CISM Practice Test

1. A candidate wants to know how the CISM exam is delivered. Which of the following correctly describes the available delivery modes?

• A. Only in-person at a test center, with no remote option
• B. Candidates may choose either an in-person test center or an online remote-proctored option
• C. Only through a mobile app with no proctoring
• D. Exclusively through employer-sponsored on-site testing

2. Which of the following BEST demonstrates that an organization's information security strategy is aligned with business objectives?

• A. The security budget increases every fiscal year
• B. Security initiatives are prioritized and funded based on their support of documented business goals
• C. The security team reports directly to the CEO
• D. All security policies have been reviewed within the past 12 months

3. An information security steering committee is being formed. Which composition BEST supports effective governance oversight?

• A. Only members of the IT department, since they understand the technical risks
• B. Senior representatives from business units, IT, legal, HR, and risk management
• C. External auditors exclusively, to ensure independence
• D. The information security manager alone, to avoid conflicting priorities

4. An organization's information security policy has not been updated in five years, though the business has since adopted cloud computing and remote work extensively. What is the GREATEST risk of this situation?

• A. Employees may not have read the policy
• B. The policy no longer reflects the current risk environment, leaving gaps in governance and control coverage
• C. The policy document is a different font than newer documents
• D. Legal counsel was not involved in the original drafting

5. A candidate is planning their CISM certification timeline after passing the exam. Which statement about the certification application process is accurate?

• A. Candidates must apply for certification within 5 years of passing the exam
• B. Candidates must apply for certification within 30 days of passing the exam
• C. There is no time limit to apply for certification after passing
• D. Certification is granted automatically the moment the exam is passed

6. An information security strategy is being developed. What should it be aligned to first?

• A. The organization's business objectives and strategy, so security investment supports what the organization is trying to achieve
• B. The security manager's professional certification syllabus
• C. The controls implemented by industry peers
• D. The latest available security technologies

7. Who should own an information security policy and approve it?

• A. Senior management or the board, since a policy sets organization-wide direction that only that level can mandate
• B. The security operations team that will enforce it
• C. The internal audit function
• D. The external security consultant who drafted it

8. How do a policy, a standard, a procedure and a guideline differ in a security documentation hierarchy?

• A. A policy states mandatory direction, a standard specifies mandatory requirements meeting it, a procedure gives step-by-step instructions, and a guideline offers recommended but optional practice
• B. All four are mandatory and differ only in length
• C. A guideline is mandatory and a standard is optional
• D. A procedure sets direction and a policy implements it

9. A security manager must report programme status to the board. What reporting approach is most effective?

• A. Expressing status in terms of risk to business objectives, trends and decisions required, rather than technical control counts
• B. Providing the raw output of vulnerability scanning tools
• C. Reporting the number of blocked firewall connections
• D. Listing every security incident with full technical detail

10. What does information security governance establish that a security programme alone does not?

• A. The accountability structure, decision rights and oversight that direct the programme and hold it to account
• B. The technical configuration of security tooling
• C. The daily operational response to security alerts
• D. The vendor selection for security products

11. An organization must comply with multiple overlapping regulatory regimes. What approach reduces duplicated effort?

• A. A common control framework mapped to each regime's requirements, so one control implementation satisfies several obligations and is tested once
• B. A separate security programme for each regime
• C. Complying with only the strictest regime and ignoring the others
• D. Delegating all compliance to the internal audit function

12. A security manager proposes a maturity model assessment of the programme. What does it provide that a control gap analysis does not?

• A. A view of how consistently and repeatably processes operate, distinguishing a control performed ad hoc from one that is managed and measured
• B. A list of missing controls
• C. The financial cost of remediation
• D. The technical configuration of each system

13. The CISO in an organization reports administratively to the Chief Information Officer (CIO), who is also responsible for IT operations and system implementation. What is the PRIMARY governance concern with this reporting structure?

• A. Security incidents will not be reported to executive management in a timely manner.
• B. The CIO may deprioritize security initiatives that conflict with IT delivery timelines and budgets, creating a conflict of interest.
• C. The CISO may lack sufficient technical knowledge of the systems being secured.
• D. The CIO cannot approve funding for information security initiatives without board approval.

14. An information security manager is preparing a business case to secure funding for a new security initiative. Which approach is MOST likely to gain executive support?

• A. Frame the initiative in terms of business risk reduction and alignment with strategic objectives.
• B. Emphasize the technical sophistication of the proposed controls.
• C. Highlight the number of vulnerabilities the initiative will remediate.
• D. Compare the initiative's cost to typical industry security budgets.

