CISM Practice Test.

1. A candidate wants to know how the CISM exam is delivered. Which of the following correctly describes the available delivery modes?

• A. Only in-person at a test center, with no remote option
• B. Candidates may choose either an in-person test center or an online remote-proctored option
• C. Only through a mobile app with no proctoring
• D. Exclusively through employer-sponsored on-site testing

2. Which of the following BEST demonstrates that an organization's information security strategy is aligned with business objectives?

• A. The security budget increases every fiscal year
• B. Security initiatives are prioritized and funded based on their support of documented business goals
• C. The security team reports directly to the CEO
• D. All security policies have been reviewed within the past 12 months

3. An information security steering committee is being formed. Which composition BEST supports effective governance oversight?

• A. Only members of the IT department, since they understand the technical risks
• B. Senior representatives from business units, IT, legal, HR, and risk management
• C. External auditors exclusively, to ensure independence
• D. The information security manager alone, to avoid conflicting priorities

4. An organization's information security policy has not been updated in five years, though the business has since adopted cloud computing and remote work extensively. What is the GREATEST risk of this situation?

• A. Employees may not have read the policy
• B. The policy no longer reflects the current risk environment, leaving gaps in governance and control coverage
• C. The policy document is a different font than newer documents
• D. Legal counsel was not involved in the original drafting

5. During a risk assessment, an information security manager identifies a legacy application with a known vulnerability, but the business unit refuses to fund remediation because the system will be decommissioned in six months. What is the MOST appropriate next step?

• A. Force decommissioning immediately regardless of business needs
• B. Document the risk, ensure it is formally accepted by an authorized business owner, and implement compensating controls if feasible
• C. Ignore the finding since the system will soon be retired
• D. Escalate directly to external regulators

6. When calculating risk during a quantitative risk assessment, which formula BEST represents the relationship between the key variables typically used?

• A. Risk = Asset Value / Threat Frequency
• B. Risk = Likelihood of a threat exploiting a vulnerability × Impact of that occurrence
• C. Risk = Number of controls implemented
• D. Risk = Cost of the asset minus insurance coverage

7. An organization decides to purchase cyber insurance to address the financial impact of a potential ransomware attack rather than investing further in prevention controls. This is an example of which risk treatment option?

• A. Risk avoidance
• B. Risk transfer
• C. Risk acceptance
• D. Risk mitigation

8. A risk register lists a high-likelihood, high-impact risk with no assigned owner or treatment plan. What is the BEST immediate action for the information security manager?

• A. Delete the entry since it lacks an owner
• B. Assign an accountable risk owner and drive development of a treatment plan with a target date
• C. Wait until the next annual risk assessment cycle
• D. Transfer the risk to the audit department by default

9. Which of the following is the MOST important reason to perform periodic reassessment of previously identified and accepted risks?

• A. To satisfy an arbitrary documentation requirement
• B. Because the threat landscape, asset value, and control environment can change, altering the risk's likelihood or impact over time
• C. To reduce the size of the risk register
• D. Because auditors always require it regardless of business context

10. An organization is evaluating two risk treatment options for a vulnerable legacy system: patching it now for a moderate cost, or replacing it next year at a much higher cost with lower risk reduction in the interim. What should PRIMARILY drive this decision?

• A. The personal preference of the IT manager
• B. A cost-benefit analysis comparing the risk reduction achieved against the cost and timing of each option
• C. Whichever option requires less paperwork
• D. The vendor offering the largest discount

11. A company's risk appetite statement specifies that it will not accept any risk with the potential for regulatory fines exceeding a defined threshold. A newly identified risk exceeds this threshold but is inexpensive to remediate. What should the information security manager recommend?

• A. Accept the risk since remediation cost is a separate consideration
• B. Remediate the risk to bring it within the defined risk appetite
• C. Escalate to the board only if the fine is actually imposed
• D. Transfer all responsibility to the compliance department without further security involvement

12. An information security program is being designed for a mid-sized organization. Which of the following BEST reflects a properly structured security program?

• A. A single antivirus product deployed across all endpoints
• B. A set of coordinated policies, standards, processes, and controls aligned to the security strategy and risk appetite
• C. An annual penetration test with no other ongoing activity
• D. A dedicated incident response team with no supporting policies

13. Which of the following is the PRIMARY purpose of a security awareness training program within an information security program?

• A. To satisfy a checkbox requirement for annual audits
• B. To reduce human-related risk by ensuring employees understand their security responsibilities and recognize common threats
• C. To replace the need for technical controls
• D. To provide a source of revenue through internal training fees

14. An information security manager is selecting metrics to report program performance to the board. Which characteristic is MOST important for these metrics to have?

• A. They should be highly technical to demonstrate the team's expertise
• B. They should be meaningful to a business audience and tied to risk reduction or business impact
• C. They should change every quarter to appear dynamic
• D. They should focus solely on the number of security incidents, regardless of severity

15. A security program includes a control requiring segregation of duties between developers and production system administrators. What is the PRIMARY security benefit of this control?

• A. It reduces the number of employees needed
• B. It reduces the risk of unauthorized or unreviewed changes being introduced into production
• C. It eliminates the need for change management processes
• D. It guarantees compliance with all data privacy regulations

16. An organization is implementing a data classification scheme as part of its security program. What is the MOST important reason for classifying data BEFORE applying protective controls?

• A. Classification is required only for marketing purposes
• B. It ensures that controls are proportionate to the sensitivity and value of the data, avoiding both under- and over-protection
• C. It allows the organization to charge different prices for data storage
• D. It removes the need for encryption on all data

17. A vulnerability management program consistently identifies critical vulnerabilities that remain unpatched for over six months due to competing IT priorities. What is the BEST course of action for the information security manager?

• A. Accept the delays as normal since IT is busy
• B. Work with IT leadership to establish and enforce risk-based remediation SLAs tied to vulnerability severity
• C. Personally patch the systems without IT involvement
• D. Stop scanning for vulnerabilities to avoid generating findings IT cannot address

18. When integrating security requirements into the systems development life cycle (SDLC), at which phase is it MOST cost-effective to identify and address security requirements?

• A. During production after deployment
• B. During the requirements and design phases, before development begins
• C. Only during user acceptance testing
• D. During the post-incident review after a breach

19. An information security manager is developing key performance indicators (KPIs) for the vulnerability management process. Which KPI provides the MOST meaningful insight into program effectiveness?

• A. Total number of vulnerability scans run per month
• B. Average time to remediate critical vulnerabilities compared to defined SLA targets
• C. Number of security tools purchased for scanning
• D. Number of employees on the vulnerability management team

20. Which of the following BEST describes the role of an information security program in supporting business continuity?

• A. The security program is entirely separate from business continuity and should not interact with it
• B. The security program provides controls and processes, such as backup protection and access continuity, that support the organization's ability to maintain and recover critical operations
• C. Business continuity planning is solely the responsibility of facilities management
• D. Security controls should be disabled during a declared disaster to speed up recovery

21. Which of the following is the MOST important consideration when selecting security controls to include in an information security program?

• A. Selecting the newest technology available regardless of fit
• B. Ensuring controls are proportionate to identified risks and aligned with business and regulatory requirements
• C. Selecting controls solely based on vendor marketing claims
• D. Choosing the least expensive controls available

22. During an active ransomware incident, which action should the incident response team take FIRST after detecting the compromise?

