Isaca CISM Exam Dumps

Certified Information Security Manager

Isaca CISM Sample Questions

Question # 1

Which of the following should an organization do FIRST upon learning that a subsidiary is located in a country where civil unrest has just begun? 

A. Assess changes in the risk profile. 
B. Activate the disaster recovery plan (DRP). 
C. Invoke the incident response plan. 
D. Conduct security awareness training. 

Show Answer

Question # 2

An organization finds it necessary to quickly shift to a work-fromhome model with an increased need for remote access security. Which of the following should be given immediate focus? 

A. Moving to a zero trust access model 
B. Enabling network-level authentication 
C. Enhancing cyber response capability 
D. Strengthening endpoint security 

Show Answer

Question # 3

An organization plans to implement a new e-commerce operation in a highly regulated market. Which of the following is MOST important to consider when updating the risk management strategy? 

A. Strategy of industry peers 
B. Outsourcing needs 
C. Business culture
 D. Compliance requirements 

Show Answer

Question # 4

Which of the following should include contact information for representatives of equipment and software vendors? 

A. Information security program charter 
B. Business impact analysis (BIA) 
C. Service level agreements (SLAs) 
D. Business continuity plan (BCP) 

Show Answer

Question # 5

Which of the following activities is designed to handle a control failure that leads to a breach? 

A. Risk assessment
 B. Incident management 
C. Root cause analysis 
D. Vulnerability management 

Show Answer

Question # 6

Which of the following is the MOST appropriate metric to demonstrate the effectiveness of information security controls to senior management? 

A. Downtime due to malware infections 
B. Number of security vulnerabilities uncovered with network scans 
C. Percentage of servers patched
 D. Annualized loss resulting from security incidents

Show Answer

Question # 7

Which of the following is MOST important to ensuring that incident management plans are executed effectively? 

A. Management support and approval has been obtained. 
B. The incident response team has the appropriate training. 
C. An incident response maturity assessment has been conducted. 
D. A reputable managed security services provider has been engaged. 

Show Answer

Question # 8

Which of the following is the MOST effective way to detect security incidents? 

A. Analyze recent security risk assessments. 
B. Analyze security anomalies. 
C. Analyze penetration test results. 
D. Analyze vulnerability assessments. 

Show Answer

Question # 9

An organization is experiencing a sharp increase in incidents related to phishing messages. The root cause is an outdated email filtering system that is no longer supported by the vendor. Which of the following should be the information security manager's FIRST course of action? 

A. Reinforce security awareness practices for end users. 
B. Temporarily outsource the email system to a cloud provider. 
C. Develop a business case to replace the system. 
D. Monitor outgoing traffic on the firewall. 

Show Answer

Question # 10

For which of the following is it MOST important that system administrators be restricted to read-only access? 

A. User access log files 
B. Administrator user profiles
 C. Administrator log files 
D. System logging options 

Show Answer

Question # 11

A security incident has been reported within an organization When should an information security manager contact the information owner? 

A. After the incident has been mitigated 
B. After the incident has been confirmed. 
C. After the potential incident has been togged
 D. After the incident has been contained 

Show Answer

Question # 12

After logging in to a web application, additional authentication is checked at various application points. Which of the following is the PRIMARY reason for such an approach? 

A. To ensure access rights meet classification requirements 
B. To facilitate the analysis of application logs 
C. To ensure web application availability 
D. To support strong two-factor authentication protocols 

Show Answer

Question # 13

Which of the following is MOST important to ensure when developing escalation procedures for an incident response plan? 

A. Each process is assigned to a responsible party. 
B. The contact list is regularly updated. 
C. Minimum regulatory requirements are maintained. 
D. Senior management approval has been documented. 

Show Answer

Question # 14

Which of the following has the MOST influence on the information security investment process? 

A. IT governance framework 
B. Information security policy 
C. Organizational risk appetite 
D. Security key performance indicators (KPIs) 

Show Answer

Question # 15

Which of the following has the GREATEST influence on the successful integration of information security within the business? 