15. An organization is selecting a governance framework (such as COBIT) to structure its information security program. What is the PRIMARY benefit of adopting a recognized framework?

• A. It provides a structured set of processes and controls that can be consistently measured and audited over time.
• B. It eliminates the need for a dedicated information security manager.
• C. It guarantees compliance with all applicable laws and regulations.
• D. It removes the need for board-level oversight of the security program.

16. Senior executives visibly comply with security policies and reference security priorities in company communications. What is this PRIMARILY an example of?

• A. Establishing a security-conscious organizational culture through tone at the top.
• B. Regulatory compliance enforcement.
• C. Risk transfer.
• D. Segregation of duties.

17. A new data protection regulation in the organization's operating jurisdiction introduces mandatory breach notification requirements. What should the information security manager do FIRST?

• A. Immediately notify all customers of the new regulatory requirement.
• B. Purchase additional cyber insurance to cover potential fines.
• C. Wait until a breach occurs before determining notification obligations.
• D. Assess current incident response and governance processes against the new requirement to identify gaps.

18. An information security manager wants to add leading indicators to a governance dashboard that currently only reports incident counts and audit findings. Which metric BEST serves as a leading indicator?

• A. Percentage of critical systems with overdue vulnerability patches.
• B. Total financial loss attributed to past breaches.
• C. Number of audit findings closed in the prior year.
• D. Number of security incidents reported last quarter.

19. A global organization with autonomous regional business units is deciding between a centralized and a federated information security governance model. Which factor MOST strongly favors a federated approach?

• A. Significant differences in regulatory requirements and risk profiles across regions.
• B. A desire to minimize the total number of security staff employed.
• C. A preference for uniform security metrics across all regions.
• D. The need to reduce the overall cost of the security program.

20. A business unit requests a formal exception to a mandatory security policy due to a legacy application that cannot support required controls. What should the information security manager ensure is part of the exception process?

• A. The exception is granted permanently once approved to avoid repeated requests.
• B. The business unit is exempted from all related policies going forward.
• C. The exception includes documented compensating controls, an owner, and a defined expiration or review date.
• D. The exception is kept informal to expedite business operations.

21. An organization is establishing an enterprise architecture function. What is the PRIMARY reason information security governance should have formal input into this function?

• A. To eliminate the need for separate security reviews of new technology projects.
• B. To ensure the enterprise architecture team reports directly to the information security manager.
• C. To reduce the overall headcount required for the architecture function.
• D. To ensure security requirements are embedded into technology decisions from the earliest design stages.

22. A business unit leader overrules a security control recommendation from the information security manager, citing operational impact, and proceeds without documented risk acceptance. What is the MOST appropriate governance response?

• A. Accept the business unit leader's decision without further action since they own the operational risk.
• B. Escalate the unresolved risk to the appropriate governance body, such as a steering committee, for formal risk acceptance.
• C. Implement the control unilaterally despite the business unit's objection.
• D. Document the disagreement informally and take no further action.

23. An information security manager is documenting who is Responsible, Accountable, Consulted, and Informed for a new access review process. What is the PRIMARY value of this exercise?

• A. It clarifies ownership and prevents gaps or overlaps in responsibility for the process.
• B. It replaces the need for a written procedure.
• C. It guarantees that the access review will detect all inappropriate access.
• D. It eliminates the need for periodic audits of the process.

24. Within an information security governance structure, which activity is MOST appropriately reserved for the board of directors rather than delegated to security management?

• A. Configuring firewall rule sets for the perimeter network.
• B. Selecting a specific vulnerability scanning tool.
• C. Assigning incident response duties during a live security event.
• D. Approving the organization's overall risk appetite for information security.

25. A governance committee is reviewing two competing security investments with similar cost but different expected outcomes: one reduces the likelihood of a low-impact, high-frequency risk, and the other reduces the impact of a low-frequency, catastrophic risk. Absent other constraints, which consideration should MOST influence the committee's prioritization?

• A. The investment that is easiest to implement technically.
• B. The organization's documented risk appetite and tolerance for catastrophic versus recurring losses.
• C. The investment that has been requested most recently by staff.
• D. The investment with the shorter vendor contract term.

26. An information security strategy was approved eighteen months ago. The organization has since undergone a merger and entered new markets. What should trigger a formal review of the security strategy?