• A. Immediately notify all customers before understanding the scope
• B. Contain the affected systems to prevent further spread while preserving evidence
• C. Wait for the next scheduled incident review meeting
• D. Restore from backups without investigating the cause

23. An organization's incident response plan has not been tested in three years. What is the GREATEST risk this poses?

• A. The plan document may use outdated formatting
• B. Response roles, contact information, and procedures may be outdated or ineffective when a real incident occurs
• C. The plan will automatically expire and become legally invalid
• D. Employees will refuse to follow the plan regardless of its content

24. Which of the following BEST defines the purpose of a post-incident review (lessons learned) process?

• A. To assign blame to individuals involved in the incident
• B. To identify root causes and process improvements to reduce the likelihood or impact of similar future incidents
• C. To close the incident ticket as quickly as possible without further analysis
• D. To satisfy a public relations requirement only

25. During incident response, which of the following is MOST important for maintaining the integrity of digital evidence that may later support legal action?

• A. Allowing any staff member to access and copy the evidence as needed
• B. Maintaining a documented chain of custody for all evidence collected
• C. Deleting evidence once the incident is resolved to save storage space
• D. Storing evidence on the affected system itself for convenience

26. An organization experiences a data breach involving customer personal information. Which factor is MOST important in determining the appropriate notification timeline and recipients?

• A. The personal preference of the CEO
• B. Applicable legal and regulatory breach notification requirements based on the data and jurisdictions involved
• C. Whichever timeline is easiest for the marketing department
• D. The size of the IT budget for the current year

27. Which of the following is the PRIMARY benefit of classifying incidents by severity level as part of an incident management process?

• A. It allows the security team to ignore lower severity events entirely
• B. It ensures response resources, escalation, and communication are proportionate to the incident's actual business impact
• C. It reduces the total number of incidents that occur
• D. It eliminates the need for a formal incident response plan

28. An organization wants to reduce the mean time to detect (MTTD) security incidents. Which investment would MOST directly support this goal?

• A. Increasing the frequency of security awareness training sessions only
• B. Implementing centralized log monitoring and correlation through a SIEM with defined use cases
• C. Reducing the number of firewalls in the network
• D. Publishing the incident response plan on the company intranet

29. During a multi-day incident affecting critical systems, business executives are demanding hourly technical updates that are consuming significant analyst time needed for containment. What is the BEST way for the incident manager to address this?

• A. Refuse to provide any updates until the incident is fully resolved
• B. Designate a dedicated communications liaison to provide scheduled executive updates, freeing technical staff to focus on response
• C. Allow executives to directly interrupt analysts whenever they want an update
• D. Shut down the incident response effort until executive demands subside

30. Which of the following BEST illustrates the difference between an information security incident and a disaster recovery (DR) event?

• A. An incident always requires invoking the full DR plan
• B. An incident is a security-relevant event requiring investigation and response, while DR specifically addresses recovery of IT services after significant disruption
• C. There is no meaningful difference between the two terms
• D. DR events are always caused by malicious actors, while incidents are always accidental

31. An information security manager is defining recovery time objectives (RTOs) for critical systems as part of incident and continuity planning. What should PRIMARILY determine the RTO for a given system?

• A. The preference of the system administrator
• B. The maximum tolerable downtime the business can withstand before unacceptable impact occurs
• C. The age of the hardware supporting the system
• D. The number of support tickets filed for the system last year

32. An organization is evaluating whether to launch a new product feature that would require processing highly sensitive data in a jurisdiction with weak data protection enforcement and no feasible compensating controls. Which risk treatment option is the organization applying if it decides not to launch the feature at all?

• A. Risk mitigation.
• B. Risk acceptance.
• C. Risk avoidance.
• D. Risk transfer.

33. Two independent risk assessments of the same critical system, conducted using different methodologies, produce materially different risk ratings: one rates the system as high risk and the other as moderate risk. Executive leadership is preparing to make a funding decision based on these results. What should the information security manager do FIRST?

• A. Present both ratings to leadership and let them choose which one to believe.
• B. Reconcile the differences by examining the underlying assumptions, scope, and data of each assessment before presenting a unified recommendation.
• C. Discard both assessments and postpone the funding decision indefinitely.
• D. Adopt the higher rating automatically, since it represents the more conservative outcome.

34. A new employee is granted access rights matching only the specific systems and data needed to perform their job duties, rather than broad administrative access. This reflects which security principle?

• A. Least privilege.
• B. Defense in depth.
• C. Non-repudiation.
• D. Separation of environments.

35. A security monitoring tool generates a very high volume of alerts, the vast majority of which analysts determine are false positives after investigation. What is the MOST significant operational risk this creates?

• A. The organization will need to purchase additional monitoring licenses.
• B. Alert fatigue may cause analysts to overlook or delay response to a genuine security event among the noise.
• C. The tool will automatically be disabled by the vendor.
• D. False positives always indicate the tool is fundamentally unsuitable for use.

36. A candidate is planning their CISM certification timeline after passing the exam. Which statement about the certification application process is accurate?

• A. Candidates must apply for certification within 5 years of passing the exam
• B. Candidates must apply for certification within 30 days of passing the exam
• C. There is no time limit to apply for certification after passing
• D. Certification is granted automatically the moment the exam is passed

37. An organization allows the same individual to both request and approve their own changes to a production firewall configuration. What control principle does this violate?

• A. Data classification.
• B. Segregation of duties, since a single individual should not both initiate and approve a sensitive change without independent oversight.
• C. Least privilege.
• D. Defense in depth.

38. An information security strategy is being developed. What should it be aligned to first?

• A. The organization's business objectives and strategy, so security investment supports what the organization is trying to achieve
• B. The security manager's professional certification syllabus
• C. The controls implemented by industry peers
• D. The latest available security technologies

39. Who should own an information security policy and approve it?

• A. Senior management or the board, since a policy sets organization-wide direction that only that level can mandate
• B. The security operations team that will enforce it
• C. The internal audit function
• D. The external security consultant who drafted it

40. How do a policy, a standard, a procedure and a guideline differ in a security documentation hierarchy?

• A. A policy states mandatory direction, a standard specifies mandatory requirements meeting it, a procedure gives step-by-step instructions, and a guideline offers recommended but optional practice
• B. All four are mandatory and differ only in length
• C. A guideline is mandatory and a standard is optional
• D. A procedure sets direction and a policy implements it

41. A security manager must report programme status to the board. What reporting approach is most effective?

• A. Expressing status in terms of risk to business objectives, trends and decisions required, rather than technical control counts
• B. Providing the raw output of vulnerability scanning tools
• C. Reporting the number of blocked firewall connections
• D. Listing every security incident with full technical detail

42. What does information security governance establish that a security programme alone does not?

• A. The accountability structure, decision rights and oversight that direct the programme and hold it to account
• B. The technical configuration of security tooling
• C. The daily operational response to security alerts
• D. The vendor selection for security products

43. An organization defines its risk appetite. What role does it play in security decisions?

• A. It sets the threshold above which risk must be treated rather than accepted, making treatment decisions consistent across the organization
• B. It specifies which security products must be purchased
• C. It determines the security team's headcount
• D. It eliminates the need for individual risk assessments

44. A risk assessment produces an inherent risk rating and a residual risk rating. What is the difference?

• A. Inherent risk is the exposure before considering controls, while residual risk is what remains after existing controls operate as designed
• B. Inherent risk is the risk after treatment and residual is before
• C. Inherent risk applies to external threats and residual to internal ones
• D. The two are the same measure at different points in time

