CISM Practice Test

1. Which of the following BEST illustrates the difference between an information security incident and a disaster recovery (DR) event?

• A. An incident always requires invoking the full DR plan
• B. An incident is a security-relevant event requiring investigation and response, while DR specifically addresses recovery of IT services after significant disruption
• C. There is no meaningful difference between the two terms
• D. DR events are always caused by malicious actors, while incidents are always accidental

2. An information security manager is defining recovery time objectives (RTOs) for critical systems as part of incident and continuity planning. What should PRIMARILY determine the RTO for a given system?

• A. The preference of the system administrator
• B. The maximum tolerable downtime the business can withstand before unacceptable impact occurs
• C. The age of the hardware supporting the system
• D. The number of support tickets filed for the system last year

3. During incident response, which of the following is MOST important for maintaining the integrity of digital evidence that may later support legal action?

• A. Allowing any staff member to access and copy the evidence as needed
• B. Maintaining a documented chain of custody for all evidence collected
• C. Deleting evidence once the incident is resolved to save storage space
• D. Storing evidence on the affected system itself for convenience

4. During a multi-day incident affecting critical systems, business executives are demanding hourly technical updates that are consuming significant analyst time needed for containment. What is the BEST way for the incident manager to address this?

• A. Refuse to provide any updates until the incident is fully resolved
• B. Designate a dedicated communications liaison to provide scheduled executive updates, freeing technical staff to focus on response
• C. Allow executives to directly interrupt analysts whenever they want an update
• D. Shut down the incident response effort until executive demands subside

5. An organization wants to reduce the mean time to detect (MTTD) security incidents. Which investment would MOST directly support this goal?

• A. Increasing the frequency of security awareness training sessions only
• B. Implementing centralized log monitoring and correlation through a SIEM with defined use cases
• C. Reducing the number of firewalls in the network
• D. Publishing the incident response plan on the company intranet

6. Which of the following is the PRIMARY benefit of classifying incidents by severity level as part of an incident management process?

• A. It allows the security team to ignore lower severity events entirely
• B. It ensures response resources, escalation, and communication are proportionate to the incident's actual business impact
• C. It reduces the total number of incidents that occur
• D. It eliminates the need for a formal incident response plan

7. An organization experiences a data breach involving customer personal information. Which factor is MOST important in determining the appropriate notification timeline and recipients?

• A. The personal preference of the CEO
• B. Applicable legal and regulatory breach notification requirements based on the data and jurisdictions involved
• C. Whichever timeline is easiest for the marketing department
• D. The size of the IT budget for the current year

8. An organization's incident response plan has not been tested in three years. What is the GREATEST risk this poses?

• A. The plan document may use outdated formatting
• B. Response roles, contact information, and procedures may be outdated or ineffective when a real incident occurs
• C. The plan will automatically expire and become legally invalid
• D. Employees will refuse to follow the plan regardless of its content

9. During an active ransomware incident, which action should the incident response team take FIRST after detecting the compromise?

• A. Immediately notify all customers before understanding the scope
• B. Contain the affected systems to prevent further spread while preserving evidence
• C. Wait for the next scheduled incident review meeting
• D. Restore from backups without investigating the cause

10. Which of the following BEST defines the purpose of a post-incident review (lessons learned) process?

• A. To assign blame to individuals involved in the incident
• B. To identify root causes and process improvements to reduce the likelihood or impact of similar future incidents
• C. To close the incident ticket as quickly as possible without further analysis
• D. To satisfy a public relations requirement only

11. How do incident response and business continuity planning relate?

• A. They are alternative names for the same plan
• B. Incident response replaces business continuity for cyber events
• C. Business continuity applies only to natural disasters
• D. Incident response addresses the security event itself while business continuity maintains critical operations, and a severe incident invokes both

12. A tabletop exercise is run for the incident response team. What does it validate that a technical drill does not?

• A. Decision-making, escalation paths and coordination between technical, legal, communications and executive participants under scenario pressure
• B. The throughput of the detection tooling
• C. The patch level of production systems
• D. The accuracy of the asset inventory

13. After an incident is resolved, a post-incident review is held. What is its principal purpose?

• A. To identify what allowed the incident and what impeded the response, producing improvements to controls and to the plan itself
• B. To determine which individual was at fault
• C. To calculate the exact financial loss for accounting
• D. To formally close the incident ticket