A. Organizational structure and culture 
B. Risk tolerance and organizational objectives
 C. The desired state of the organization 
D. Information security personnel 

Show Answer

Question # 16

What should be the FIRST step when an Internet of Things (loT) device in an organization's network is confirmed to have been hacked? 

A. Monitor the network. 
B. Perform forensic analysis. 
C. Disconnect the device from the network, 
D. Escalate to the incident response team 

Show Answer

Question # 17

Which of the following is the BEST way to determine if an information security profile is aligned with business requirements? 

A. Review the key performance indicator (KPI) dashboard 
B. Review security-related key risk indicators (KRIs) 
C. Review control self-assessment (CSA) results
 D. Review periodic security audits 

Show Answer

Question # 18

Which of the following should be the PRIMARY focus of a status report on the information security program to senior management? 

A. Providing evidence that resources are performing as expected 
B. Verifying security costs do not exceed the budget 
C. Demonstrating risk is managed at the desired level 
D. Confirming the organization complies with security policies 

Show Answer

Question # 19

Management would like to understand the risk associated with engaging an Infrastructureas-a-Service (laaS) provider compared to hosting internally. Which of the following would provide the BEST method of comparing risk scenarios? 

A. Mapping risk scenarios according to sensitivity of data 
B. Reviewing mitigating and compensating controls for each risk scenario 
C. Mapping the risk scenarios by likelihood and impact on a chart 
D. Performing a risk assessment on the laaS provider 

Show Answer

Question # 20

The PRIMARY goal when conducting post-incident reviews is to identify: 

A. Additional cybersecurity budget needs 
B. Weaknesses in incident response plans 
C. Information to be shared with senior management 
D. Individuals that need additional training 

Show Answer

Question # 21

Which of the following metrics BEST demonstrates the effectiveness of an organization's security awareness program? 

A. Number of security incidents reported to the help desk 
B. Percentage of employees who regularly attend security training 
C. Percentage of employee computers and devices infected with malware 
D. Number of phishing emails viewed by end users 

Show Answer

Question # 22

Reviewing which of the following would be MOST helpful when a new information security manager is developing an information security strategy for a non-regulated organization? 

A. Management's business goals and objectives 
B. Strategies of other non-regulated companies 
C. Risk assessment results 
D. Industry best practices and control recommendations 

Show Answer

Question # 23

An organization has decided to implement an Internet of Things (IoT) solution to remain competitive in the market. Which of the following should information security do FIRST? 

A. Recalculate risk profile 
B. Implement compensating controls 
C. Reassess risk tolerance levels 
D. Update the security architecture 

Show Answer

Question # 24

Which of the following is the BEST approach for data owners to use when defining access privileges for users?

A. Implement an identity and access management (IDM) tool. 
B. Define access privileges based on user roles.
C. Adopt user account settings recommended by the vendor.
D. Perform a risk assessment of the users' access privileges.

Show Answer

Question # 25

An incident response team recently encountered an unfamiliar type of cyber event. Though the team was able to resolve the issue, it took a significant amount of time to identify. What is the BEST way to help ensure similar incidents are identified more quickly in the future? 

A. Implement a SIEM solution. 
B. Perform a threat analysis. 
C. Establish performance metrics for the team. 
D. Perform a post-incident review. 

Show Answer

Question # 26

During the implementation of a new system, which of the following processes proactively minimizes the likelihood of disruption, unauthorized alterations, and errors? 

A. Configuration management 
B. Password management 
C. Change management 
D. Version management 

Show Answer

Question # 27

Which of the following is the MOST common cause of cybersecurity breaches? 

A. Lack of adequate password rotation 
B. Human error
 C. Abuse of privileged accounts 
D. Lack of control baselines 

Show Answer

Question # 28

An information security manager notes that security incidents are not being appropriately escalated by the help desk after tickets are logged. Which of the following is the BEST automated control to resolve this issue? 

A. Implementing automated vulnerability scanning in the help desk workflow 
B. Changing the default setting for all security incidents to the highest priority 
C. Integrating automated service level agreement (SLA) reporting into the help desk ticketing system 
D. Integrating incident response workflow into the help desk ticketing system 

Show Answer

Question # 29

An information security program is BEST positioned for success when it is closely aligned with: 

A. information security best practices. 
B. recognized industry frameworks. 
C. information security policies. 
D. the information security strategy. 