45. Which risk treatment option is being applied when an organization buys cyber insurance?

• A. Transfer or sharing, since the financial consequence moves to another party while the operational risk remains
• B. Mitigation, since the likelihood of an incident falls
• C. Acceptance, since no action was taken
• D. Avoidance, since the risk no longer applies

46. A quantitative risk analysis estimates annualized loss expectancy. What does that figure represent?

• A. The expected loss per year from a risk, combining the loss per occurrence with how often occurrences are expected
• B. The worst-case loss from a single occurrence
• C. The cost of the controls addressing the risk
• D. The insurance premium for the exposure

47. A control costs more per year than the annualized loss expectancy of the risk it addresses. What does this suggest?

• A. The control is not cost-justified on that risk alone, though qualitative factors such as regulatory obligation or reputational harm may still justify it
• B. The control should always be implemented regardless of cost
• C. The risk assessment must be wrong
• D. The risk should be transferred automatically

48. A risk register entry has no named owner. Why is this a significant weakness?

• A. Because without an accountable owner no one is responsible for treating the risk or for the consequences of accepting it, so the entry documents rather than manages it
• B. Because a register cannot be maintained without owners
• C. Because owners are required by all security standards
• D. Because unowned risks are automatically the security manager's

49. A newly identified threat is added to the risk assessment. What should trigger reassessment of existing risks?

• A. Material change in the threat landscape, business processes, technology or regulation, in addition to a periodic cycle
• B. Only the annual review date
• C. Only a security incident
• D. Only a request from internal audit

50. A security programme is being built. What should determine the controls selected?

• A. The risk assessment results and the organization's risk appetite, so controls address assessed exposures at proportionate cost
• B. A complete implementation of every control in a chosen framework
• C. The controls the previous security manager preferred
• D. The products the organization already owns licences for

51. How do preventive, detective and corrective controls differ in function?

• A. Corrective controls operate before an event
• B. Preventive controls are technical and detective controls are administrative
• C. Detective controls are always stronger than preventive ones
• D. Preventive controls stop an event occurring, detective controls identify that it occurred, and corrective controls restore the state afterward

52. A security awareness programme is measured by completion rates. What is the limitation of that metric?

• A. It measures participation rather than behaviour change, so it can be high while susceptibility to social engineering remains unchanged
• B. It cannot be collected reliably
• C. It is prohibited by privacy regulation
• D. It applies only to technical staff

53. A security manager wants to reduce the risk of insider data theft. Which combination addresses it most completely?

• A. Least privilege and segregation of duties, monitoring of sensitive data access, and defined joiner-mover-leaver processes
• B. Perimeter firewall rules and intrusion prevention alone
• C. Antivirus deployment across all endpoints
• D. Annual penetration testing of external systems

54. A security manager introduces a control that materially slows a revenue-generating process. What is the appropriate course?

• A. Quantify the risk reduction against the business impact and present the trade-off to the accountable business owner for a decision
• B. Implement the control regardless, since security takes precedence
• C. Abandon the control, since business operations take precedence
• D. Implement the control without informing the business

55. A third-party supplier will process sensitive data. What should the security manager ensure before onboarding?

• A. Due diligence proportionate to the risk, contractual security requirements including breach notification and audit rights, and defined ongoing monitoring
• B. That the supplier holds any security certification, without reviewing its scope
• C. That the supplier is larger than the organization
• D. That procurement has obtained the lowest price

56. A security programme reports a declining number of detected incidents. How should this be interpreted?

• A. Cautiously, since it may indicate improved prevention or degraded detection, and the two require different responses
• B. As unambiguous evidence that security has improved
• C. As evidence that the security budget should be reduced
• D. As evidence that reporting should be discontinued

57. An incident response plan defines phases. What is the purpose of the containment phase?

• A. To notify regulators of the breach
• B. To limit the incident's spread and damage while preserving evidence, before eradication of the cause begins
• C. To identify the root cause of the incident
• D. To restore all systems to normal operation

58. During an incident, a responder wants to reboot a compromised server immediately. What is the concern?

• A. Rebooting would alert the attacker
• B. There is no concern, since disk evidence is sufficient
• C. Volatile evidence in memory and active connections would be lost, potentially destroying the only record of how the compromise occurred and what else it reached
• D. The server would take too long to restart

59. An incident response plan requires a communication protocol. Why is this a distinct element?

• A. Because regulatory notification is never time-bound
• B. Because who says what to regulators, customers, staff and media, and when, must be decided in advance rather than improvised under pressure
• C. Because communication is optional in most incidents
• D. Because technical responders should handle all external communication

60. After an incident is resolved, a post-incident review is held. What is its principal purpose?

• A. To identify what allowed the incident and what impeded the response, producing improvements to controls and to the plan itself
• B. To determine which individual was at fault
• C. To calculate the exact financial loss for accounting
• D. To formally close the incident ticket

61. How do incident response and business continuity planning relate?

• A. They are alternative names for the same plan
• B. Incident response replaces business continuity for cyber events
• C. Business continuity applies only to natural disasters
• D. Incident response addresses the security event itself while business continuity maintains critical operations, and a severe incident invokes both

62. An organization measures mean time to detect and mean time to respond. What do these indicate?

• A. The number of incidents occurring per month
• B. How long an adversary operates undetected and how quickly the organization acts once aware, both of which bound the damage an incident causes
• C. The cost of the security operations function
• D. The technical severity of each incident

63. An incident may involve criminal activity and potential litigation. What does this require of evidence handling?

• A. A documented chain of custody and forensically sound acquisition, so the evidence remains admissible and its integrity demonstrable
• B. Immediate deletion of affected data to prevent further exposure
• C. Analysis performed only on the original media
• D. Restricting all documentation to verbal briefings

64. A security manager is asked whether an incident constitutes a reportable breach. What primarily determines this?

• A. The applicable legal and regulatory definitions against the facts established, including the data involved and the jurisdictions of affected individuals
• B. The organization's internal severity rating alone
• C. Whether the media has reported the incident
• D. Whether the attacker has been identified

65. A tabletop exercise is run for the incident response team. What does it validate that a technical drill does not?

• A. Decision-making, escalation paths and coordination between technical, legal, communications and executive participants under scenario pressure
• B. The throughput of the detection tooling
• C. The patch level of production systems
• D. The accuracy of the asset inventory

66. A security manager inherits a programme with no asset inventory. Why is this the priority to address?

• A. Because controls, risk assessment, vulnerability management and incident scoping all depend on knowing what exists and who owns it
• B. Because inventories are required for software licensing compliance
• C. Because it determines the security team's budget
• D. Because it is the easiest deliverable to complete quickly

67. A vulnerability management programme reports thousands of open findings. How should remediation be prioritized?

• A. By risk to the organization, combining severity with exploitability, exposure and the criticality of the affected asset
• B. By the technical severity score alone, highest first
• C. By the age of the finding, oldest first
• D. By the ease of remediation, simplest first

68. An organization must comply with multiple overlapping regulatory regimes. What approach reduces duplicated effort?

• A. A common control framework mapped to each regime's requirements, so one control implementation satisfies several obligations and is tested once
• B. A separate security programme for each regime
• C. Complying with only the strictest regime and ignoring the others
• D. Delegating all compliance to the internal audit function

69. A security manager proposes a maturity model assessment of the programme. What does it provide that a control gap analysis does not?