14. An incident response plan defines phases. What is the purpose of the containment phase?

• A. To notify regulators of the breach
• B. To limit the incident's spread and damage while preserving evidence, before eradication of the cause begins
• C. To identify the root cause of the incident
• D. To restore all systems to normal operation

15. An incident may involve criminal activity and potential litigation. What does this require of evidence handling?

• A. A documented chain of custody and forensically sound acquisition, so the evidence remains admissible and its integrity demonstrable
• B. Immediate deletion of affected data to prevent further exposure
• C. Analysis performed only on the original media
• D. Restricting all documentation to verbal briefings

16. During an incident, a responder wants to reboot a compromised server immediately. What is the concern?

• A. Rebooting would alert the attacker
• B. There is no concern, since disk evidence is sufficient
• C. Volatile evidence in memory and active connections would be lost, potentially destroying the only record of how the compromise occurred and what else it reached
• D. The server would take too long to restart

17. An organization measures mean time to detect and mean time to respond. What do these indicate?

• A. The number of incidents occurring per month
• B. How long an adversary operates undetected and how quickly the organization acts once aware, both of which bound the damage an incident causes
• C. The cost of the security operations function
• D. The technical severity of each incident

18. A security manager is asked whether an incident constitutes a reportable breach. What primarily determines this?

• A. The applicable legal and regulatory definitions against the facts established, including the data involved and the jurisdictions of affected individuals
• B. The organization's internal severity rating alone
• C. Whether the media has reported the incident
• D. Whether the attacker has been identified

19. An incident response plan requires a communication protocol. Why is this a distinct element?

• A. Because regulatory notification is never time-bound
• B. Because who says what to regulators, customers, staff and media, and when, must be decided in advance rather than improvised under pressure
• C. Because communication is optional in most incidents
• D. Because technical responders should handle all external communication

20. During a significant incident that may require public disclosure, why is it important for the information security manager to coordinate closely with legal and communications teams before any public statement is released?

• A. To delay the incident response process until a statement is fully drafted.
• B. To ensure the statement uses the most technical language possible for accuracy.
• C. To transfer full responsibility for the incident response to the communications team.
• D. To ensure the statement is factually accurate, legally sound, and does not disclose information that could aid attackers or violate notification obligations.

21. An organization discovers that an attacker compromised an executive's email account and used it to instruct the finance department to wire funds to a fraudulent account, a portion of which was transferred before detection. In addition to securing the compromised account, what should the incident response include?

• A. Notification to the marketing department to update the company website.
• B. A review of the physical security badge access logs for the building.
• C. Prompt engagement with the organization's bank and, where applicable, law enforcement to attempt to recall or trace the fraudulent transfer, alongside a review of financial approval controls.
• D. A mandatory password reset for all customers of the organization.

22. What criteria should PRIMARILY determine when an information security incident can formally be closed?

• A. When exactly 30 days have passed since detection, regardless of remediation status.
• B. When the incident response team simply runs out of available time to continue working it.
• C. When the affected business unit stops asking for status updates.
• D. When containment, eradication, and recovery actions are verified complete, the root cause is addressed, and any required documentation and notifications are finished.

23. During evidence collection for a security incident that may result in legal action, an analyst images a hard drive and documents who handled it, when, and for what purpose at each step. What is the PRIMARY reason this documentation is maintained?

• A. To reduce the storage space required for the evidence.
• B. To satisfy the organization's data retention policy.
• C. To allow the evidence to be deleted more quickly after the investigation.
• D. To establish a defensible chain of custody demonstrating the evidence was not altered or tampered with between collection and use.

24. An information security manager wants to report the total organizational cost of a recent incident to executive leadership. Which set of factors should this figure PRIMARILY include?

• A. Direct costs such as remediation, legal fees, and regulatory fines, along with reasonably estimable indirect costs such as business disruption.
• B. Only the cost of new security tools purchased after the incident.
• C. Only the salary of the incident response team members involved.
• D. Only the cost of the cyber insurance premium for the following year.

25. An organization develops documented runbooks that specify step-by-step actions for responding to common incident types, such as ransomware or phishing, before any incident occurs. Which incident response phase does this activity belong to?

• A. Preparation.
• B. Recovery.
• C. Containment.
• D. Eradication.

26. An information security program is being designed for a mid-sized organization. Which of the following BEST reflects a properly structured security program?

• A. A single antivirus product deployed across all endpoints
• B. A set of coordinated policies, standards, processes, and controls aligned to the security strategy and risk appetite
• C. An annual penetration test with no other ongoing activity
• D. A dedicated incident response team with no supporting policies

27. A security program includes a control requiring segregation of duties between developers and production system administrators. What is the PRIMARY security benefit of this control?

