal of a risk management strategy. It is erroneous to say, "Identify credible risks and transfer them to an external entity," when many other potential outcomes for hazards can be discovered. It is erroneous to say "remove credible dangers," as risks can only be decreased to tolerable levels.

Question 102: Which of the following is the BEST technique to catch an intruder who breaks into a network without doing any damage?

Implement vendor default settings
Install a honeypot on the network (Correct answer)
Establish minimum security baselines
Perform periodic penetration testing

Correct answer: Install a honeypot on the network

A honeypot is the best tool to catch a non-destructive intruder because it's a decoy system designed to lure and observe attackers while keeping real assets safe. Baselines, penetration testing, and default settings are preventive or assessment measures—they don't actively detect or study an intruder already moving inside the network.

Question 103: What is the FIRST step in developing a Business Continuity Plan?

Defining roles and responsibilities for the recovery team
Establishing communication procedures for incidents
Identifying recovery strategies and backup sites
Conducting a Business Impact Analysis (BIA) (Correct answer)

Correct answer: Conducting a Business Impact Analysis (BIA)

A Business Impact Analysis (BIA) is conducted first to identify critical business functions and quantify the impact of disruptions before recovery strategies are defined.

Question 104: A CISM discovers that a new business initiative will require processing of EU citizen data. Which regulation MUST be considered?

GDPR (Correct answer)
FISMA
GLBA
HIPAA

Correct answer: GDPR

The General Data Protection Regulation (GDPR) applies to any organization processing personal data of EU residents, regardless of where the organization is located.

Question 105: Which of the following BEST describes the purpose of an incident response retainer with a third-party firm?

To replace the need for an internal incident response plan
To outsource all internal security operations permanently
To ensure pre-negotiated access to expert resources during a crisis (Correct answer)
To satisfy cyber insurance policy requirements only

Correct answer: To ensure pre-negotiated access to expert resources during a crisis

A retainer pre-negotiates access to specialized incident response expertise and resources, reducing response time and ensuring availability during a major incident.

Question 106: What is the purpose of a risk register in information security management?

To list all employees with access to sensitive systems
To document all installed security software
To track security incident response timelines
To record identified risks, their assessments, and treatment decisions (Correct answer)

Correct answer: To record identified risks, their assessments, and treatment decisions

A risk register is a formal document that records identified risks, their assessed likelihood and impact, treatment options chosen, and residual risk levels.

Question 107: Which of the following BEST describes a threat in the context of information security risk?

A potential cause of an unwanted event that could harm an asset (Correct answer)
A weakness in a system or process
The financial impact of a security breach
A control that has failed to prevent an incident

Correct answer: A potential cause of an unwanted event that could harm an asset

A threat is any potential cause of an unwanted incident that could result in harm to an organization's assets or operations.

Question 108: Which of the following is the PRIMARY purpose of a business impact analysis (BIA) in the context of information security?

To identify all possible security threats to the organization
To identify critical processes and the impact of their disruption (Correct answer)
To determine the financial cost of implementing security controls
To assess the effectiveness of existing security controls

Correct answer: To identify critical processes and the impact of their disruption

A BIA identifies critical business processes, their dependencies, and the consequences of disruption to prioritize recovery efforts.

Question 109: Which of the following BEST supports measuring the maturity of an information security program?

Comparing policy counts with peer organizations
Using a capability maturity model to assess program components (Correct answer)
Counting the total number of security incidents in a year
Tracking the number of security tools deployed

Correct answer: Using a capability maturity model to assess program components

Capability maturity models provide a structured, objective way to assess the maturity and effectiveness of security program components against defined levels.

Question 110: Which of the following is MOST important when prioritizing risks for treatment?

The age of the vulnerability
The potential business impact and likelihood (Correct answer)
The number of systems affected
The vendor's severity rating

Correct answer: The potential business impact and likelihood

Risks should be prioritized based on their potential business impact and likelihood of occurrence, not just technical severity or vendor ratings.