• A. A view of how consistently and repeatably processes operate, distinguishing a control performed ad hoc from one that is managed and measured
• B. A list of missing controls
• C. The financial cost of remediation
• D. The technical configuration of each system

70. What criteria should PRIMARILY determine when an information security incident can formally be closed?

• A. When exactly 30 days have passed since detection, regardless of remediation status.
• B. When the incident response team simply runs out of available time to continue working it.
• C. When the affected business unit stops asking for status updates.
• D. When containment, eradication, and recovery actions are verified complete, the root cause is addressed, and any required documentation and notifications are finished.

71. The CISO in an organization reports administratively to the Chief Information Officer (CIO), who is also responsible for IT operations and system implementation. What is the PRIMARY governance concern with this reporting structure?

• A. Security incidents will not be reported to executive management in a timely manner.
• B. The CIO may deprioritize security initiatives that conflict with IT delivery timelines and budgets, creating a conflict of interest.
• C. The CISO may lack sufficient technical knowledge of the systems being secured.
• D. The CIO cannot approve funding for information security initiatives without board approval.

72. An information security manager is preparing a business case to secure funding for a new security initiative. Which approach is MOST likely to gain executive support?

• A. Frame the initiative in terms of business risk reduction and alignment with strategic objectives.
• B. Emphasize the technical sophistication of the proposed controls.
• C. Highlight the number of vulnerabilities the initiative will remediate.
• D. Compare the initiative's cost to typical industry security budgets.

73. An organization is selecting a governance framework (such as COBIT) to structure its information security program. What is the PRIMARY benefit of adopting a recognized framework?

• A. It provides a structured set of processes and controls that can be consistently measured and audited over time.
• B. It eliminates the need for a dedicated information security manager.
• C. It guarantees compliance with all applicable laws and regulations.
• D. It removes the need for board-level oversight of the security program.

74. Senior executives visibly comply with security policies and reference security priorities in company communications. What is this PRIMARILY an example of?

• A. Establishing a security-conscious organizational culture through tone at the top.
• B. Regulatory compliance enforcement.
• C. Risk transfer.
• D. Segregation of duties.

75. A new data protection regulation in the organization's operating jurisdiction introduces mandatory breach notification requirements. What should the information security manager do FIRST?

• A. Immediately notify all customers of the new regulatory requirement.
• B. Purchase additional cyber insurance to cover potential fines.
• C. Wait until a breach occurs before determining notification obligations.
• D. Assess current incident response and governance processes against the new requirement to identify gaps.

76. An information security manager wants to add leading indicators to a governance dashboard that currently only reports incident counts and audit findings. Which metric BEST serves as a leading indicator?

• A. Percentage of critical systems with overdue vulnerability patches.
• B. Total financial loss attributed to past breaches.
• C. Number of audit findings closed in the prior year.
• D. Number of security incidents reported last quarter.

77. A global organization with autonomous regional business units is deciding between a centralized and a federated information security governance model. Which factor MOST strongly favors a federated approach?

• A. Significant differences in regulatory requirements and risk profiles across regions.
• B. A desire to minimize the total number of security staff employed.
• C. A preference for uniform security metrics across all regions.
• D. The need to reduce the overall cost of the security program.

78. A business unit requests a formal exception to a mandatory security policy due to a legacy application that cannot support required controls. What should the information security manager ensure is part of the exception process?

• A. The exception is granted permanently once approved to avoid repeated requests.
• B. The business unit is exempted from all related policies going forward.
• C. The exception includes documented compensating controls, an owner, and a defined expiration or review date.
• D. The exception is kept informal to expedite business operations.

79. An organization is establishing an enterprise architecture function. What is the PRIMARY reason information security governance should have formal input into this function?

• A. To eliminate the need for separate security reviews of new technology projects.
• B. To ensure the enterprise architecture team reports directly to the information security manager.
• C. To reduce the overall headcount required for the architecture function.
• D. To ensure security requirements are embedded into technology decisions from the earliest design stages.

80. A business unit leader overrules a security control recommendation from the information security manager, citing operational impact, and proceeds without documented risk acceptance. What is the MOST appropriate governance response?

• A. Accept the business unit leader's decision without further action since they own the operational risk.
• B. Escalate the unresolved risk to the appropriate governance body, such as a steering committee, for formal risk acceptance.
• C. Implement the control unilaterally despite the business unit's objection.
• D. Document the disagreement informally and take no further action.

81. An information security manager is documenting who is Responsible, Accountable, Consulted, and Informed for a new access review process. What is the PRIMARY value of this exercise?

• A. It clarifies ownership and prevents gaps or overlaps in responsibility for the process.
• B. It replaces the need for a written procedure.
• C. It guarantees that the access review will detect all inappropriate access.
• D. It eliminates the need for periodic audits of the process.

82. Within an information security governance structure, which activity is MOST appropriately reserved for the board of directors rather than delegated to security management?

• A. Configuring firewall rule sets for the perimeter network.
• B. Selecting a specific vulnerability scanning tool.
• C. Assigning incident response duties during a live security event.
• D. Approving the organization's overall risk appetite for information security.

83. A governance committee is reviewing two competing security investments with similar cost but different expected outcomes: one reduces the likelihood of a low-impact, high-frequency risk, and the other reduces the impact of a low-frequency, catastrophic risk. Absent other constraints, which consideration should MOST influence the committee's prioritization?

• A. The investment that is easiest to implement technically.
• B. The organization's documented risk appetite and tolerance for catastrophic versus recurring losses.
• C. The investment that has been requested most recently by staff.
• D. The investment with the shorter vendor contract term.

84. An information security strategy was approved eighteen months ago. The organization has since undergone a merger and entered new markets. What should trigger a formal review of the security strategy?

• A. The passage of exactly twelve months since the last review.
• B. A request from the IT help desk for additional staffing.
• C. The renewal date of the cyber insurance policy.
• D. Material changes to the business, such as a merger or new market entry, that alter the risk and threat landscape.

85. An organization's governance framework requires that critical third-party service providers be subject to periodic security oversight. What is the PRIMARY reason this oversight should be governed at the enterprise level rather than left to individual business units?

• A. It ensures consistent risk criteria and accountability are applied across all vendor relationships regardless of which unit engages them.
• B. It eliminates the need for contractual security clauses.
• C. It reduces the total number of vendors the organization can use.
• D. It transfers all security liability to the third party.

86. A parent company with a conservative risk appetite acquires a subsidiary operating in a jurisdiction where local competitors normally accept far higher levels of cyber risk to remain price-competitive. The subsidiary's leadership resists adopting the parent's security requirements, citing competitive disadvantage. What is the MOST appropriate governance approach for the information security manager to recommend?

• A. Allow the subsidiary to define its own independent risk appetite separate from the parent company.
• B. Mandate immediate, uniform application of all parent company controls regardless of local business impact.
• C. Engage subsidiary and parent governance stakeholders to reconcile risk appetite differences through a documented, risk-based exception and phased-adoption plan.
• D. Defer the decision entirely to the subsidiary's local IT department.

87. An information security manager conducts a maturity assessment and finds the organization's security processes are performed but not consistently documented or repeatable across teams. According to common maturity models, this level is BEST characterized as which stage?

• A. Nonexistent, where no processes are performed at all.
• B. Optimized, where processes are continuously improved using metrics.
• C. Managed and measured, where processes are quantitatively controlled.
• D. Repeatable but informal, where processes are performed and produce results but are not consistently documented or standardized across teams.

88. An organization has passed all required regulatory compliance audits for the past three years but has experienced two significant security incidents caused by control gaps that fell outside the scope of the audited requirements. What does this scenario BEST illustrate?