Show Answer

Question # 30

A security incident has been reported within an organization. When should an information security manager contact the information owner? 

A. After the incident has been contained 
B. After the incident has been mitigated 
C. After the incident has been confirmed 
D. After the potential incident has been logged 

Show Answer

Question # 31

An information security manager has discovered a new technique that cybercriminals are exploiting. Which of the following has the manager identified? 

A. A risk 
B. A threat 
C. An incident 
D. An event 

Show Answer

Question # 32

The PRIMARY advantage of performing black-box control tests as opposed to white-box control tests is that they: 

A. cause fewer potential production issues. 
B. require less IT staff preparation. 
C. simulate real-world attacks. 
D. identify more threats. 

Show Answer

Question # 33

Which of the following is the PRIMARY benefit of an information security awareness training program? 

A. Influencing human behavior 
B. Evaluating organizational security culture 
C. Defining risk accountability 
D. Enforcing security policy 

Show Answer

Question # 34

Which of the following is the MOST effective way to determine the alignment of an information security program with the business strategy? 

A. Evaluate the results of business continuity testing. 
B. Review key performance indicators (KPIs). 
C. Evaluate the business impact of incidents. 
D. Engage business process owners. 

Show Answer

Question # 35

When multiple Internet intrusions on a server are detected, the PRIMARY concern of the information security manager should be to ensure: 

A. the integrity of evidence is preserved. 
B. forensic investigation software is loaded on the server.
C. the incident is reported to senior management. 
D. the server is unplugged from power. 

Show Answer

Question # 36

The MOST useful technique for maintaining management support for the information security program is: 

A. informing management about the security of business operations. 
B. implementing a comprehensive security awareness and training program. 
C. identifying the risks and consequences of failure to comply with standards. 
D. benchmarking the security programs of comparable organizations. 

Show Answer

Question # 37

An organization involved in e-commerce activities operating from its home country opened a new office in another country with stringent security laws. In this scenario, the overall security strategy should be based on: 

A. the security organization structure. 
B. international security standards. 
C. risk assessment results.
 D. the most stringent requirements. 

Show Answer

Question # 38

Which of the following is the BEST approach for addressing noncompliance with security standards?

A. Develop new security standards. 
B. Maintain a security exceptions process. 
C. Discontinue affected activities until security requirements can be met. 
D. Apply additional logging and monitoring to affected assets. 

Show Answer

Question # 39

Which of the following backup methods requires the MOST time to restore data for an application? 

A. Full backup 
B. Incremental 
C. Differential 
D. Disk mirroring 

Show Answer

Question # 40

Which of the following should be the PRIMARY consideration when developing an incident response plan? 

A. The definition of an incident 
B. Compliance with regulations 
C. Management support 
D. Previously reported incidents 

Show Answer

Question # 41

ACISO learns that a third-party service provider did not notify the organization of a data breach that affected the service provider's data center. Which of the following should the CISO do FIRST? 

A. Recommend canceling the outsourcing contract. 
B. Request an independent review of the provider's data center. 
C. Notify affected customers of the data breach. 
D. Determine the extent of the impact to the organization. 

Show Answer

Question # 42

Which of the following BEST ensures timely and reliable access to services? 

A. Nonrepudiation 
B. Authenticity 
C. Availability 
D. Recovery time objective (RTO) 

Show Answer

Question # 43

An organization permits the storage and use of its critical and sensitive information on employee-owned smartphones. Which of the following is the BEST security control? 

A. Establishing the authority to remote wipe 
B. Developing security awareness training 
C. Requiring the backup of the organization's data by the user 
D. Monitoring how often the smartphone is used 

Show Answer

Question # 44

Data classification is PRIMARILY the responsibility of: 

A. senior management. 
B. the data custodian. 
C. the data owner. 
D. the security manager. 

Show Answer

Question # 45

Which of the following is the PRIMARY reason for an information security manager to periodically review existing controls? 