Question 111: An organization is developing its information security strategy. Which factor is MOST critical to align the strategy with business objectives?

Adopting the latest security technologies
Understanding the organization's risk appetite and business goals (Correct answer)
Benchmarking against industry peers' security budgets
Maximizing the number of security controls implemented

Correct answer: Understanding the organization's risk appetite and business goals

Security strategy must be grounded in the organization's risk appetite and specific business objectives to be effective.

Question 112: Which of the following BEST describes the difference between a regulation and a standard in the context of compliance?

Regulations are legally mandated by governments; standards are typically voluntary industry guidelines (Correct answer)
Regulations are optional; standards are mandatory
Standards are enforced by government agencies; regulations are created by industry groups
There is no practical difference between regulations and standards

Correct answer: Regulations are legally mandated by governments; standards are typically voluntary industry guidelines

Regulations are legally enforceable requirements imposed by government authorities, while standards are generally voluntary guidelines developed by industry bodies.

Question 113: When developing an information security program, a CISM should FIRST:

Define the security program's scope and objectives based on business needs (Correct answer)
Conduct employee phishing simulations
Hire additional security analysts
Procure security tools and technologies

Correct answer: Define the security program's scope and objectives based on business needs

Defining the scope and objectives aligned to business needs ensures the security program is purposeful, relevant, and capable of gaining organizational support.

Question 114: Which of the following BEST describes the primary objective of information security governance?

Aligning security strategy with business objectives (Correct answer)
Training employees on password policies
Conducting annual penetration tests
Deploying firewalls and intrusion detection systems

Correct answer: Aligning security strategy with business objectives

Information security governance ensures that security strategies are aligned with and support the overall business objectives of the organization.

Question 115: What procedures must be followed before a risk assessment can begin in an organization?

Determine the qualifications of the person(s) who will perform the audit
Determine scope, purpose, and criteria for the audit (Correct answer)
Determine the qualifications of the firm that will perform the audit
Determine scope, applicability, and purpose for the audit

Correct answer: Determine scope, purpose, and criteria for the audit

Establishing an audit context is essential, according to ISO/IEC 27005 and other risk management standards. This entails choosing the audit's scope or the areas of the company that will be examined. Determining the risk assessment's goal, such as control coverage, control efficacy, or business process effectiveness, is also crucial. The criteria for the audit must then be decided. Since any confirmation of qualifications would be made previous to this point, the phrases "Determine the qualifications of the firm that will execute the audit" and "Determine the qualifications of the person(s) who will perform the audit" are erroneous. It is erroneous to say, "Determine scope, application, and purpose for the audit," as an audit that was not necessary should not be carried out.

Question 116: Which of the following is the PRIMARY purpose of a Business Impact Analysis (BIA)?

To map network topology for disaster recovery
To determine the criticality of business processes and recovery time requirements (Correct answer)
To identify all IT assets in the organization
To assign financial value to security incidents

Correct answer: To determine the criticality of business processes and recovery time requirements

A BIA identifies critical business functions, their dependencies, and the time within which they must be restored to avoid unacceptable consequences.

Question 117: Which of the following is the PRIMARY purpose of a compliance audit?

To assess whether the organization's controls meet applicable requirements (Correct answer)
To identify all technical vulnerabilities in the organization's systems
To evaluate the efficiency of the IT department's operations
To test employee knowledge of security policies

Correct answer: To assess whether the organization's controls meet applicable requirements

A compliance audit evaluates whether an organization's controls, processes, and practices meet the requirements of applicable laws, regulations, or standards.

Question 118: What is the PRIMARY purpose of a Business Continuity Plan (BCP)?

To document the IT infrastructure and recovery procedures
To assign accountability for security incidents to key personnel
To ensure critical business functions can continue during and after a disruption (Correct answer)
To eliminate all risks that could disrupt business operations

Correct answer: To ensure critical business functions can continue during and after a disruption

A BCP is designed to ensure that critical business functions can continue during and after a disruption, minimizing operational impact.