• A. It reduces the number of employees needed
• B. It reduces the risk of unauthorized or unreviewed changes being introduced into production
• C. It eliminates the need for change management processes
• D. It guarantees compliance with all data privacy regulations

28. An organization is implementing a data classification scheme as part of its security program. What is the MOST important reason for classifying data BEFORE applying protective controls?

• A. Classification is required only for marketing purposes
• B. It ensures that controls are proportionate to the sensitivity and value of the data, avoiding both under- and over-protection
• C. It allows the organization to charge different prices for data storage
• D. It removes the need for encryption on all data

29. An information security manager is developing key performance indicators (KPIs) for the vulnerability management process. Which KPI provides the MOST meaningful insight into program effectiveness?

• A. Total number of vulnerability scans run per month
• B. Average time to remediate critical vulnerabilities compared to defined SLA targets
• C. Number of security tools purchased for scanning
• D. Number of employees on the vulnerability management team

30. An information security manager is selecting metrics to report program performance to the board. Which characteristic is MOST important for these metrics to have?

• A. They should be highly technical to demonstrate the team's expertise
• B. They should be meaningful to a business audience and tied to risk reduction or business impact
• C. They should change every quarter to appear dynamic
• D. They should focus solely on the number of security incidents, regardless of severity

31. A vulnerability management program consistently identifies critical vulnerabilities that remain unpatched for over six months due to competing IT priorities. What is the BEST course of action for the information security manager?

• A. Accept the delays as normal since IT is busy
• B. Work with IT leadership to establish and enforce risk-based remediation SLAs tied to vulnerability severity
• C. Personally patch the systems without IT involvement
• D. Stop scanning for vulnerabilities to avoid generating findings IT cannot address

32. When integrating security requirements into the systems development life cycle (SDLC), at which phase is it MOST cost-effective to identify and address security requirements?

• A. During production after deployment
• B. During the requirements and design phases, before development begins
• C. Only during user acceptance testing
• D. During the post-incident review after a breach

33. Which of the following is the PRIMARY purpose of a security awareness training program within an information security program?

• A. To satisfy a checkbox requirement for annual audits
• B. To reduce human-related risk by ensuring employees understand their security responsibilities and recognize common threats
• C. To replace the need for technical controls
• D. To provide a source of revenue through internal training fees

34. Which of the following is the MOST important consideration when selecting security controls to include in an information security program?

• A. Selecting the newest technology available regardless of fit
• B. Ensuring controls are proportionate to identified risks and aligned with business and regulatory requirements
• C. Selecting controls solely based on vendor marketing claims
• D. Choosing the least expensive controls available

35. Which of the following BEST describes the role of an information security program in supporting business continuity?

• A. The security program is entirely separate from business continuity and should not interact with it
• B. The security program provides controls and processes, such as backup protection and access continuity, that support the organization's ability to maintain and recover critical operations
• C. Business continuity planning is solely the responsibility of facilities management
• D. Security controls should be disabled during a declared disaster to speed up recovery

36. A security manager introduces a control that materially slows a revenue-generating process. What is the appropriate course?

• A. Quantify the risk reduction against the business impact and present the trade-off to the accountable business owner for a decision
• B. Implement the control regardless, since security takes precedence
• C. Abandon the control, since business operations take precedence
• D. Implement the control without informing the business

37. How do preventive, detective and corrective controls differ in function?

• A. Corrective controls operate before an event
• B. Preventive controls are technical and detective controls are administrative
• C. Detective controls are always stronger than preventive ones
• D. Preventive controls stop an event occurring, detective controls identify that it occurred, and corrective controls restore the state afterward

38. A security manager wants to reduce the risk of insider data theft. Which combination addresses it most completely?

• A. Least privilege and segregation of duties, monitoring of sensitive data access, and defined joiner-mover-leaver processes
• B. Perimeter firewall rules and intrusion prevention alone
• C. Antivirus deployment across all endpoints
• D. Annual penetration testing of external systems

39. A security programme reports a declining number of detected incidents. How should this be interpreted?

• A. Cautiously, since it may indicate improved prevention or degraded detection, and the two require different responses
• B. As unambiguous evidence that security has improved
• C. As evidence that the security budget should be reduced
• D. As evidence that reporting should be discontinued