• A. The passage of exactly twelve months since the last review.
• B. A request from the IT help desk for additional staffing.
• C. The renewal date of the cyber insurance policy.
• D. Material changes to the business, such as a merger or new market entry, that alter the risk and threat landscape.

27. An organization's governance framework requires that critical third-party service providers be subject to periodic security oversight. What is the PRIMARY reason this oversight should be governed at the enterprise level rather than left to individual business units?

• A. It ensures consistent risk criteria and accountability are applied across all vendor relationships regardless of which unit engages them.
• B. It eliminates the need for contractual security clauses.
• C. It reduces the total number of vendors the organization can use.
• D. It transfers all security liability to the third party.

28. A parent company with a conservative risk appetite acquires a subsidiary operating in a jurisdiction where local competitors normally accept far higher levels of cyber risk to remain price-competitive. The subsidiary's leadership resists adopting the parent's security requirements, citing competitive disadvantage. What is the MOST appropriate governance approach for the information security manager to recommend?

• A. Allow the subsidiary to define its own independent risk appetite separate from the parent company.
• B. Mandate immediate, uniform application of all parent company controls regardless of local business impact.
• C. Engage subsidiary and parent governance stakeholders to reconcile risk appetite differences through a documented, risk-based exception and phased-adoption plan.
• D. Defer the decision entirely to the subsidiary's local IT department.

29. An information security manager conducts a maturity assessment and finds the organization's security processes are performed but not consistently documented or repeatable across teams. According to common maturity models, this level is BEST characterized as which stage?

• A. Nonexistent, where no processes are performed at all.
• B. Optimized, where processes are continuously improved using metrics.
• C. Managed and measured, where processes are quantitatively controlled.
• D. Repeatable but informal, where processes are performed and produce results but are not consistently documented or standardized across teams.

30. An organization has passed all required regulatory compliance audits for the past three years but has experienced two significant security incidents caused by control gaps that fell outside the scope of the audited requirements. What does this scenario BEST illustrate?

• A. The compliance audits were performed incorrectly.
• B. Compliance with regulatory requirements is necessary but not sufficient for effective security governance, which must address risk beyond the minimum mandated baseline.
• C. Regulatory requirements are always sufficient to prevent security incidents.
• D. The organization should discontinue compliance audits since they did not prevent incidents.

31. During a risk assessment, an information security manager identifies a legacy application with a known vulnerability, but the business unit refuses to fund remediation because the system will be decommissioned in six months. What is the MOST appropriate next step?

• A. Force decommissioning immediately regardless of business needs
• B. Document the risk, ensure it is formally accepted by an authorized business owner, and implement compensating controls if feasible
• C. Ignore the finding since the system will soon be retired
• D. Escalate directly to external regulators

32. When calculating risk during a quantitative risk assessment, which formula BEST represents the relationship between the key variables typically used?

• A. Risk = Asset Value / Threat Frequency
• B. Risk = Likelihood of a threat exploiting a vulnerability × Impact of that occurrence
• C. Risk = Number of controls implemented
• D. Risk = Cost of the asset minus insurance coverage

33. An organization decides to purchase cyber insurance to address the financial impact of a potential ransomware attack rather than investing further in prevention controls. This is an example of which risk treatment option?

• A. Risk avoidance
• B. Risk transfer
• C. Risk acceptance
• D. Risk mitigation

34. A risk register lists a high-likelihood, high-impact risk with no assigned owner or treatment plan. What is the BEST immediate action for the information security manager?

• A. Delete the entry since it lacks an owner
• B. Assign an accountable risk owner and drive development of a treatment plan with a target date
• C. Wait until the next annual risk assessment cycle
• D. Transfer the risk to the audit department by default

35. Which of the following is the MOST important reason to perform periodic reassessment of previously identified and accepted risks?

• A. To satisfy an arbitrary documentation requirement
• B. Because the threat landscape, asset value, and control environment can change, altering the risk's likelihood or impact over time
• C. To reduce the size of the risk register
• D. Because auditors always require it regardless of business context

36. An organization is evaluating two risk treatment options for a vulnerable legacy system: patching it now for a moderate cost, or replacing it next year at a much higher cost with lower risk reduction in the interim. What should PRIMARILY drive this decision?

• A. The personal preference of the IT manager
• B. A cost-benefit analysis comparing the risk reduction achieved against the cost and timing of each option
• C. Whichever option requires less paperwork
• D. The vendor offering the largest discount

37. A company's risk appetite statement specifies that it will not accept any risk with the potential for regulatory fines exceeding a defined threshold. A newly identified risk exceeds this threshold but is inexpensive to remediate. What should the information security manager recommend?