Question 119: After containing a security incident, what is the MOST important next step before returning systems to production?

Bill the affected business unit for response costs
Conduct a root cause analysis and verify eradication of the threat (Correct answer)
Notify the press about the incident
Immediately restore from the most recent backup

Correct answer: Conduct a root cause analysis and verify eradication of the threat

Root cause analysis identifies how the incident occurred and confirms the threat is fully removed, preventing recurrence after restoration.

Question 120: Which of the following BEST defines 'security culture' within a governance context?

The technical security tools deployed across the organization
The frequency of penetration testing conducted annually
The shared values, behaviors, and attitudes toward security among employees (Correct answer)
The number of security policies documented by the organization

Correct answer: The shared values, behaviors, and attitudes toward security among employees

Security culture refers to the collective attitudes, values, and behaviors of employees toward security, which governance programs aim to develop and reinforce.

Question 121: What is the role of a cold site in a disaster recovery strategy?

A fully equipped facility with real-time data replication for immediate failover
A facility with basic infrastructure such as power and cooling, but no pre-installed IT equipment (Correct answer)
A secondary data center that mirrors the primary site at reduced capacity
A cloud environment maintained by a managed service provider

Correct answer: A facility with basic infrastructure such as power and cooling, but no pre-installed IT equipment

A cold site provides basic facilities (space, power, cooling) but has no pre-installed equipment, requiring significant setup time before operations can resume.

Question 122: A newly appointed CISM is reviewing the organization's information security governance structure. Which of the following BEST demonstrates effective governance?

Security policies are updated only after a breach occurs
Security decisions are made exclusively by the IT department
The CISO manages all security activities without oversight
The board of directors receives regular security risk reports (Correct answer)

Correct answer: The board of directors receives regular security risk reports

Effective governance requires board-level oversight and accountability, including regular reporting on security risks.

Question 123: A CISM discovers that a business unit is non-compliant with a key regulatory requirement. The MOST appropriate action is to:

Document the non-compliance, assess risk, and initiate a remediation plan with appropriate escalation (Correct answer)
Shut down the business unit's operations until compliance is achieved
Immediately report the business unit to the regulator
Ignore the issue if the probability of examination is low

Correct answer: Document the non-compliance, assess risk, and initiate a remediation plan with appropriate escalation

Non-compliance should be documented, risk-assessed, and addressed through a formal remediation plan with appropriate escalation to management.

Question 124: Which risk assessment approach assigns numerical values to probability and impact to calculate risk scores?

Quantitative risk assessment (Correct answer)
Qualitative risk assessment
Delphi technique
Scenario-based assessment

Correct answer: Quantitative risk assessment

Quantitative risk assessment uses numerical values (often monetary) to calculate risk scores, enabling objective comparison and cost-benefit analysis.

Question 125: A CISM is developing a compliance program. The FIRST step should be to:

Identify all applicable laws, regulations, and contractual obligations (Correct answer)
Conduct an internal audit of all existing controls
Assign compliance responsibilities to the legal team only
Purchase GRC (governance, risk, compliance) software

Correct answer: Identify all applicable laws, regulations, and contractual obligations

Identifying all applicable regulatory, legal, and contractual requirements is the foundational step before any compliance program activities can be structured.

Question 126: An organization experiences a security incident involving a third-party vendor's system. The CISM should FIRST:

Deploy monitoring tools on all vendor-connected systems
Immediately terminate the vendor contract
Invoke the vendor's contractual incident notification and response obligations (Correct answer)
File a complaint with the vendor's regulatory body

Correct answer: Invoke the vendor's contractual incident notification and response obligations

Contractual incident notification and response obligations should be invoked immediately to ensure the vendor takes required action and shares necessary information.

Question 127: According to an internal audit of the employee termination procedure, one or more terminated employee user accounts were not locked or deleted in 20% of employee terminations. The internal audit division discovered that regular monthly user access reviews detected 100% of missed account closures, leading to those user accounts being closed by 60 days following user termination. What, if any, corrective measures are necessary?