A. To prioritize security initiatives
 B. To avoid redundant controls 
C. To align with emerging risk 
D. To address end-user control complaints

Show Answer

Question # 46

An information security manager has confirmed the organization's cloud provider has unintentionally published some of the organization's business data. Which of the following should be done NEXT? 

A. Identify users associated with the exposed data. 
B. Initiate the organization's data loss prevention (DLP) processes. 
C. Review the cloud provider's service level agreement (SLA). 
D. Invoke the incident response plan. 

Show Answer

Question # 47

Which of the following is the GREATEST challenge when developing key risk indicators (KRIs)? 

A. Limiting the number of KRIs 
B. Comprehensively reporting on KRIs 
C. Aggregating common KRIs 
D. Linking KRIs to specific risks 

Show Answer

Question # 48

The ULTIMATE responsibility for ensuring the objectives of an information security framework are being met belongs to: 

A. the internal audit manager. 
B. the information security officer. 
C. the steering committee. 
D. the board of directors. 

Show Answer

Question # 49

From an information security perspective, legal issues associated with a transborder flow of technology-related items are MOST often 

A. website transactions and taxation. 
B. software patches and corporate date. 
C. encryption tools and personal data. 
D. lack of competition and free trade. 

Show Answer

Question # 50

Which of the following is the BEST tool to use for identifying and correlating intrusion attempt alerts? 

A. Threat analytics software 
B. Host intrusion detection system 
C. SIEM 
D. Network intrusion detection system 

Show Answer

Question # 51

A post-incident review identified that user error resulted in a major breach. Which of the following is MOST important to determine during the review?

A. The time and location that the breach occurred 
B. Evidence of previous incidents caused by the user 
C. The underlying reason for the user error 
D. Appropriate disciplinary procedures for user error 

Show Answer

Question # 52

An organization experienced a loss of revenue during a recent disaster. Which of the following would BEST prepare the organization to recover? 

A. Business impact analysis (BIA) 
B. Business continuity plan (BCP) 
C. Incident response plan 
D. Disaster recovery plan (DRP) 

Show Answer

Question # 53

Recovery time objectives (RTOs) are BEST determined by: 

A. business managers 
B. business continuity officers 
C. executive management
 D. database administrators (DBAs). 

Show Answer

Question # 54

Which of the following would BEST justify continued investment in an information security program? 

A. Reduction in residual risk 
B. Security framework alignment 
C. Speed of implementation 
D. Industry peer benchmarking 

Show Answer

Question # 55

A multinational organization is introducing a security governance framework. The information security manager's concern is that regional security practices differ. Which of the following should be evaluated FIRST? 

A. Local regulatory requirements 
B. Global framework standards 
C. Cross-border data mobility 
D. Training requirements of the framework 

Show Answer

Question # 56

A small organization with limited budget hires a new information security manager who finds the same IT staff member is assigned the responsibility of system administrator, security administrator, database administrator (DBA), and application administrator What is the manager's BEST course of action? 

A. Automate user provisioning activities. 
B. Maintain strict control over user provisioning activities. 
C. Formally document IT administrator activities. 
D. Implement monitoring of IT administrator activities. 

Show Answer

Question # 57

After a ransomware incident an organization's systems were restored. Which of the following should be of MOST concern to the information security manager? 

A. The service level agreement (SLA) was not met. 
B. The recovery time objective (RTO) was not met. 
C. The root cause was not identified. 
D. Notification to stakeholders was delayed. 

Show Answer

Question # 58

An information security manager is assisting in the development of the request for proposal (RFP) for a new outsourced service. This will require the third party to have access to critical business information. The security manager should focus PRIMARILY on defining: 

A. service level agreements (SLAs) 
B. security requirements for the process being outsourced. 
C. risk-reporting methodologies. 
D. security metrics 

Show Answer

Question # 59

Which of the following would BEST mitigate accidental data loss events? 

A. Conduct periodic user awareness training. 
B. Obtain senior management support for the information security strategy. 
C. Conduct a data loss prevention (DLP) audit. 
D. Enforce a data hard drive encryption policy. 