• A. Accept the risk since remediation cost is a separate consideration
• B. Remediate the risk to bring it within the defined risk appetite
• C. Escalate to the board only if the fine is actually imposed
• D. Transfer all responsibility to the compliance department without further security involvement

38. An organization is evaluating whether to launch a new product feature that would require processing highly sensitive data in a jurisdiction with weak data protection enforcement and no feasible compensating controls. Which risk treatment option is the organization applying if it decides not to launch the feature at all?

• A. Risk mitigation.
• B. Risk acceptance.
• C. Risk avoidance.
• D. Risk transfer.

39. Two independent risk assessments of the same critical system, conducted using different methodologies, produce materially different risk ratings: one rates the system as high risk and the other as moderate risk. Executive leadership is preparing to make a funding decision based on these results. What should the information security manager do FIRST?

• A. Present both ratings to leadership and let them choose which one to believe.
• B. Reconcile the differences by examining the underlying assumptions, scope, and data of each assessment before presenting a unified recommendation.
• C. Discard both assessments and postpone the funding decision indefinitely.
• D. Adopt the higher rating automatically, since it represents the more conservative outcome.

40. An organization defines its risk appetite. What role does it play in security decisions?

• A. It sets the threshold above which risk must be treated rather than accepted, making treatment decisions consistent across the organization
• B. It specifies which security products must be purchased
• C. It determines the security team's headcount
• D. It eliminates the need for individual risk assessments

41. A risk assessment produces an inherent risk rating and a residual risk rating. What is the difference?

• A. Inherent risk is the exposure before considering controls, while residual risk is what remains after existing controls operate as designed
• B. Inherent risk is the risk after treatment and residual is before
• C. Inherent risk applies to external threats and residual to internal ones
• D. The two are the same measure at different points in time

42. Which risk treatment option is being applied when an organization buys cyber insurance?

• A. Transfer or sharing, since the financial consequence moves to another party while the operational risk remains
• B. Mitigation, since the likelihood of an incident falls
• C. Acceptance, since no action was taken
• D. Avoidance, since the risk no longer applies

43. A quantitative risk analysis estimates annualized loss expectancy. What does that figure represent?

• A. The expected loss per year from a risk, combining the loss per occurrence with how often occurrences are expected
• B. The worst-case loss from a single occurrence
• C. The cost of the controls addressing the risk
• D. The insurance premium for the exposure

44. A control costs more per year than the annualized loss expectancy of the risk it addresses. What does this suggest?

• A. The control is not cost-justified on that risk alone, though qualitative factors such as regulatory obligation or reputational harm may still justify it
• B. The control should always be implemented regardless of cost
• C. The risk assessment must be wrong
• D. The risk should be transferred automatically

45. A risk register entry has no named owner. Why is this a significant weakness?

• A. Because without an accountable owner no one is responsible for treating the risk or for the consequences of accepting it, so the entry documents rather than manages it
• B. Because a register cannot be maintained without owners
• C. Because owners are required by all security standards
• D. Because unowned risks are automatically the security manager's

46. A newly identified threat is added to the risk assessment. What should trigger reassessment of existing risks?

• A. Material change in the threat landscape, business processes, technology or regulation, in addition to a periodic cycle
• B. Only the annual review date
• C. Only a security incident
• D. Only a request from internal audit

47. An organization needs to assess risk for a new initiative but lacks reliable historical loss data and cannot easily estimate financial impact in dollar terms. Which risk assessment approach is MOST appropriate?

• A. A purely quantitative approach using annualized loss expectancy calculations.
• B. No formal risk assessment is needed since data is unavailable.
• C. A qualitative approach using risk ratings such as high, medium, and low based on expert judgment.
• D. A purely statistical approach based on industry-wide breach cost averages.

48. An information security manager wants to improve the accuracy of likelihood estimates used in the organization's risk assessments. Which action would MOST directly improve this?

• A. Incorporating current threat intelligence relevant to the organization's industry and technology environment.
• B. Increasing the frequency of employee security awareness training.
• C. Reducing the number of risk categories tracked in the risk register.
• D. Outsourcing the entire risk assessment process to a single vendor.

49. After implementing a set of security controls, the residual risk for a critical system remains above the organization's documented risk appetite. What is the MOST appropriate next step for the information security manager?