40. A security awareness programme is measured by completion rates. What is the limitation of that metric?

• A. It measures participation rather than behaviour change, so it can be high while susceptibility to social engineering remains unchanged
• B. It cannot be collected reliably
• C. It is prohibited by privacy regulation
• D. It applies only to technical staff

41. A vulnerability management programme reports thousands of open findings. How should remediation be prioritized?

• A. By risk to the organization, combining severity with exploitability, exposure and the criticality of the affected asset
• B. By the technical severity score alone, highest first
• C. By the age of the finding, oldest first
• D. By the ease of remediation, simplest first

42. A third-party supplier will process sensitive data. What should the security manager ensure before onboarding?

• A. Due diligence proportionate to the risk, contractual security requirements including breach notification and audit rights, and defined ongoing monitoring
• B. That the supplier holds any security certification, without reviewing its scope
• C. That the supplier is larger than the organization
• D. That procurement has obtained the lowest price

43. A security programme is being built. What should determine the controls selected?

• A. The risk assessment results and the organization's risk appetite, so controls address assessed exposures at proportionate cost
• B. A complete implementation of every control in a chosen framework
• C. The controls the previous security manager preferred
• D. The products the organization already owns licences for

44. A security manager inherits a programme with no asset inventory. Why is this the priority to address?

• A. Because controls, risk assessment, vulnerability management and incident scoping all depend on knowing what exists and who owns it
• B. Because inventories are required for software licensing compliance
• C. Because it determines the security team's budget
• D. Because it is the easiest deliverable to complete quickly

45. An organization is redesigning its network architecture around the principle that no user or device should be inherently trusted, regardless of whether it is inside or outside the traditional network perimeter. This describes which architectural approach?

• A. Perimeter-based security.
• B. Segregation of duties.
• C. Zero trust architecture, which requires continuous verification of identity and context for every access request.
• D. Defense in depth.

46. An organization implements a data loss prevention (DLP) solution as part of its information security program. What is the PRIMARY purpose of this control?

• A. To manage user authentication across applications.
• B. To detect and remediate software vulnerabilities.
• C. To encrypt all data at rest automatically.
• D. To detect and prevent unauthorized transmission or exfiltration of sensitive data.

47. An information security manager wants a metric that reflects how consistently systems adhere to the organization's hardened configuration standard over time. Which metric BEST serves this purpose?

• A. The total number of servers owned by the organization.
• B. The average age of the organization's hardware inventory.
• C. The number of help desk tickets submitted per month.
• D. The percentage of systems found compliant with the configuration baseline during periodic scans.

48. An organization permits employees to access corporate email and data on personally owned mobile devices (BYOD) without any mobile device management (MDM) enrollment requirement. What is the GREATEST security gap this creates?

• A. The organization will be unable to issue any devices to employees in the future.
• B. Personal devices will automatically be slower than corporate-issued devices.
• C. The organization has no ability to enforce security configurations or remotely wipe corporate data if a device is lost, stolen, or compromised.
• D. Employees will be unable to access corporate resources from their devices.

49. An information security manager wants independent assurance that implemented controls are actually operating as designed, beyond the team's own self-assessment. What is the MOST appropriate approach?

• A. Rely on the control owners' self-reported completion status.
• B. Engage internal audit or an independent third party to test control effectiveness.
• C. Review the original control design documentation only.
• D. Assume controls are effective if no incidents have occurred recently.

50. What is the PRIMARY function of a security operations center (SOC) within an information security program?

• A. Drafting the organization's information security policies.
• B. Conducting the organization's financial audits.
• C. Continuously monitoring, detecting, and initially responding to security events across the environment.
• D. Approving the organization's annual security budget.

51. When calculating risk during a quantitative risk assessment, which formula BEST represents the relationship between the key variables typically used?

• A. Risk = Asset Value / Threat Frequency
• B. Risk = Likelihood of a threat exploiting a vulnerability × Impact of that occurrence
• C. Risk = Number of controls implemented
• D. Risk = Cost of the asset minus insurance coverage

52. A company's risk appetite statement specifies that it will not accept any risk with the potential for regulatory fines exceeding a defined threshold. A newly identified risk exceeds this threshold but is inexpensive to remediate. What should the information security manager recommend?

• A. Accept the risk since remediation cost is a separate consideration
• B. Remediate the risk to bring it within the defined risk appetite
• C. Escalate to the board only if the fine is actually imposed
• D. Transfer all responsibility to the compliance department without further security involvement

53. During a risk assessment, an information security manager identifies a legacy application with a known vulnerability, but the business unit refuses to fund remediation because the system will be decommissioned in six months. What is the MOST appropriate next step?

