Certified Information Security Manager practice questions

1. Question 1 of 25

   An information security risk analysis BEST assists an organization in ensuring that:

   • Athe infrastructure has the appropriate level of access control.
   • Bcost-effective decisions are made with regard to which assets need protection
   • Can appropriate level of funding is applied to security processes.
   • Dthe organization implements appropriate security technologies

   Show answer

   Correct answer: B

   How others answered

   • B94%

   Explanation

   CISM - AIO 2nd - The risk analyst studies different event scenarios and determines the impact of each. This may be expressed in quantitative terms (dollars or other currency) or qualitative terms (high/medium/low or a numeric scale of 1 to 5 or of 1 to 10). Sounds like B to me

   Adapted from community discussion by MSKid · 2024-09-24 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

   1. M

      MSKid

      2024-09-24

      Selected B19 upvotes

      CISM - AIO 2nd - The risk analyst studies different event scenarios and determines the impact of each. This may be expressed in quantitative terms (dollars or other currency) or qualitative terms (high/medium/low or a numeric scale of 1 to 5 or of 1 to 10). Sounds like B to me

   2. V

      Viperhunter

      2024-09-24

      Selected B8 upvotes

      Information security risk analysis helps organizations identify and prioritize potential risks to their information assets. By assessing the likelihood and impact of various risks, organizations can make informed and cost-effective decisions about where to allocate resources for protection. This involves determining which assets are most critical and require heightened security measures based on the level of risk they pose. While the other options (ensuring appropriate access control, applying appropriate funding to security processes, and implementing appropriate security technologies) are also important considerations, the primary benefit of risk analysis is in facilitating cost-effective decisions related to asset protection.

   3. P

      puggalhimanya

      2023-08-10

      Selected B1 upvote

      Asset protection as per the data stored in it is HIGHEST priority while doing Risk Analysis

   4. A

      Ali29

      2023-09-26

      Selected B1 upvote

      B. cost-effective decisions are made with regard to which assets need protection

2. Question 2 of 25

   Which of the following is the MOST effective way to address an organization's security concerns during contract negotiations with a third party?

   • AReview the third-party contract with the organization's legal department.
   • BCommunicate security policy with the third-party vendor.
   • CEnsure security is involved in the procurement process.
   • DConduct an information security audit on the third-party vendor.

   Show answer

   Correct answer: C

   How others answered

   • C82%
   • B18%

   Explanation

   Ensuring security is involved in the procurement process is the most effective way to address an organization's security concerns during contract negotiations with a third party. Involving security personnel in the procurement process allows the organization to identify and address potential security risks early on, before a contract is signed. This helps ensure that security requirements are included in the contract and that the third-party vendor is aware of and committed to meeting the organization's security standards. By having security involved in the procurement process, the organization can also ensure that the third-party vendor has adequate security controls in place to protect sensitive information and critical assets. This can include reviewing the vendor's security policies, conducting security assessments, and verifying that the vendor is in compliance with relevant laws and regulations.

   Adapted from community discussion by ccKane · 2023-01-31 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

   1. C

      ccKane

      2023-01-31

      Selected C8 upvotes

      Ensuring security is involved in the procurement process is the most effective way to address an organization's security concerns during contract negotiations with a third party. Involving security personnel in the procurement process allows the organization to identify and address potential security risks early on, before a contract is signed. This helps ensure that security requirements are included in the contract and that the third-party vendor is aware of and committed to meeting the organization's security standards. By having security involved in the procurement process, the organization can also ensure that the third-party vendor has adequate security controls in place to protect sensitive information and critical assets. This can include reviewing the vendor's security policies, conducting security assessments, and verifying that the vendor is in compliance with relevant laws and regulations.

   2. M

      mfourati

      2022-12-15

      6 upvotes

      Answer B is completely wrong, communicating the policy to the third party does not grantee the third party will enforce the proper measures

   3. V

      Viperhunter

      2024-09-24

      Selected C1 upvote

      By involving the security team in the procurement process, you can proactively address security concerns from the outset. This allows security professionals to assess the third party's security posture, ensure that security requirements are adequately addressed in the contract, and provide valuable input to the negotiation process. It helps in aligning the security needs of the organization with the contractual agreements, leading to a more secure and compliant relationship with the third party. While other options, such as reviewing the contract with the legal department (option A), communicating security policies with the third-party vendor (option B), and conducting an information security audit (option D) are important steps, involving security in the procurement process is the proactive approach that can prevent security issues before they arise.