• A. Consider the risk treatment complete since controls were implemented.
• B. Identify and implement additional controls, or escalate the residual risk for formal acceptance by an authorized party.
• C. Remove the risk from the risk register since it has already been treated.
• D. Transfer full responsibility for the residual risk to the system's end users.

50. How does a business impact analysis (BIA) relate to an information security risk assessment?

• A. A BIA replaces the need for a risk assessment entirely.
• B. A BIA is only relevant to physical security, not information security.
• C. A BIA identifies the criticality and impact of business processes, informing which assets and risks the risk assessment should prioritize.
• D. A BIA and a risk assessment measure identical variables and produce redundant results.

51. Individually, ten systems each carry a 'low' risk rating, but they share a common underlying vulnerability in a widely used software component. What risk consideration does this scenario illustrate?

• A. Low individual risk ratings can always be safely ignored regardless of scale.
• B. Risk ratings for individual systems should never be compared to one another.
• C. Aggregated risk across multiple assets can be significantly higher than any single asset's individual rating suggests.
• D. Shared vulnerabilities only matter if the systems are physically co-located.

52. An organization is rapidly adopting generative AI tools across business units without a formal risk assessment process for new technology adoption. What is the GREATEST concern with this approach?

• A. Generative AI tools cannot be used for legitimate business purposes.
• B. Employees will become overly reliant on AI for routine tasks.
• C. Sensitive data may be exposed to external AI providers or embedded in outputs without appropriate risk evaluation and controls.
• D. AI tools are inherently more expensive than traditional software.

53. An information security manager facilitates risk assessments and maintains the risk register, but a specific risk in the register concerns a business application owned by a department director. Who should be assigned as the risk owner for that item?

• A. The department director, since they have the authority and accountability to make decisions about that application's risk.
• B. The information security manager, since they maintain the risk register.
• C. The organization's external auditor.
• D. No owner is required as long as the risk is documented.

54. Before onboarding a new cloud service provider that will store regulated customer data, the information security manager is designing a vendor risk assessment approach. Which approach BEST ensures resources are focused appropriately?

• A. Skip formal assessment for vendors offering the lowest contract price.
• B. Tier vendors by the sensitivity of data and level of system access involved, applying deeper scrutiny to higher-tier vendors.
• C. Rely exclusively on the vendor's self-attestation without independent verification for any vendor.
• D. Apply the identical, most rigorous assessment to every vendor regardless of the data or access involved.

55. A project team plans to launch a new customer-facing application in eight weeks and requests that the risk assessment be skipped to meet the deadline, citing that a similar application was assessed two years ago. What is the MOST appropriate response from the information security manager?

• A. Perform a scoped risk assessment for the new application, since the threat landscape and application design may have changed materially since the prior assessment.
• B. Approve skipping the assessment since a similar application was already assessed previously.
• C. Delay the launch indefinitely until a full enterprise-wide risk assessment is completed.
• D. Allow the project team to self-certify that no significant risks exist.

56. An organization has limited resources to perform risk assessments. How should the information security manager PRIMARILY determine the frequency of reassessment for different systems?

• A. Assess every system on the same fixed annual schedule regardless of criticality.
• B. Assess systems in alphabetical order as time permits.
• C. Assess higher-risk and more critical systems more frequently than lower-risk, less critical systems.
• D. Assess only systems that have experienced a prior security incident.

57. An information security manager needs to explain a complex technical vulnerability to a group of business executives with no technical background. What is the MOST effective communication approach?

• A. Present the full technical details, including exploit mechanics, to ensure completeness.
• B. Translate the vulnerability into business terms, describing potential business impact and recommended decisions needed.
• C. Delegate the explanation entirely to a third-party consultant.
• D. Postpone the discussion until the executives acquire technical training.

58. How does risk tolerance differ from risk appetite in the context of an information security risk management program?

• A. Risk appetite is set by IT staff, while risk tolerance is set by external auditors.
• B. Risk tolerance and risk appetite are interchangeable terms with no meaningful distinction.
• C. Risk tolerance applies only to financial risk, while risk appetite applies only to security risk.
• D. Risk appetite is the broad level of risk the organization is willing to pursue, while risk tolerance is the acceptable variation around that level for specific objectives.

59. An information security program is being designed for a mid-sized organization. Which of the following BEST reflects a properly structured security program?

• A. A single antivirus product deployed across all endpoints
• B. A set of coordinated policies, standards, processes, and controls aligned to the security strategy and risk appetite
• C. An annual penetration test with no other ongoing activity
• D. A dedicated incident response team with no supporting policies

60. Which of the following is the PRIMARY purpose of a security awareness training program within an information security program?