• A. Force decommissioning immediately regardless of business needs
• B. Document the risk, ensure it is formally accepted by an authorized business owner, and implement compensating controls if feasible
• C. Ignore the finding since the system will soon be retired
• D. Escalate directly to external regulators

54. An organization is evaluating two risk treatment options for a vulnerable legacy system: patching it now for a moderate cost, or replacing it next year at a much higher cost with lower risk reduction in the interim. What should PRIMARILY drive this decision?

• A. The personal preference of the IT manager
• B. A cost-benefit analysis comparing the risk reduction achieved against the cost and timing of each option
• C. Whichever option requires less paperwork
• D. The vendor offering the largest discount

55. An organization decides to purchase cyber insurance to address the financial impact of a potential ransomware attack rather than investing further in prevention controls. This is an example of which risk treatment option?

• A. Risk avoidance
• B. Risk transfer
• C. Risk acceptance
• D. Risk mitigation

56. Which of the following is the MOST important reason to perform periodic reassessment of previously identified and accepted risks?

• A. To satisfy an arbitrary documentation requirement
• B. Because the threat landscape, asset value, and control environment can change, altering the risk's likelihood or impact over time
• C. To reduce the size of the risk register
• D. Because auditors always require it regardless of business context

57. A risk register lists a high-likelihood, high-impact risk with no assigned owner or treatment plan. What is the BEST immediate action for the information security manager?

• A. Delete the entry since it lacks an owner
• B. Assign an accountable risk owner and drive development of a treatment plan with a target date
• C. Wait until the next annual risk assessment cycle
• D. Transfer the risk to the audit department by default

58. Which risk treatment option is being applied when an organization buys cyber insurance?

• A. Transfer or sharing, since the financial consequence moves to another party while the operational risk remains
• B. Mitigation, since the likelihood of an incident falls
• C. Acceptance, since no action was taken
• D. Avoidance, since the risk no longer applies

59. An organization defines its risk appetite. What role does it play in security decisions?

• A. It sets the threshold above which risk must be treated rather than accepted, making treatment decisions consistent across the organization
• B. It specifies which security products must be purchased
• C. It determines the security team's headcount
• D. It eliminates the need for individual risk assessments

60. A newly identified threat is added to the risk assessment. What should trigger reassessment of existing risks?

• A. Material change in the threat landscape, business processes, technology or regulation, in addition to a periodic cycle
• B. Only the annual review date
• C. Only a security incident
• D. Only a request from internal audit

61. A quantitative risk analysis estimates annualized loss expectancy. What does that figure represent?

• A. The expected loss per year from a risk, combining the loss per occurrence with how often occurrences are expected
• B. The worst-case loss from a single occurrence
• C. The cost of the controls addressing the risk
• D. The insurance premium for the exposure

62. A risk assessment produces an inherent risk rating and a residual risk rating. What is the difference?

• A. Inherent risk is the exposure before considering controls, while residual risk is what remains after existing controls operate as designed
• B. Inherent risk is the risk after treatment and residual is before
• C. Inherent risk applies to external threats and residual to internal ones
• D. The two are the same measure at different points in time

63. A risk register entry has no named owner. Why is this a significant weakness?

• A. Because without an accountable owner no one is responsible for treating the risk or for the consequences of accepting it, so the entry documents rather than manages it
• B. Because a register cannot be maintained without owners
• C. Because owners are required by all security standards
• D. Because unowned risks are automatically the security manager's

64. A control costs more per year than the annualized loss expectancy of the risk it addresses. What does this suggest?

• A. The control is not cost-justified on that risk alone, though qualitative factors such as regulatory obligation or reputational harm may still justify it
• B. The control should always be implemented regardless of cost
• C. The risk assessment must be wrong
• D. The risk should be transferred automatically

65. Two independent risk assessments of the same critical system, conducted using different methodologies, produce materially different risk ratings: one rates the system as high risk and the other as moderate risk. Executive leadership is preparing to make a funding decision based on these results. What should the information security manager do FIRST?

• A. Present both ratings to leadership and let them choose which one to believe.
• B. Reconcile the differences by examining the underlying assumptions, scope, and data of each assessment before presenting a unified recommendation.
• C. Discard both assessments and postpone the funding decision indefinitely.
• D. Adopt the higher rating automatically, since it represents the more conservative outcome.