• A. The compliance audits were performed incorrectly.
• B. Compliance with regulatory requirements is necessary but not sufficient for effective security governance, which must address risk beyond the minimum mandated baseline.
• C. Regulatory requirements are always sufficient to prevent security incidents.
• D. The organization should discontinue compliance audits since they did not prevent incidents.

89. An organization needs to assess risk for a new initiative but lacks reliable historical loss data and cannot easily estimate financial impact in dollar terms. Which risk assessment approach is MOST appropriate?

• A. A purely quantitative approach using annualized loss expectancy calculations.
• B. No formal risk assessment is needed since data is unavailable.
• C. A qualitative approach using risk ratings such as high, medium, and low based on expert judgment.
• D. A purely statistical approach based on industry-wide breach cost averages.

90. An information security manager wants to improve the accuracy of likelihood estimates used in the organization's risk assessments. Which action would MOST directly improve this?

• A. Incorporating current threat intelligence relevant to the organization's industry and technology environment.
• B. Increasing the frequency of employee security awareness training.
• C. Reducing the number of risk categories tracked in the risk register.
• D. Outsourcing the entire risk assessment process to a single vendor.

91. After implementing a set of security controls, the residual risk for a critical system remains above the organization's documented risk appetite. What is the MOST appropriate next step for the information security manager?

• A. Consider the risk treatment complete since controls were implemented.
• B. Identify and implement additional controls, or escalate the residual risk for formal acceptance by an authorized party.
• C. Remove the risk from the risk register since it has already been treated.
• D. Transfer full responsibility for the residual risk to the system's end users.

92. How does a business impact analysis (BIA) relate to an information security risk assessment?

• A. A BIA replaces the need for a risk assessment entirely.
• B. A BIA is only relevant to physical security, not information security.
• C. A BIA identifies the criticality and impact of business processes, informing which assets and risks the risk assessment should prioritize.
• D. A BIA and a risk assessment measure identical variables and produce redundant results.

93. Individually, ten systems each carry a 'low' risk rating, but they share a common underlying vulnerability in a widely used software component. What risk consideration does this scenario illustrate?

• A. Low individual risk ratings can always be safely ignored regardless of scale.
• B. Risk ratings for individual systems should never be compared to one another.
• C. Aggregated risk across multiple assets can be significantly higher than any single asset's individual rating suggests.
• D. Shared vulnerabilities only matter if the systems are physically co-located.

94. An organization is rapidly adopting generative AI tools across business units without a formal risk assessment process for new technology adoption. What is the GREATEST concern with this approach?

• A. Generative AI tools cannot be used for legitimate business purposes.
• B. Employees will become overly reliant on AI for routine tasks.
• C. Sensitive data may be exposed to external AI providers or embedded in outputs without appropriate risk evaluation and controls.
• D. AI tools are inherently more expensive than traditional software.

95. An information security manager facilitates risk assessments and maintains the risk register, but a specific risk in the register concerns a business application owned by a department director. Who should be assigned as the risk owner for that item?

• A. The department director, since they have the authority and accountability to make decisions about that application's risk.
• B. The information security manager, since they maintain the risk register.
• C. The organization's external auditor.
• D. No owner is required as long as the risk is documented.

96. Before onboarding a new cloud service provider that will store regulated customer data, the information security manager is designing a vendor risk assessment approach. Which approach BEST ensures resources are focused appropriately?

• A. Skip formal assessment for vendors offering the lowest contract price.
• B. Tier vendors by the sensitivity of data and level of system access involved, applying deeper scrutiny to higher-tier vendors.
• C. Rely exclusively on the vendor's self-attestation without independent verification for any vendor.
• D. Apply the identical, most rigorous assessment to every vendor regardless of the data or access involved.

97. A project team plans to launch a new customer-facing application in eight weeks and requests that the risk assessment be skipped to meet the deadline, citing that a similar application was assessed two years ago. What is the MOST appropriate response from the information security manager?

• A. Perform a scoped risk assessment for the new application, since the threat landscape and application design may have changed materially since the prior assessment.
• B. Approve skipping the assessment since a similar application was already assessed previously.
• C. Delay the launch indefinitely until a full enterprise-wide risk assessment is completed.
• D. Allow the project team to self-certify that no significant risks exist.

98. An organization has limited resources to perform risk assessments. How should the information security manager PRIMARILY determine the frequency of reassessment for different systems?

• A. Assess every system on the same fixed annual schedule regardless of criticality.
• B. Assess systems in alphabetical order as time permits.
• C. Assess higher-risk and more critical systems more frequently than lower-risk, less critical systems.
• D. Assess only systems that have experienced a prior security incident.

99. An information security manager needs to explain a complex technical vulnerability to a group of business executives with no technical background. What is the MOST effective communication approach?

• A. Present the full technical details, including exploit mechanics, to ensure completeness.
• B. Translate the vulnerability into business terms, describing potential business impact and recommended decisions needed.
• C. Delegate the explanation entirely to a third-party consultant.
• D. Postpone the discussion until the executives acquire technical training.

100. How does risk tolerance differ from risk appetite in the context of an information security risk management program?

• A. Risk appetite is set by IT staff, while risk tolerance is set by external auditors.
• B. Risk tolerance and risk appetite are interchangeable terms with no meaningful distinction.
• C. Risk tolerance applies only to financial risk, while risk appetite applies only to security risk.
• D. Risk appetite is the broad level of risk the organization is willing to pursue, while risk tolerance is the acceptable variation around that level for specific objectives.

101. A risk analysis estimates that a successful ransomware attack on a specific server would result in a single-occurrence financial loss of $200,000. This figure represents which quantitative risk metric?

• A. Annualized rate of occurrence.
• B. Annualized loss expectancy.
• C. Single loss expectancy.
• D. Total cost of ownership.

102. In quantitative risk analysis, the exposure factor represents which of the following?

• A. The total financial value of an asset.
• B. The annual frequency of a threat event occurring.
• C. The total number of threats facing an asset.
• D. The percentage of an asset's value that would be lost if a specific threat event occurred.

103. An organization formally accepts a risk associated with an outdated authentication mechanism on a legacy system because replacement is not feasible in the near term. What should accompany this risk acceptance?

• A. Documented compensating controls, such as enhanced monitoring, that reduce exposure while the underlying risk remains.
• B. Transfer of the risk to the software vendor.
• C. No further action, since acceptance means the risk requires no additional attention.
• D. Removal of the system from the risk register to simplify reporting.

104. A proposed control would reduce a risk's annualized loss expectancy from $500,000 to $150,000, at an annual cost of $200,000 to operate. Based purely on this cost-benefit comparison, what should the information security manager conclude?

• A. The annualized cost of $200,000 is less than the $350,000 reduction in annualized loss expectancy the control provides, indicating a positive net benefit that supports adoption.
• B. The control should be rejected because its annual cost of $200,000 is a significant expense.
• C. The organization should discontinue risk analysis since a single control produced an unfavorable result.
• D. The control's cost is irrelevant as long as any risk is reduced.

105. A risk register contains several risks with similar likelihood ratings but significantly different potential business impact. When resources for treatment are limited, which risks should generally be prioritized FIRST?

• A. Risks that are least costly to remediate, regardless of impact.
• B. Risks that were most recently added to the register.
• C. Risks with the greatest combination of likelihood and potential business impact.
• D. Risks that were identified by external auditors rather than internal staff.