Show Answer

Question # 60

Which of the following is the BEST way lo monitor for advanced persistent threats (APT) in an organization? 

A. Network with peers in the industry to share information. 
B. Browse the Internet to team of potential events 
C. Search for anomalies in the environment 
D. Search for threat signatures in the environment. 

Show Answer

Question # 61

Which of the following is a prerequisite for formulating a business continuity plan (BCP)? 

A. Recovery time objectives (RTOs) for the business processes 
B. Process maps for production applications 
C. System recovery procedures for alternate-site processing 
D. Comprehensive property inventory 

Show Answer

Question # 62

Which of the following is the BEST reason to implement an information security architecture? 

A. Assess the cost-effectiveness of the integration. 
B. Fast-track the deployment of information security components. 
C. Serve as a post-deployment information security road map. 
D. Facilitate consistent implementation of security requirements. 

Show Answer

Question # 63

Which of the following BEST determines the allocation of resources during a security incident response? 

A. Senior management commitment 
B. A business continuity plan (BCP) 
C. An established escalation process 
D. Defined levels of severity 

Show Answer

Question # 64

Which of the following eradication methods is MOST appropriate when responding to an incident resulting in malware on an application server? 

A. Disconnect the system from the network. 
B. Change passwords on the compromised system. 
C. Restore the system from a known good backup. 
D. Perform operation system hardening. 

Show Answer

Question # 65

Which of the following should an information security manager do FIRST when there is a conflict between the organization's information security policy and a local regulation? 

A. Enforce the local regulation. 
B. Obtain legal guidance. 
C. Enforce the organization's information security policy. 
D. Obtain an independent assessment of the regulation. 

Show Answer

Question # 66

Which of the following BEST facilitates recovery of data lost as a result of a cybersecurity incident? 

A. Removable storage media 
B. Disaster recovery plan (DRP) 
C. Offsite data backups 
D. Encrypted data drives 

Show Answer

Question # 67

Which of the following is MOST important for an information security manager to verify before conducting full-functional continuity testing? 

A. Risk acceptance by the business has been documented 
B. Teams and individuals responsible for recovery have been identified 
C. Copies of recovery and incident response plans are kept offsite 
D. Incident response and recovery plans are documented in simple language 

Show Answer

Question # 68

Which of the following roles is MOST appropriate to determine access rights for specific users of an application? 

A. Data owner 
B. Data custodian 
C. System administrator
 D. Senior management 

Show Answer

Question # 69

Which of the following BEST enables an organization to provide ongoing assurance that legal and regulatory compliance requirements can be met? 

A. Embedding compliance requirements within operational processes 
B. Engaging external experts to provide guidance on changes in compliance requirements 
C. Performing periodic audits for compliance with legal and regulatory requirements 
D. Assigning the operations manager accountability for meeting compliance requirements 

Show Answer

Question # 70

Which of the following is the BEST course of action when confidential information is inadvertently disseminated outside the organization? 

A. Review compliance requirements. 
B. Communicate the exposure. 
C. Declare an incident. 
D. Change the encryption keys. 

Show Answer

Question # 71

Which of the following should be the KEY consideration when creating an information security communication plan with industry peers? 

A. Balancing the benefits of information sharing with the drawbacks of sharing sensitive information 
B. Reducing the costs associated with information sharing by automating the process 
C. Ensuring information is detailed enough to be of use to other organizations 
D. Notifying the legal department whenever incident-related information is shared 

Show Answer

Question # 72

An organization is planning to outsource the execution of its disaster recovery activities. Which of the following would be MOST important to include in the outsourcing agreement? 

A. Definition of when a disaster should be declared 
B. Requirements for regularly testing backups 
C. Recovery time objectives (RTOs) 
D. The disaster recovery communication plan 

Show Answer

Question # 73

Which of the following should an information security manager do FIRST upon learning that a competitor has experienced a ransomware attack? 

A. Perform a full data backup. 
B. Conduct ransomware awareness training for all staff.
 C. Update indicators of compromise in the security systems. 
D. Review the current risk assessment. 

Show Answer