Increase user access review process frequency to twice per week.
Improve the user termination process to reduce the number of missed account closures. (Correct answer)
No action is necessary since monthly user access review process is effective.
Increase user access review process frequency to weekly.

Correct answer: Improve the user termination process to reduce the number of missed account closures.

The frequency of improper user terminations is too frequent. The time required to increase the frequency of user access evaluations will be too great. The most excellent solution is to figure out how to make the user termination procedure better. Since there are 20% "misses," every step is assumed to be manual. The user access review process is too time-consuming. Thus the statements "raise user access review process frequency to twice per week" and "increase user access review process frequency to weekly" are wrong. Since there are 20% "misses," every step is assumed to be manual. The statement, "No action is required since monthly user access review process is functional," is untrue because a "miss" rate of 20% would be considered excessive in most firms. A rate of less than 2% is acceptable.

Question 128: What is 'residual risk' in information security risk management?

The original risk before any assessment is performed
The risk transferred to cyber insurance policies
The risk that remains after controls have been applied (Correct answer)
The risk associated with legacy systems only

Correct answer: The risk that remains after controls have been applied

Residual risk is the amount of risk that remains after security controls have been implemented to reduce or manage the inherent risk.

Question 129: A CISM discovers that business units are making risk decisions without consulting the security team. The BEST corrective action is to:

Restrict business units from making any IT-related decisions
Report all business units to senior management immediately
Purchase risk management software for all business units
Implement mandatory security reviews into the project management process (Correct answer)

Correct answer: Implement mandatory security reviews into the project management process

Embedding mandatory security reviews into project management processes ensures risk is systematically considered before business decisions are finalized.

Question 130: Which of the following represents a governance control rather than a technical control?

Encryption of data at rest
Intrusion detection system
Acceptable use policy (Correct answer)
Multi-factor authentication

Correct answer: Acceptable use policy

An acceptable use policy is a governance (administrative) control that defines rules and expectations for users, rather than a technical enforcement mechanism.

Question 131: Which of the following BEST describes a 'control deficiency' in a compliance context?

A failure of a control to operate as intended or meet a required standard (Correct answer)
A regulatory requirement that the organization believes is excessive
A security tool that has been deprecated by the vendor
An employee who has violated an acceptable use policy

Correct answer: A failure of a control to operate as intended or meet a required standard

A control deficiency is a gap where a control either doesn't exist, fails to operate as designed, or fails to meet the required standard.

Question 132: When reviewing BC/DR plans, the information security manager should PRIMARILY ensure that:

Insurance coverage adequately compensates for losses during a business interruption
All employees receive training on disaster recovery procedures annually
Security controls are maintained and not bypassed during recovery operations (Correct answer)
Recovery sites are located in geographically distant regions from the primary site

Correct answer: Security controls are maintained and not bypassed during recovery operations

The information security manager must ensure that security controls remain in force during recovery, as the pressure to restore quickly can lead to shortcuts that introduce vulnerabilities.

Question 133: Which of the following is the MOST important factor in determining incident severity?

The potential business impact of the incident (Correct answer)
The number of systems technically involved
The type of attack technique used by the threat actor
The time of day the incident was detected

Correct answer: The potential business impact of the incident

Incident severity should be determined by potential business impact — the degree of harm to operations, data, reputation, and stakeholders.

Question 134: A third-party vendor with access to sensitive customer data has suffered a breach. What should the information security manager do FIRST?

Terminate the vendor contract immediately
Assess the impact on the organization and notify affected parties per policy (Correct answer)
Conduct a full audit of all vendor relationships
Wait for the vendor's incident report before taking action

Correct answer: Assess the impact on the organization and notify affected parties per policy

The immediate priority is assessing organizational impact and fulfilling notification obligations per policy and regulatory requirements.