106. An organization purchases a cyber insurance policy to cover the financial costs of a potential data breach. What is an important LIMITATION of this risk transfer strategy that the information security manager should communicate to leadership?

• A. Cyber insurance eliminates the need for any technical security controls.
• B. Cyber insurance transfers full legal accountability for the breach to the insurer.
• C. Cyber insurance automatically prevents breaches from occurring.
• D. Cyber insurance may not cover reputational damage, regulatory penalties, or losses from failure to meet policy security requirements.

107. An organization is planning a merger with another company that will integrate the acquired company's IT environment into its own network. At what point should a risk assessment of the acquired environment BEST be initiated?

• A. Only after the networks have been fully integrated and are operating as one environment.
• B. After the first annual audit following the merger.
• C. Only if a security incident occurs after integration.
• D. As early as possible during due diligence, before systems and networks are integrated.

108. An information security program relies on a single perimeter firewall as its primary control against external threats, with minimal internal network controls. What principle is this program failing to apply?

• A. Risk transfer.
• B. Segregation of duties.
• C. Least privilege.
• D. Defense in depth, using multiple layered controls so that failure of one does not compromise the entire environment.

109. How does patch management relate to a broader vulnerability management program?

• A. Patch management is one remediation mechanism within the broader vulnerability management program, which also includes identification, prioritization, and verification.
• B. Patch management and vulnerability management are unrelated disciplines.
• C. Vulnerability management applies only to network devices, while patch management applies only to servers.
• D. Patch management replaces the need for vulnerability scanning.

110. A development team wants to identify security flaws in application source code before it is deployed to production. Which practice BEST supports this goal within the SDLC?

• A. Conducting user acceptance testing after deployment.
• B. Relying solely on production monitoring to detect issues.
• C. Performing a post-incident review after a breach occurs.
• D. Integrating static application security testing and secure code review into the development pipeline.

111. An organization's IT administrators use their standard, always-on privileged accounts for both daily email and browsing as well as system administration tasks. What is the PRIMARY risk this practice introduces?

• A. Administrators will be unable to complete their job duties efficiently.
• B. A compromise of the administrator's everyday activity, such as a phishing click, could directly expose highly privileged credentials to an attacker.
• C. The organization will incur higher software licensing costs.
• D. Administrators will be unable to receive email notifications about system alerts.

112. What is the PRIMARY function of a security operations center (SOC) within an information security program?

• A. Drafting the organization's information security policies.
• B. Conducting the organization's financial audits.
• C. Continuously monitoring, detecting, and initially responding to security events across the environment.
• D. Approving the organization's annual security budget.

113. An organization frequently experiences security incidents traced back to unauthorized or undocumented changes to production systems. Which program improvement would MOST directly address this root cause?

• A. Strengthening the change management process to require documented approval and security review before production changes are implemented.
• B. Expanding the security awareness training curriculum.
• C. Purchasing additional endpoint detection tools.
• D. Increasing the frequency of penetration testing.

114. An information security program establishes a standardized, hardened configuration baseline that all new servers must be built from. What is the PRIMARY security benefit of this practice?

• A. It reduces the attack surface and ensures a consistent, known-secure starting state across the environment.
• B. It eliminates the need for future vulnerability scanning.
• C. It guarantees compliance with all data protection regulations.
• D. It removes the need for a change management process.

115. An organization encrypts sensitive data at rest but stores the encryption keys on the same server as the encrypted data, with no separate access controls on the keys. What is the PRIMARY weakness in this approach?

• A. Encryption at rest is not an effective control under any circumstances.
• B. Encrypted data cannot be backed up if keys are stored locally.
• C. An attacker who compromises the server gains access to both the encrypted data and the means to decrypt it, undermining the protection encryption is meant to provide.
• D. Local key storage always violates data protection regulations.

116. An organization implements a data loss prevention (DLP) solution as part of its information security program. What is the PRIMARY purpose of this control?

• A. To manage user authentication across applications.
• B. To detect and remediate software vulnerabilities.
• C. To encrypt all data at rest automatically.
• D. To detect and prevent unauthorized transmission or exfiltration of sensitive data.

117. An organization currently relies solely on an annual penetration test to identify security weaknesses. What is the PRIMARY limitation of this approach compared to continuous monitoring?

• A. Annual testing eliminates the need for a vulnerability management program.
• B. Annual testing is always more expensive than continuous monitoring.
• C. Annual testing cannot be performed by external parties.
• D. Vulnerabilities or misconfigurations introduced between annual tests may go undetected for extended periods.

118. An information security manager wants independent assurance that implemented controls are actually operating as designed, beyond the team's own self-assessment. What is the MOST appropriate approach?

• A. Rely on the control owners' self-reported completion status.
• B. Engage internal audit or an independent third party to test control effectiveness.
• C. Review the original control design documentation only.
• D. Assume controls are effective if no incidents have occurred recently.

119. An organization establishes a 'security champions' program, designating volunteers within each development team to receive additional security training and serve as a liaison to the security team. What is the PRIMARY benefit of this approach?

• A. It transfers all security responsibility from the security team to developers.
• B. It eliminates the need for formal secure coding standards.
• C. It removes the need for the security team to review any code.
• D. It embeds security awareness and a point of contact directly within development teams, improving early identification of security concerns.

120. An organization migrates a workload to a public cloud infrastructure-as-a-service (IaaS) provider. Under the typical shared responsibility model, which security responsibility generally REMAINS with the customer?

• A. Maintaining the physical network hardware.
• B. Securing the physical data center facility.
• C. Patching the underlying virtualization hypervisor.
• D. Securing the guest operating system, applications, and data configurations within the cloud environment.

121. An organization permits employees to access corporate email and data on personally owned mobile devices (BYOD) without any mobile device management (MDM) enrollment requirement. What is the GREATEST security gap this creates?

• A. The organization will be unable to issue any devices to employees in the future.
• B. Personal devices will automatically be slower than corporate-issued devices.
• C. The organization has no ability to enforce security configurations or remotely wipe corporate data if a device is lost, stolen, or compromised.
• D. Employees will be unable to access corporate resources from their devices.

122. When defining the scope of an information security program, what is the MOST important factor to establish at the outset?

• A. The color scheme for security awareness training materials.
• B. The exact number of full-time security staff to be hired.
• C. Which assets, systems, and organizational units the program's policies and controls apply to.
• D. The specific vendor products that will be purchased.

123. Over three consecutive annual penetration tests, the number of critical findings has steadily decreased, while the overall scope and complexity of the tested environment has grown. How should the information security manager MOST reasonably interpret this trend?

• A. The security program's controls are likely improving in effectiveness, since findings decreased despite increased environmental complexity.
• B. The penetration testers are becoming less thorough each year.
• C. The organization no longer needs to conduct future penetration tests.
• D. The decreasing findings indicate the environment has become simpler to defend.

124. An organization is redesigning its network architecture around the principle that no user or device should be inherently trusted, regardless of whether it is inside or outside the traditional network perimeter. This describes which architectural approach?

• A. Perimeter-based security.
• B. Segregation of duties.
• C. Zero trust architecture, which requires continuous verification of identity and context for every access request.
• D. Defense in depth.

125. Two vulnerabilities have identical severity scores, but one has a publicly available exploit actively being used in attacks, while the other has no known exploit. How should the information security manager prioritize remediation?