• A. To satisfy a checkbox requirement for annual audits
• B. To reduce human-related risk by ensuring employees understand their security responsibilities and recognize common threats
• C. To replace the need for technical controls
• D. To provide a source of revenue through internal training fees

61. An information security manager is selecting metrics to report program performance to the board. Which characteristic is MOST important for these metrics to have?

• A. They should be highly technical to demonstrate the team's expertise
• B. They should be meaningful to a business audience and tied to risk reduction or business impact
• C. They should change every quarter to appear dynamic
• D. They should focus solely on the number of security incidents, regardless of severity

62. A security program includes a control requiring segregation of duties between developers and production system administrators. What is the PRIMARY security benefit of this control?

• A. It reduces the number of employees needed
• B. It reduces the risk of unauthorized or unreviewed changes being introduced into production
• C. It eliminates the need for change management processes
• D. It guarantees compliance with all data privacy regulations

63. An organization is implementing a data classification scheme as part of its security program. What is the MOST important reason for classifying data BEFORE applying protective controls?

• A. Classification is required only for marketing purposes
• B. It ensures that controls are proportionate to the sensitivity and value of the data, avoiding both under- and over-protection
• C. It allows the organization to charge different prices for data storage
• D. It removes the need for encryption on all data

64. A vulnerability management program consistently identifies critical vulnerabilities that remain unpatched for over six months due to competing IT priorities. What is the BEST course of action for the information security manager?

• A. Accept the delays as normal since IT is busy
• B. Work with IT leadership to establish and enforce risk-based remediation SLAs tied to vulnerability severity
• C. Personally patch the systems without IT involvement
• D. Stop scanning for vulnerabilities to avoid generating findings IT cannot address

65. When integrating security requirements into the systems development life cycle (SDLC), at which phase is it MOST cost-effective to identify and address security requirements?

• A. During production after deployment
• B. During the requirements and design phases, before development begins
• C. Only during user acceptance testing
• D. During the post-incident review after a breach

66. An information security manager is developing key performance indicators (KPIs) for the vulnerability management process. Which KPI provides the MOST meaningful insight into program effectiveness?

• A. Total number of vulnerability scans run per month
• B. Average time to remediate critical vulnerabilities compared to defined SLA targets
• C. Number of security tools purchased for scanning
• D. Number of employees on the vulnerability management team

67. Which of the following BEST describes the role of an information security program in supporting business continuity?

• A. The security program is entirely separate from business continuity and should not interact with it
• B. The security program provides controls and processes, such as backup protection and access continuity, that support the organization's ability to maintain and recover critical operations
• C. Business continuity planning is solely the responsibility of facilities management
• D. Security controls should be disabled during a declared disaster to speed up recovery

68. Which of the following is the MOST important consideration when selecting security controls to include in an information security program?

• A. Selecting the newest technology available regardless of fit
• B. Ensuring controls are proportionate to identified risks and aligned with business and regulatory requirements
• C. Selecting controls solely based on vendor marketing claims
• D. Choosing the least expensive controls available

69. A new employee is granted access rights matching only the specific systems and data needed to perform their job duties, rather than broad administrative access. This reflects which security principle?

• A. Least privilege.
• B. Defense in depth.
• C. Non-repudiation.
• D. Separation of environments.

70. A security monitoring tool generates a very high volume of alerts, the vast majority of which analysts determine are false positives after investigation. What is the MOST significant operational risk this creates?

• A. The organization will need to purchase additional monitoring licenses.
• B. Alert fatigue may cause analysts to overlook or delay response to a genuine security event among the noise.
• C. The tool will automatically be disabled by the vendor.
• D. False positives always indicate the tool is fundamentally unsuitable for use.

71. An organization allows the same individual to both request and approve their own changes to a production firewall configuration. What control principle does this violate?

• A. Data classification.
• B. Segregation of duties, since a single individual should not both initiate and approve a sensitive change without independent oversight.
• C. Least privilege.
• D. Defense in depth.