66. In quantitative risk analysis, the exposure factor represents which of the following?

• A. The total financial value of an asset.
• B. The annual frequency of a threat event occurring.
• C. The total number of threats facing an asset.
• D. The percentage of an asset's value that would be lost if a specific threat event occurred.

67. An organization is evaluating whether to launch a new product feature that would require processing highly sensitive data in a jurisdiction with weak data protection enforcement and no feasible compensating controls. Which risk treatment option is the organization applying if it decides not to launch the feature at all?

• A. Risk mitigation.
• B. Risk acceptance.
• C. Risk avoidance.
• D. Risk transfer.

68. An information security manager wants to improve the accuracy of likelihood estimates used in the organization's risk assessments. Which action would MOST directly improve this?

• A. Incorporating current threat intelligence relevant to the organization's industry and technology environment.
• B. Increasing the frequency of employee security awareness training.
• C. Reducing the number of risk categories tracked in the risk register.
• D. Outsourcing the entire risk assessment process to a single vendor.

69. An organization formally accepts a risk associated with an outdated authentication mechanism on a legacy system because replacement is not feasible in the near term. What should accompany this risk acceptance?

• A. Documented compensating controls, such as enhanced monitoring, that reduce exposure while the underlying risk remains.
• B. Transfer of the risk to the software vendor.
• C. No further action, since acceptance means the risk requires no additional attention.
• D. Removal of the system from the risk register to simplify reporting.

70. An organization needs to assess risk for a new initiative but lacks reliable historical loss data and cannot easily estimate financial impact in dollar terms. Which risk assessment approach is MOST appropriate?

• A. A purely quantitative approach using annualized loss expectancy calculations.
• B. No formal risk assessment is needed since data is unavailable.
• C. A qualitative approach using risk ratings such as high, medium, and low based on expert judgment.
• D. A purely statistical approach based on industry-wide breach cost averages.

71. An organization is rapidly adopting generative AI tools across business units without a formal risk assessment process for new technology adoption. What is the GREATEST concern with this approach?

• A. Generative AI tools cannot be used for legitimate business purposes.
• B. Employees will become overly reliant on AI for routine tasks.
• C. Sensitive data may be exposed to external AI providers or embedded in outputs without appropriate risk evaluation and controls.
• D. AI tools are inherently more expensive than traditional software.

72. After implementing a set of security controls, the residual risk for a critical system remains above the organization's documented risk appetite. What is the MOST appropriate next step for the information security manager?

• A. Consider the risk treatment complete since controls were implemented.
• B. Identify and implement additional controls, or escalate the residual risk for formal acceptance by an authorized party.
• C. Remove the risk from the risk register since it has already been treated.
• D. Transfer full responsibility for the residual risk to the system's end users.

73. An organization purchases a cyber insurance policy to cover the financial costs of a potential data breach. What is an important LIMITATION of this risk transfer strategy that the information security manager should communicate to leadership?

• A. Cyber insurance eliminates the need for any technical security controls.
• B. Cyber insurance transfers full legal accountability for the breach to the insurer.
• C. Cyber insurance automatically prevents breaches from occurring.
• D. Cyber insurance may not cover reputational damage, regulatory penalties, or losses from failure to meet policy security requirements.

74. An information security manager facilitates risk assessments and maintains the risk register, but a specific risk in the register concerns a business application owned by a department director. Who should be assigned as the risk owner for that item?

• A. The department director, since they have the authority and accountability to make decisions about that application's risk.
• B. The information security manager, since they maintain the risk register.
• C. The organization's external auditor.
• D. No owner is required as long as the risk is documented.

75. A project team plans to launch a new customer-facing application in eight weeks and requests that the risk assessment be skipped to meet the deadline, citing that a similar application was assessed two years ago. What is the MOST appropriate response from the information security manager?

• A. Perform a scoped risk assessment for the new application, since the threat landscape and application design may have changed materially since the prior assessment.
• B. Approve skipping the assessment since a similar application was already assessed previously.
• C. Delay the launch indefinitely until a full enterprise-wide risk assessment is completed.
• D. Allow the project team to self-certify that no significant risks exist.

76. An information security steering committee is being formed. Which composition BEST supports effective governance oversight?

• A. Only members of the IT department, since they understand the technical risks
• B. Senior representatives from business units, IT, legal, HR, and risk management
• C. External auditors exclusively, to ensure independence
• D. The information security manager alone, to avoid conflicting priorities

77. An organization's information security policy has not been updated in five years, though the business has since adopted cloud computing and remote work extensively. What is the GREATEST risk of this situation?