• A. Treat both vulnerabilities with equal priority since their severity scores are identical.
• B. Prioritize the vulnerability with the known, actively exploited attack, since real-world exploitability increases the actual likelihood of compromise.
• C. Prioritize the vulnerability without a known exploit, since it is less understood by defenders.
• D. Defer both vulnerabilities until the next scheduled patch cycle regardless of exploit status.

126. An organization requires users to provide both a password and a one-time code from a mobile authenticator app to log into sensitive systems. This is an example of which security practice?

• A. Single sign-on.
• B. Data classification.
• C. Role-based access control.
• D. Multi-factor authentication, combining something the user knows with something the user has.

127. As part of an acquisition, the information security program must integrate the acquired company's systems and staff into the parent organization's security policies and controls. Which factor is MOST important for the information security manager to address EARLY in this integration?

• A. Postponing any security assessment until the acquired company's staff have completed a full year of employment.
• B. Immediately terminating all of the acquired company's existing security contracts.
• C. Identifying gaps between the acquired company's control environment and the parent's required baseline, and prioritizing remediation of the highest-risk gaps.
• D. Rebranding all acquired company assets with the parent company's logo.

128. An employee resigns and their last day is in two weeks. What is the BEST practice for managing their system access during the notice period and upon departure?

• A. Leave all access unchanged until the employee's final day, then review access at a convenient time afterward.
• B. Immediately revoke all access the moment resignation is announced, regardless of ongoing job duties.
• C. Rely on the employee to self-report which systems should be deactivated.
• D. Review and restrict access to only what is needed during the notice period, and ensure all access is revoked promptly at the effective termination time.

129. A security program relies exclusively on static application security testing (SAST) of source code and performs no testing of the running application. What type of vulnerability is this approach MOST likely to miss?

• A. Hardcoded credentials embedded directly in the source code.
• B. Runtime configuration and environment-specific vulnerabilities that only manifest when the application is executing, such as certain authentication or session-handling flaws.
• C. Vulnerabilities involving unsafe use of a known-insecure coding pattern.
• D. Vulnerable open-source library versions referenced directly in the code.

130. An organization segments its network so that point-of-sale systems are isolated on a separate network segment from general corporate workstations, with tightly controlled traffic between them. What is the PRIMARY security benefit of this design?

• A. It guarantees compliance with all payment card industry requirements.
• B. It eliminates the need for endpoint protection software on either segment.
• C. It removes the need for monitoring traffic within the payment segment.
• D. It limits the ability of an attacker who compromises the general corporate network to move laterally into the more sensitive payment environment.

131. An organization performs nightly backups of critical systems but has never tested restoring from those backups. What is the GREATEST risk this practice creates?

• A. Backup storage costs will be higher than necessary.
• B. Nightly backups will interfere with normal business operations during the day.
• C. The backups will automatically expire after a fixed period.
• D. The organization may discover during an actual recovery event that the backups are incomplete, corrupted, or unusable, when it is too late to correct the problem.

132. An information security manager wants a metric that reflects how consistently systems adhere to the organization's hardened configuration standard over time. Which metric BEST serves this purpose?

• A. The total number of servers owned by the organization.
• B. The average age of the organization's hardware inventory.
• C. The number of help desk tickets submitted per month.
• D. The percentage of systems found compliant with the configuration baseline during periodic scans.

133. After a compromised system has been contained, the incident response team removes the malware, disables the attacker's persistence mechanisms, and closes the exploited vulnerability. Which incident response phase does this describe?

• A. Eradication.
• B. Preparation.
• C. Detection.
• D. Containment.

134. Before returning a previously compromised system to production, what should the incident response team verify FIRST?

• A. That end users have been notified of a new password policy.
• B. That the system's hardware has been physically relocated.
• C. That the system's warranty is still valid.
• D. That the root cause has been eradicated and the system is free of any remaining indicators of compromise.

135. An organization develops documented runbooks that specify step-by-step actions for responding to common incident types, such as ransomware or phishing, before any incident occurs. Which incident response phase does this activity belong to?

• A. Preparation.
• B. Recovery.
• C. Containment.
• D. Eradication.

136. A security operations center simultaneously receives alerts for a suspected phishing email reported by one employee and unusual outbound data transfer from a database server containing regulated customer records. With limited immediate analyst capacity, which should be triaged FIRST?

• A. The phishing email, since email-based threats are always the most common attack vector.
• B. Both should be assigned equal priority and worked in the order received.
• C. Neither should be treated as urgent until a formal incident is declared by management.
• D. The unusual outbound data transfer from the regulated database server, given its higher potential impact and evidence of active data movement.

137. An organization's incident response plan defines specific criteria, such as data type affected and number of systems involved, that determine when an event must be escalated to senior management. What is the PRIMARY purpose of having these predefined escalation criteria?

• A. To reduce the total number of incidents the organization experiences.
• B. To ensure all incidents, regardless of severity, are escalated to the board of directors.
• C. To eliminate the need for a formal incident response plan.
• D. To ensure incidents of sufficient severity reach decision-makers consistently and promptly, rather than relying on ad hoc judgment calls during a stressful event.

138. During evidence collection for a security incident that may result in legal action, an analyst images a hard drive and documents who handled it, when, and for what purpose at each step. What is the PRIMARY reason this documentation is maintained?

• A. To reduce the storage space required for the evidence.
• B. To satisfy the organization's data retention policy.
• C. To allow the evidence to be deleted more quickly after the investigation.
• D. To establish a defensible chain of custody demonstrating the evidence was not altered or tampered with between collection and use.

139. During an active incident on a critical production server, the team is deciding between isolating the server from the network while keeping it running, versus immediately powering it off. What is the PRIMARY trade-off between these two containment approaches?

• A. Isolating the server always causes greater business disruption than powering it off.
• B. Isolating while running can preserve volatile evidence such as memory contents and active connections, while powering off may cause the loss of that volatile data but definitively stops any ongoing malicious activity.
• C. There is no meaningful difference between the two approaches for containment purposes.
• D. Powering off the server always preserves more forensic evidence than isolating it.

140. An alert indicating potential malware on an endpoint is investigated and determined to be a false positive triggered by legitimate administrative software. What is the MOST appropriate next step?

• A. Immediately isolate the endpoint from the network regardless of the finding.
• B. Escalate the alert to senior management as a confirmed incident.
• C. Take no further action or documentation since the alert was a false positive.
• D. Document the finding and, if appropriate, tune the detection rule to reduce recurrence of similar false positives.

141. Following an incident, the response team determines that the initial point of entry was a misconfigured remote access service left exposed to the internet. What activity does identifying this specific finding represent?

• A. Business impact analysis.
• B. Risk transfer.
• C. Root cause analysis, which identifies the underlying condition that allowed the incident to occur.
• D. Chain of custody documentation.

142. During a major incident involving multiple technical teams, legal, and communications staff, who is generally responsible for coordinating overall response activities and making key operational decisions?

• A. Whichever team member first detected the incident.
• B. A designated incident commander with the authority to coordinate across teams and make timely decisions.
• C. The organization's external auditor.
• D. The most senior executive available, regardless of incident response training.

143. During an incident involving a suspected nation-state actor, legal counsel recommends engaging law enforcement. What is an important consideration the information security manager should raise regarding this decision?

• A. Law enforcement engagement is never appropriate for security incidents.
• B. Law enforcement involvement will guarantee full recovery of any stolen data.
• C. Engaging law enforcement eliminates the need to continue technical remediation efforts.
• D. Law enforcement involvement may affect the timeline and handling of evidence, systems, and public disclosure, and should be coordinated with the ongoing technical response.