Question 135: A newly appointed CISM discovers the organization has no formal security governance structure. The FIRST step should be to:

Perform a full network vulnerability scan
Deploy endpoint detection and response tools
Obtain executive sponsorship and establish governance authority (Correct answer)
Conduct a security awareness training campaign

Correct answer: Obtain executive sponsorship and establish governance authority

Without executive sponsorship and formal governance authority, a CISM cannot effectively implement or enforce any security program.

Question 136: When conducting a parallel test during disaster recovery, the organization is:

Shutting down primary systems and routing all traffic to the recovery site
Discussing recovery procedures with stakeholders without activating any systems
Migrating all data to a cloud backup environment for a 24-hour period
Running recovery systems simultaneously alongside production to validate functionality without disruption (Correct answer)

Correct answer: Running recovery systems simultaneously alongside production to validate functionality without disruption

A parallel test activates the recovery environment while keeping production running simultaneously, allowing validation of the DR site without risking a real outage.

Question 137: Which of the following is a KEY component of an effective risk communication strategy?

Publishing raw vulnerability data on the intranet
Translating risk findings into business terms for stakeholders (Correct answer)
Using technical jargon to demonstrate expertise
Restricting risk reports to IT and security teams only

Correct answer: Translating risk findings into business terms for stakeholders

Effective risk communication requires translating technical findings into business-relevant language so that stakeholders can make informed decisions.

Question 138: A third-party vendor has access to the organization's sensitive systems. Which control BEST reduces the associated risk?

Limiting communication with the vendor to email only
Requiring the vendor to purchase liability insurance
Conducting periodic vendor security assessments and right-to-audit clauses (Correct answer)
Requiring the vendor to sign a non-disclosure agreement

Correct answer: Conducting periodic vendor security assessments and right-to-audit clauses

Periodic assessments and right-to-audit clauses provide ongoing assurance that vendors maintain required security standards throughout the relationship.

Question 139: The following conditions lead to the MOST successful IT risk management activities:

Conducted by the IT department
Treated as a distinct process
Communicated to all employees
Integrated within business processes (Correct answer)

Correct answer: Integrated within business processes

Effective IT-related risk management activities are most effective when they are integrated within business processes.

Question 140: Which BC/DR test type carries the GREATEST risk of causing unplanned downtime?

Full interruption test (Correct answer)
Structured walkthrough
Tabletop exercise
Parallel test

Correct answer: Full interruption test

A full interruption test shuts down primary systems and fully activates recovery procedures, carrying the highest risk of real outages if the recovery environment fails.

Question 141: A CISM wants to improve detection of security incidents. The MOST effective improvement is to:

Increase the number of security policies documented
Purchase the newest endpoint antivirus solution available
Implement continuous monitoring with defined detection use cases aligned to risks (Correct answer)
Hire additional help desk staff to handle user reports

Correct answer: Implement continuous monitoring with defined detection use cases aligned to risks

Continuous monitoring with detection use cases aligned to the organization's specific risk profile maximizes the relevance and effectiveness of detection capabilities.

Question 142: Which of the following BEST describes the relationship between incident response and disaster recovery?

Incident response is managed by IT while disaster recovery is managed by facilities
Incident response focuses on containment and investigation; disaster recovery focuses on restoring business operations (Correct answer)
Disaster recovery is triggered only after incident response is fully complete
They are identical processes with the same objectives

Correct answer: Incident response focuses on containment and investigation; disaster recovery focuses on restoring business operations

Incident response focuses on containing, investigating, and eradicating threats, while disaster recovery focuses on restoring critical business operations and systems.

Question 143: A CISM has identified a critical vulnerability but the cost of remediation exceeds the potential loss. The MOST appropriate risk response is:

Risk avoidance
Risk acceptance (Correct answer)
Risk mitigation
Risk transfer

Correct answer: Risk acceptance

When remediation costs exceed the potential impact, accepting the risk is the most cost-effective response, provided it falls within the organization's risk appetite.

Question 144: Which framework is MOST commonly used to align information security management with overall IT governance?