• A. Employees may not have read the policy
• B. The policy no longer reflects the current risk environment, leaving gaps in governance and control coverage
• C. The policy document is a different font than newer documents
• D. Legal counsel was not involved in the original drafting

78. A candidate is planning their CISM certification timeline after passing the exam. Which statement about the certification application process is accurate?

• A. Candidates must apply for certification within 5 years of passing the exam
• B. Candidates must apply for certification within 30 days of passing the exam
• C. There is no time limit to apply for certification after passing
• D. Certification is granted automatically the moment the exam is passed

79. Which of the following BEST demonstrates that an organization's information security strategy is aligned with business objectives?

• A. The security budget increases every fiscal year
• B. Security initiatives are prioritized and funded based on their support of documented business goals
• C. The security team reports directly to the CEO
• D. All security policies have been reviewed within the past 12 months

80. A candidate wants to know how the CISM exam is delivered. Which of the following correctly describes the available delivery modes?

• A. Only in-person at a test center, with no remote option
• B. Candidates may choose either an in-person test center or an online remote-proctored option
• C. Only through a mobile app with no proctoring
• D. Exclusively through employer-sponsored on-site testing

81. An organization must comply with multiple overlapping regulatory regimes. What approach reduces duplicated effort?

• A. A common control framework mapped to each regime's requirements, so one control implementation satisfies several obligations and is tested once
• B. A separate security programme for each regime
• C. Complying with only the strictest regime and ignoring the others
• D. Delegating all compliance to the internal audit function

82. Who should own an information security policy and approve it?

• A. Senior management or the board, since a policy sets organization-wide direction that only that level can mandate
• B. The security operations team that will enforce it
• C. The internal audit function
• D. The external security consultant who drafted it

83. An information security strategy is being developed. What should it be aligned to first?

• A. The organization's business objectives and strategy, so security investment supports what the organization is trying to achieve
• B. The security manager's professional certification syllabus
• C. The controls implemented by industry peers
• D. The latest available security technologies

84. How do a policy, a standard, a procedure and a guideline differ in a security documentation hierarchy?

• A. A policy states mandatory direction, a standard specifies mandatory requirements meeting it, a procedure gives step-by-step instructions, and a guideline offers recommended but optional practice
• B. All four are mandatory and differ only in length
• C. A guideline is mandatory and a standard is optional
• D. A procedure sets direction and a policy implements it

85. What does information security governance establish that a security programme alone does not?

• A. The accountability structure, decision rights and oversight that direct the programme and hold it to account
• B. The technical configuration of security tooling
• C. The daily operational response to security alerts
• D. The vendor selection for security products

86. A security manager must report programme status to the board. What reporting approach is most effective?

• A. Expressing status in terms of risk to business objectives, trends and decisions required, rather than technical control counts
• B. Providing the raw output of vulnerability scanning tools
• C. Reporting the number of blocked firewall connections
• D. Listing every security incident with full technical detail

87. A security manager proposes a maturity model assessment of the programme. What does it provide that a control gap analysis does not?

• A. A view of how consistently and repeatably processes operate, distinguishing a control performed ad hoc from one that is managed and measured
• B. A list of missing controls
• C. The financial cost of remediation
• D. The technical configuration of each system

88. An organization has passed all required regulatory compliance audits for the past three years but has experienced two significant security incidents caused by control gaps that fell outside the scope of the audited requirements. What does this scenario BEST illustrate?

• A. The compliance audits were performed incorrectly.
• B. Compliance with regulatory requirements is necessary but not sufficient for effective security governance, which must address risk beyond the minimum mandated baseline.
• C. Regulatory requirements are always sufficient to prevent security incidents.
• D. The organization should discontinue compliance audits since they did not prevent incidents.

89. A parent company with a conservative risk appetite acquires a subsidiary operating in a jurisdiction where local competitors normally accept far higher levels of cyber risk to remain price-competitive. The subsidiary's leadership resists adopting the parent's security requirements, citing competitive disadvantage. What is the MOST appropriate governance approach for the information security manager to recommend?

• A. Allow the subsidiary to define its own independent risk appetite separate from the parent company.
• B. Mandate immediate, uniform application of all parent company controls regardless of local business impact.
• C. Engage subsidiary and parent governance stakeholders to reconcile risk appetite differences through a documented, risk-based exception and phased-adoption plan.
• D. Defer the decision entirely to the subsidiary's local IT department.