144. During a significant incident that may require public disclosure, why is it important for the information security manager to coordinate closely with legal and communications teams before any public statement is released?

• A. To delay the incident response process until a statement is fully drafted.
• B. To ensure the statement uses the most technical language possible for accuracy.
• C. To transfer full responsibility for the incident response to the communications team.
• D. To ensure the statement is factually accurate, legally sound, and does not disclose information that could aid attackers or violate notification obligations.

145. An incident response plan has been drafted by the security operations team. Who should formally approve the plan to ensure organizational commitment and authority?

• A. Senior management or an appropriate governance body with the authority to commit organizational resources and roles during an incident.
• B. Only the security operations team that authored it.
• C. The organization's external penetration testing vendor.
• D. No formal approval is necessary as long as the plan is technically sound.

146. An organization has only ever tested its incident response plan through tabletop discussions where participants talk through hypothetical scenarios. What additional value would a full technical simulation exercise, involving actual systems in a test environment, provide beyond the tabletop format?

• A. It would replace the need for documented runbooks.
• B. It would validate the technical execution of response actions, such as actual tool usage and system isolation steps, which a discussion-based exercise cannot verify.
• C. It would eliminate the need for any future tabletop exercises.
• D. It guarantees that no future incident will occur.

147. An organization discovers that a security incident originated at a third-party vendor with system access to its environment, rather than within its own systems. What should the information security manager do regarding this vendor relationship as part of the response?

• A. Immediately terminate the vendor contract without further investigation.
• B. Wait for the vendor to voluntarily disclose details with no formal engagement.
• C. Take no action regarding the vendor since the incident occurred on the organization's own systems ultimately.
• D. Engage the vendor per any contractual incident notification and cooperation obligations, and assess the vendor's access and controls as part of the response.

148. An investigation reveals that a current employee intentionally exfiltrated confidential data. Compared to responding to an external attacker, what additional consideration does this insider incident MOST require?

• A. Close coordination with human resources and legal counsel regarding employment action, evidence standards, and potential legal proceedings against the individual.
• B. Technical containment steps become unnecessary once an insider is identified.
• C. The incident does not need to be documented since no external party was involved.
• D. No additional considerations are needed since the response process is identical.

149. An information security manager wants to report the total organizational cost of a recent incident to executive leadership. Which set of factors should this figure PRIMARILY include?

• A. Direct costs such as remediation, legal fees, and regulatory fines, along with reasonably estimable indirect costs such as business disruption.
• B. Only the cost of new security tools purchased after the incident.
• C. Only the salary of the incident response team members involved.
• D. Only the cost of the cyber insurance premium for the following year.

150. An organization's public-facing web application becomes unavailable due to a large-scale distributed denial-of-service (DDoS) attack. Which response action is MOST directly relevant to this specific type of incident, compared to a typical malware-based incident?

• A. Performing forensic imaging of the affected web server's hard drive.
• B. Engaging DDoS mitigation services or traffic-scrubbing capabilities to absorb and filter malicious traffic while preserving legitimate access.
• C. Disabling the affected employee's user account credentials.
• D. Reviewing email gateway logs for phishing indicators.

151. An organization discovers that an attacker compromised an executive's email account and used it to instruct the finance department to wire funds to a fraudulent account, a portion of which was transferred before detection. In addition to securing the compromised account, what should the incident response include?

• A. Notification to the marketing department to update the company website.
• B. A review of the physical security badge access logs for the building.
• C. Prompt engagement with the organization's bank and, where applicable, law enforcement to attempt to recall or trace the fraudulent transfer, alongside a review of financial approval controls.
• D. A mandatory password reset for all customers of the organization.

152. An organization learns that a software vendor whose product is widely deployed across the organization's environment has suffered a supply chain compromise, potentially distributing malicious code through a legitimate software update. What should the information security manager's response PRIMARILY focus on FIRST?

• A. Identifying all instances of the affected product and update version within the environment and assessing whether indicators of compromise associated with the malicious update are present.
• B. Waiting for the vendor to issue a public statement before taking any internal action.
• C. Immediately uninstalling all software from every vendor the organization uses, as a precaution.
• D. Filing a lawsuit against the vendor before assessing internal exposure.

153. An analyst isolates an infected workstation from the network to prevent malware from spreading further, but has not yet removed the malware from the system. What has been accomplished at this point?

• A. Recovery, since the system is now considered safe to use.
• B. Preparation, since the response plan is now being followed for the first time.
• C. Containment, since the spread of the threat has been limited, though the underlying malware has not yet been eradicated.
• D. Eradication, since the malware can no longer communicate externally.

154. An organization's incident response process requires a formal 'incident' to be declared before certain response resources and communication protocols are activated. What is the PRIMARY benefit of having clearly defined criteria for when an event qualifies as a formal incident?

• A. It guarantees that declared incidents will always be resolved within a fixed time period.
• B. It reduces the total number of security events the organization experiences.
• C. It ensures response resources and protocols are activated consistently for events that meet the threshold, avoiding both under-response to serious events and unnecessary activation for minor ones.
• D. It eliminates the need to investigate events that do not meet the incident threshold.

155. An information security manager is preparing a post-incident report for two audiences: the technical response team and executive leadership. How should the content of these two versions MOST appropriately differ?

• A. Both versions should be identical to avoid any inconsistency in reporting.
• B. The executive version should focus on business impact, root cause at a high level, and recommended actions, while the technical version includes detailed forensic findings and remediation steps.
• C. The executive version should include the full technical exploit details for completeness.
• D. The technical version should omit the timeline of events entirely.

156. A severe incident begins to affect not only IT systems but also physical facility operations and requires coordination with corporate crisis management processes. What does this scenario illustrate about incident response planning?

• A. Incident response plans should never address scenarios beyond pure IT systems.
• B. Crisis management and incident response are entirely separate processes that should never interact.
• C. Physical facility issues should always be handled independently of the security incident response team.
• D. Incident response plans should be integrated with broader organizational crisis management processes to handle incidents with impacts beyond IT systems alone.

157. An organization with a small internal security team is evaluating whether to establish a retainer agreement with an external incident response firm before any incident occurs. What is the PRIMARY benefit of establishing this retainer in advance, rather than seeking external help only after an incident begins?

• A. It transfers full legal liability for any incident to the external firm.
• B. It guarantees the organization will never need to declare a major incident.
• C. It eliminates the need for the internal security team to have any incident response capability.
• D. It secures predefined response times, contractual terms, and familiarity with the environment, avoiding delays that would occur if vendor selection and contracting started only after an incident is already underway.

158. During an investigation into a suspected compromise, the response team discovers that critical system logs were only retained for seven days and the initial intrusion is believed to have occurred three weeks earlier. What is the PRIMARY impact of this finding?

• A. The investigation can proceed with no meaningful loss of capability.
• B. The organization will be unable to declare a formal incident.
• C. The team's ability to reconstruct the full timeline and initial entry point of the attack is significantly impaired due to the missing historical log data.
• D. The compromised systems can no longer be patched.

159. An organization is simultaneously handling two active incidents: a low-severity malware infection on a single non-critical workstation, and a suspected unauthorized access attempt against the organization's core financial database. With limited response staff available, how should resources be allocated?

• A. Prioritize the suspected unauthorized access to the core financial database, given its significantly higher potential business impact.
• B. Postpone both incidents until additional staff can be hired.
• C. Prioritize the malware infection because it was detected first.
• D. Equally split resources between both incidents regardless of severity or potential impact.