   4. B

      Broesweelies

      2023-01-14

      3 upvotes

      Answer is C: Ensure security is involved in the procurement process is the MOST effective way to address an organization's security concerns during contract negotiations with a third party. Involving security in the procurement process allows the organization to assess the security risks associated with a particular vendor or service and to negotiate appropriate security measures into the contract. This can include requirements for data encryption, incident response, and regular security assessments.

3. Question 3 of 25

   Which of the following would BEST enable effective decision-making?

   • AAnnualized loss estimates determined from past security events
   • BA universally applied list of generic threats, impacts, and vulnerabilities
   • CA consistent process to analyze new and historical information risk
   • DFormalized acceptance of risk analysis by business management

   Show answer

   Correct answer: C

   How others answered

   • C76%
   • D24%

   Explanation

   A consistent process to analyze new and historical information risk is also an important factor in enabling effective decision-making. It provides a structured approach for evaluating risk and ensures that all relevant information is taken into account when making decisions. However, without the formalized acceptance of risk analysis by business management, the risk analysis process may not be integrated into the decision-making process of the organization and may not have the necessary influence on decision-making. Therefore D: Formalized acceptance of risk analysis by business management would BEST enable effective decision-making because it ensures that the risk analysis process is integrated into the decision-making process of the organization and that risk is taken into account when making decisions. This helps to ensure that decisions are made with a full understanding of the potential risks and consequences, leading to better and more informed decision-making.

   Adapted from community discussion by ccKane · 2023-02-02 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

   1. C

      ccKane

      2023-02-02

      4 upvotes

      A consistent process to analyze new and historical information risk is also an important factor in enabling effective decision-making. It provides a structured approach for evaluating risk and ensures that all relevant information is taken into account when making decisions. However, without the formalized acceptance of risk analysis by business management, the risk analysis process may not be integrated into the decision-making process of the organization and may not have the necessary influence on decision-making. Therefore D: Formalized acceptance of risk analysis by business management would BEST enable effective decision-making because it ensures that the risk analysis process is integrated into the decision-making process of the organization and that risk is taken into account when making decisions. This helps to ensure that decisions are made with a full understanding of the potential risks and consequences, leading to better and more informed decision-making.

   2. C

      CISM_newbie

      2023-04-05

      4 upvotes

      It's a matter of wording. In order to conduct a consistent process of analyzing new/historical risk info there should first be a formalized acceptance of risk analysis conducted by the business mgt team. Once this is established, than there should be a consistent review, just my thoughts.

   3. B

      Broesweelies

      2023-01-19

      Selected C3 upvotes

      C. A consistent process to analyze new and historical information risk would BEST enable effective decision-making. This allows for the continual assessment and re-evaluation of risks, taking into account new and historical information, in order to make informed and effective decisions about risk management.

   4. B

      bambs

      2023-03-28

      Selected C3 upvotes

      Effective decision-making in information security requires a consistent and repeatable process for analyzing risk. This process should take into account both new and historical information, and should be able to adapt to changing circumstances, such as new threats or changes to the business environment.

4. Question 4 of 25

   During a post-incident review, it was determined that a known vulnerability was exploited in order to gain access to a system. The vulnerability was patched as part of the remediation on the offending system. Which of the following should be done NEXT?

   • AScan to determine whether the vulnerability is present on other systems.
   • BReview the vulnerability management process.
   • CInstall patches an all existing systems.
   • DReport the root cause of the vulnerability to senior management.

   Show answer

   Correct answer: A

   How others answered

   • A78%
   • C22%

   Explanation

   I'm going with A. I get it is a known vulnerability. But option C states " Install patches an all existing systems." The ALL EXISTING SYSTEMS seems excessive because we don't know what all the systems are. Assuming everything is the same is illogical as almost all businesses make use of several different OS, versions, etc... so installing a patch on "ALL EXISITNG SYSTMES" with out scanning to see which ones actually need the patch first seems like a mistake and like it could interrupt the work environment. This is why I pick option A.

   Adapted from community discussion by blehbleh · 2024-07-07 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

   1. B

      blehbleh

      2024-07-07

      Selected A5 upvotes

      I'm going with A. I get it is a known vulnerability. But option C states " Install patches an all existing systems." The ALL EXISTING SYSTEMS seems excessive because we don't know what all the systems are. Assuming everything is the same is illogical as almost all businesses make use of several different OS, versions, etc... so installing a patch on "ALL EXISITNG SYSTMES" with out scanning to see which ones actually need the patch first seems like a mistake and like it could interrupt the work environment. This is why I pick option A.