NIST SP 800-53
OWASP Top 10
PCI DSS
COBIT (Control Objectives for Information and Related Technologies) (Correct answer)

Correct answer: COBIT (Control Objectives for Information and Related Technologies)

COBIT provides a comprehensive IT governance and management framework that aligns IT activities, including security, with enterprise objectives.

Question 145: What authentication technique stops authentication replay?

Wired equivalent privacy encryption usage
Password hash implementation
Challenge/response mechanism (Correct answer)
Hypertext Transfer Protocol basic authentication

Correct answer: Challenge/response mechanism

The challenge/response mechanism is an authentication method that effectively prevents authentication replay attacks.

Question 146: For a significant proposed purchase and new procedure for an organization, a risk assessment and business impact analysis (BIA) have been finished. The business department manager and the information security manager debate about who will be in charge of assessing the outcomes and identified risks. Which of the following would be the information security manager's BEST course of action?

Acceptance of the business manager’s decision on the risk to the corporation
Acceptance of the information security manager’s decision on the risk to the corporation
Create a new risk assessment and BIA to resolve the disagreement
Review of the risk assessment with executive management for final input (Correct answer)

Correct answer: Review of the risk assessment with executive management for final input

The best approach for the information security manager in this situation would be to review the risk assessment with executive management for final input.

Question 147: What is the PRIMARY purpose of tabletop exercises in incident management?

To test technical security controls in a live environment
To satisfy annual penetration testing requirements
To validate the incident response plan and team readiness through discussion-based scenarios (Correct answer)
To train help desk staff on ticket escalation procedures

Correct answer: To validate the incident response plan and team readiness through discussion-based scenarios

Tabletop exercises use discussion-based scenarios to test the incident response plan's effectiveness and identify gaps in team readiness without disrupting operations.

Question 148: Which of the following is MOST important when mapping security controls to regulatory requirements?

Using a unified control framework to address multiple requirements efficiently (Correct answer)
Focusing only on the most recent regulatory guidance
Implementing a separate set of controls for each regulation
Delegating control mapping entirely to external auditors

Correct answer: Using a unified control framework to address multiple requirements efficiently

A unified control framework maps controls to multiple regulations simultaneously, reducing duplication and improving efficiency across compliance programs.

Question 149: Which element should be included in a crisis communications plan?

Database recovery scripts and step-by-step IT restoration procedures
Pre-approved messaging templates and designated spokespersons for stakeholder communication (Correct answer)
Technical specifications for backup hardware at the recovery site
Financial projections for losses during a declared business interruption

Correct answer: Pre-approved messaging templates and designated spokespersons for stakeholder communication

A crisis communications plan defines who communicates, what is communicated, and provides pre-approved templates to ensure timely, consistent, and accurate messaging during a disruption.

Question 150: During a risk assessment, the team identifies a vulnerability with a high likelihood but very low impact. How should this risk MOST likely be treated?

Accept the risk without further action
Mitigate it with low-cost controls proportional to impact (Correct answer)
Implement costly countermeasures to eliminate it
Transfer the risk through cyber insurance

Correct answer: Mitigate it with low-cost controls proportional to impact

Risk treatment should be proportional; high-likelihood, low-impact risks warrant lightweight mitigating controls rather than expensive remediation or acceptance.

Question 151: Which of the following BEST describes the purpose of a security awareness training program?

To replace technical security controls
To test employees with unannounced phishing attacks
To educate employees about threats and their role in protecting information (Correct answer)
To satisfy regulatory requirements only

Correct answer: To educate employees about threats and their role in protecting information

Security awareness training educates employees about information security threats and their individual responsibilities in protecting organizational assets.

Certified Information Security Manager (CISM)

The CISM certification, administered by ISACA, validates expertise in managing and overseeing enterprise information security programs, covering governance, risk management, program development, and incident management. It targets experienced security managers and professionals seeking to demonstrate management-level security competence.

150

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

isaca.org — Renewal, test delivery, eligibility, score validity, fees, exam format, passing score, retake fee, score release, test dates · verified Oct 2026