72. A security programme is being built. What should determine the controls selected?

• A. The risk assessment results and the organization's risk appetite, so controls address assessed exposures at proportionate cost
• B. A complete implementation of every control in a chosen framework
• C. The controls the previous security manager preferred
• D. The products the organization already owns licences for

73. How do preventive, detective and corrective controls differ in function?

• A. Corrective controls operate before an event
• B. Preventive controls are technical and detective controls are administrative
• C. Detective controls are always stronger than preventive ones
• D. Preventive controls stop an event occurring, detective controls identify that it occurred, and corrective controls restore the state afterward

74. A security awareness programme is measured by completion rates. What is the limitation of that metric?

• A. It measures participation rather than behaviour change, so it can be high while susceptibility to social engineering remains unchanged
• B. It cannot be collected reliably
• C. It is prohibited by privacy regulation
• D. It applies only to technical staff

75. A security manager wants to reduce the risk of insider data theft. Which combination addresses it most completely?

• A. Least privilege and segregation of duties, monitoring of sensitive data access, and defined joiner-mover-leaver processes
• B. Perimeter firewall rules and intrusion prevention alone
• C. Antivirus deployment across all endpoints
• D. Annual penetration testing of external systems

76. A security manager introduces a control that materially slows a revenue-generating process. What is the appropriate course?

• A. Quantify the risk reduction against the business impact and present the trade-off to the accountable business owner for a decision
• B. Implement the control regardless, since security takes precedence
• C. Abandon the control, since business operations take precedence
• D. Implement the control without informing the business

77. A third-party supplier will process sensitive data. What should the security manager ensure before onboarding?

• A. Due diligence proportionate to the risk, contractual security requirements including breach notification and audit rights, and defined ongoing monitoring
• B. That the supplier holds any security certification, without reviewing its scope
• C. That the supplier is larger than the organization
• D. That procurement has obtained the lowest price

78. A security programme reports a declining number of detected incidents. How should this be interpreted?

• A. Cautiously, since it may indicate improved prevention or degraded detection, and the two require different responses
• B. As unambiguous evidence that security has improved
• C. As evidence that the security budget should be reduced
• D. As evidence that reporting should be discontinued

79. A security manager inherits a programme with no asset inventory. Why is this the priority to address?

• A. Because controls, risk assessment, vulnerability management and incident scoping all depend on knowing what exists and who owns it
• B. Because inventories are required for software licensing compliance
• C. Because it determines the security team's budget
• D. Because it is the easiest deliverable to complete quickly

80. A vulnerability management programme reports thousands of open findings. How should remediation be prioritized?

• A. By risk to the organization, combining severity with exploitability, exposure and the criticality of the affected asset
• B. By the technical severity score alone, highest first
• C. By the age of the finding, oldest first
• D. By the ease of remediation, simplest first

81. During an active ransomware incident, which action should the incident response team take FIRST after detecting the compromise?

• A. Immediately notify all customers before understanding the scope
• B. Contain the affected systems to prevent further spread while preserving evidence
• C. Wait for the next scheduled incident review meeting
• D. Restore from backups without investigating the cause

82. An organization's incident response plan has not been tested in three years. What is the GREATEST risk this poses?

• A. The plan document may use outdated formatting
• B. Response roles, contact information, and procedures may be outdated or ineffective when a real incident occurs
• C. The plan will automatically expire and become legally invalid
• D. Employees will refuse to follow the plan regardless of its content

83. Which of the following BEST defines the purpose of a post-incident review (lessons learned) process?

• A. To assign blame to individuals involved in the incident
• B. To identify root causes and process improvements to reduce the likelihood or impact of similar future incidents
• C. To close the incident ticket as quickly as possible without further analysis
• D. To satisfy a public relations requirement only

84. During incident response, which of the following is MOST important for maintaining the integrity of digital evidence that may later support legal action?

• A. Allowing any staff member to access and copy the evidence as needed
• B. Maintaining a documented chain of custody for all evidence collected
• C. Deleting evidence once the incident is resolved to save storage space
• D. Storing evidence on the affected system itself for convenience

85. An organization experiences a data breach involving customer personal information. Which factor is MOST important in determining the appropriate notification timeline and recipients?

• A. The personal preference of the CEO
• B. Applicable legal and regulatory breach notification requirements based on the data and jurisdictions involved
• C. Whichever timeline is easiest for the marketing department
• D. The size of the IT budget for the current year

86. Which of the following is the PRIMARY benefit of classifying incidents by severity level as part of an incident management process?

• A. It allows the security team to ignore lower severity events entirely
• B. It ensures response resources, escalation, and communication are proportionate to the incident's actual business impact
• C. It reduces the total number of incidents that occur
• D. It eliminates the need for a formal incident response plan

87. An organization wants to reduce the mean time to detect (MTTD) security incidents. Which investment would MOST directly support this goal?