90. An information security manager conducts a maturity assessment and finds the organization's security processes are performed but not consistently documented or repeatable across teams. According to common maturity models, this level is BEST characterized as which stage?

• A. Nonexistent, where no processes are performed at all.
• B. Optimized, where processes are continuously improved using metrics.
• C. Managed and measured, where processes are quantitatively controlled.
• D. Repeatable but informal, where processes are performed and produce results but are not consistently documented or standardized across teams.

91. An organization's governance framework requires that critical third-party service providers be subject to periodic security oversight. What is the PRIMARY reason this oversight should be governed at the enterprise level rather than left to individual business units?

• A. It ensures consistent risk criteria and accountability are applied across all vendor relationships regardless of which unit engages them.
• B. It eliminates the need for contractual security clauses.
• C. It reduces the total number of vendors the organization can use.
• D. It transfers all security liability to the third party.

92. A new data protection regulation in the organization's operating jurisdiction introduces mandatory breach notification requirements. What should the information security manager do FIRST?

• A. Immediately notify all customers of the new regulatory requirement.
• B. Purchase additional cyber insurance to cover potential fines.
• C. Wait until a breach occurs before determining notification obligations.
• D. Assess current incident response and governance processes against the new requirement to identify gaps.

93. A governance committee is reviewing two competing security investments with similar cost but different expected outcomes: one reduces the likelihood of a low-impact, high-frequency risk, and the other reduces the impact of a low-frequency, catastrophic risk. Absent other constraints, which consideration should MOST influence the committee's prioritization?

• A. The investment that is easiest to implement technically.
• B. The organization's documented risk appetite and tolerance for catastrophic versus recurring losses.
• C. The investment that has been requested most recently by staff.
• D. The investment with the shorter vendor contract term.

94. An information security strategy was approved eighteen months ago. The organization has since undergone a merger and entered new markets. What should trigger a formal review of the security strategy?

• A. The passage of exactly twelve months since the last review.
• B. A request from the IT help desk for additional staffing.
• C. The renewal date of the cyber insurance policy.
• D. Material changes to the business, such as a merger or new market entry, that alter the risk and threat landscape.

95. An information security manager is preparing a business case to secure funding for a new security initiative. Which approach is MOST likely to gain executive support?

• A. Frame the initiative in terms of business risk reduction and alignment with strategic objectives.
• B. Emphasize the technical sophistication of the proposed controls.
• C. Highlight the number of vulnerabilities the initiative will remediate.
• D. Compare the initiative's cost to typical industry security budgets.

96. A business unit leader overrules a security control recommendation from the information security manager, citing operational impact, and proceeds without documented risk acceptance. What is the MOST appropriate governance response?

• A. Accept the business unit leader's decision without further action since they own the operational risk.
• B. Escalate the unresolved risk to the appropriate governance body, such as a steering committee, for formal risk acceptance.
• C. Implement the control unilaterally despite the business unit's objection.
• D. Document the disagreement informally and take no further action.

97. A business unit requests a formal exception to a mandatory security policy due to a legacy application that cannot support required controls. What should the information security manager ensure is part of the exception process?

• A. The exception is granted permanently once approved to avoid repeated requests.
• B. The business unit is exempted from all related policies going forward.
• C. The exception includes documented compensating controls, an owner, and a defined expiration or review date.
• D. The exception is kept informal to expedite business operations.

98. A global organization with autonomous regional business units is deciding between a centralized and a federated information security governance model. Which factor MOST strongly favors a federated approach?

• A. Significant differences in regulatory requirements and risk profiles across regions.
• B. A desire to minimize the total number of security staff employed.
• C. A preference for uniform security metrics across all regions.
• D. The need to reduce the overall cost of the security program.

99. Within an information security governance structure, which activity is MOST appropriately reserved for the board of directors rather than delegated to security management?

• A. Configuring firewall rule sets for the perimeter network.
• B. Selecting a specific vulnerability scanning tool.
• C. Assigning incident response duties during a live security event.
• D. Approving the organization's overall risk appetite for information security.

100. An information security manager wants to add leading indicators to a governance dashboard that currently only reports incident counts and audit findings. Which metric BEST serves as a leading indicator?

• A. Percentage of critical systems with overdue vulnerability patches.
• B. Total financial loss attributed to past breaches.
• C. Number of audit findings closed in the prior year.
• D. Number of security incidents reported last quarter.