• A. Increasing the frequency of security awareness training sessions only
• B. Implementing centralized log monitoring and correlation through a SIEM with defined use cases
• C. Reducing the number of firewalls in the network
• D. Publishing the incident response plan on the company intranet

88. During a multi-day incident affecting critical systems, business executives are demanding hourly technical updates that are consuming significant analyst time needed for containment. What is the BEST way for the incident manager to address this?

• A. Refuse to provide any updates until the incident is fully resolved
• B. Designate a dedicated communications liaison to provide scheduled executive updates, freeing technical staff to focus on response
• C. Allow executives to directly interrupt analysts whenever they want an update
• D. Shut down the incident response effort until executive demands subside

89. Which of the following BEST illustrates the difference between an information security incident and a disaster recovery (DR) event?

• A. An incident always requires invoking the full DR plan
• B. An incident is a security-relevant event requiring investigation and response, while DR specifically addresses recovery of IT services after significant disruption
• C. There is no meaningful difference between the two terms
• D. DR events are always caused by malicious actors, while incidents are always accidental

90. An information security manager is defining recovery time objectives (RTOs) for critical systems as part of incident and continuity planning. What should PRIMARILY determine the RTO for a given system?

• A. The preference of the system administrator
• B. The maximum tolerable downtime the business can withstand before unacceptable impact occurs
• C. The age of the hardware supporting the system
• D. The number of support tickets filed for the system last year

91. An incident response plan defines phases. What is the purpose of the containment phase?

• A. To notify regulators of the breach
• B. To limit the incident's spread and damage while preserving evidence, before eradication of the cause begins
• C. To identify the root cause of the incident
• D. To restore all systems to normal operation

92. During an incident, a responder wants to reboot a compromised server immediately. What is the concern?

• A. Rebooting would alert the attacker
• B. There is no concern, since disk evidence is sufficient
• C. Volatile evidence in memory and active connections would be lost, potentially destroying the only record of how the compromise occurred and what else it reached
• D. The server would take too long to restart

93. An incident response plan requires a communication protocol. Why is this a distinct element?

• A. Because regulatory notification is never time-bound
• B. Because who says what to regulators, customers, staff and media, and when, must be decided in advance rather than improvised under pressure
• C. Because communication is optional in most incidents
• D. Because technical responders should handle all external communication

94. After an incident is resolved, a post-incident review is held. What is its principal purpose?

• A. To identify what allowed the incident and what impeded the response, producing improvements to controls and to the plan itself
• B. To determine which individual was at fault
• C. To calculate the exact financial loss for accounting
• D. To formally close the incident ticket

95. How do incident response and business continuity planning relate?

• A. They are alternative names for the same plan
• B. Incident response replaces business continuity for cyber events
• C. Business continuity applies only to natural disasters
• D. Incident response addresses the security event itself while business continuity maintains critical operations, and a severe incident invokes both

96. An organization measures mean time to detect and mean time to respond. What do these indicate?

• A. The number of incidents occurring per month
• B. How long an adversary operates undetected and how quickly the organization acts once aware, both of which bound the damage an incident causes
• C. The cost of the security operations function
• D. The technical severity of each incident

97. An incident may involve criminal activity and potential litigation. What does this require of evidence handling?

• A. A documented chain of custody and forensically sound acquisition, so the evidence remains admissible and its integrity demonstrable
• B. Immediate deletion of affected data to prevent further exposure
• C. Analysis performed only on the original media
• D. Restricting all documentation to verbal briefings

98. A security manager is asked whether an incident constitutes a reportable breach. What primarily determines this?

• A. The applicable legal and regulatory definitions against the facts established, including the data involved and the jurisdictions of affected individuals
• B. The organization's internal severity rating alone
• C. Whether the media has reported the incident
• D. Whether the attacker has been identified

99. A tabletop exercise is run for the incident response team. What does it validate that a technical drill does not?

• A. Decision-making, escalation paths and coordination between technical, legal, communications and executive participants under scenario pressure
• B. The throughput of the detection tooling
• C. The patch level of production systems
• D. The accuracy of the asset inventory

100. What criteria should PRIMARILY determine when an information security incident can formally be closed?

• A. When exactly 30 days have passed since detection, regardless of remediation status.
• B. When the incident response team simply runs out of available time to continue working it.
• C. When the affected business unit stops asking for status updates.
• D. When containment, eradication, and recovery actions are verified complete, the root cause is addressed, and any required documentation and notifications are finished.