   2. J

      Jay2021aws

      2024-08-07

      2 upvotes

      Here is what you all are missing if you think that C is correct... Patching all existing systems may break certain functions and render some software unusable for a specific business purpose. That is why a risk assessment needs to be done to determine if patching is the right thing to do in light of the business needs or the organization. Once you scan and find the vulnerability on other systems, it is up to Management to determine whether it should be patched pursuant to their business needs.

   3. S

      SHERLOCKAWS

      2024-06-15

      2 upvotes

      Yes but just because it's a known vulnerability for example for one system why assume that all systems are the same and thus all systems suffer from the same vulnerability? For example a vulnerability could affect all Windows based systems but not Unix based? On the other hand for a known vulnerability you could have an immediate view on which systems suffer from this (e.g using tools like Kenna or Qualys) and then you just need to apply the patch. Can't decide between A and C.

   4. A

      AlexJacobson

      2024-07-29

      2 upvotes

      Agreed! To me, C happens after A. Fire up Nessus/OpenVas/whatever and check other systems for the existence of this vulnerability. Patch all systems that have the vulnerability present. Do NOT apply patch to a system that doesn't have it. You never know if it could have an adverse effect to the OS.

5. Question 5 of 25

   During an internal compliance review, the review team discovers that a critical legacy application is unable to meet the organization's mandatory security requirements. Which of the following should be done FIRST?

   • AUpdate the risk register.
   • BRecommend taking the application out of service.
   • CImplement compensating controls.
   • DMonitor the application until it can be replaced.

   Show answer

   Correct answer: A

   How others answered

   • A86%

   Explanation

   A. Update the risk register. Updating the risk register is the initial action to document and track the identified risk associated with the critical legacy application. This involves recording the non-compliance with mandatory security requirements and assessing the potential impact and likelihood of the risk. Once the risk is documented, the organization can then proceed to determine the most appropriate risk treatment strategy. While options like recommending taking the application out of service (Option B), implementing compensating controls (Option C), and monitoring the application until it can be replaced (Option D) are potential risk treatment strategies, updating the risk register is the foundational step in the risk management process. It ensures that the organization has a clear record of the identified risk and can make informed decisions on how to address it.

   Adapted from community discussion by TamerBeSafe · 2024-01-24 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

   1. T

      TamerBeSafe

      2024-01-24

      Selected A3 upvotes

      A. Update the risk register. Updating the risk register is the initial action to document and track the identified risk associated with the critical legacy application. This involves recording the non-compliance with mandatory security requirements and assessing the potential impact and likelihood of the risk. Once the risk is documented, the organization can then proceed to determine the most appropriate risk treatment strategy. While options like recommending taking the application out of service (Option B), implementing compensating controls (Option C), and monitoring the application until it can be replaced (Option D) are potential risk treatment strategies, updating the risk register is the foundational step in the risk management process. It ensures that the organization has a clear record of the identified risk and can make informed decisions on how to address it.

   2. A

      AlexJacobson

      2024-01-29

      Selected A2 upvotes

      Update the risk register first. This way you can better understand the risk and choose how to treat the risk (like with compensating controls).

   3. Y

      yottabyte

      2024-03-17

      Selected A1 upvote

      update the risk register first and then track it on regular intervals.

   4. S

      shootnot

      2024-04-17

      1 upvote

      First C, if after applying compensating control, the risk is still above the acceptable level, then accept the risk and update the risk register.

6. Question 6 of 25

   Which of the following is the BEST strategy to implement an effective operational security posture?

   • AIncreased security awareness
   • BDefense in depth
   • CThreat management
   • DVulnerability management

   Show answer

   Correct answer: B

   How others answered

   • B81%
   • A19%

   Explanation

   The keyword is a strategy and the only one that does that is (B) Defense in depth as a defense in depth is a strategy of how things should be done and why. As mentioned by MSKid, this means that Defense in Depth includes the rest. Even if the other were strategies... the fact that defense in depth has multiple layers means that it should be able to succeed even if one fails and this is incredibly useful for operations. Rationale: (A) Increased security awareness is a goal/objective (C) Threat management is a process (D) Vulnerability management is a process

   Adapted from community discussion by dark_3k03r · 2023-11-06 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

   1. M

      MSKid

      2023-05-14

      Selected B8 upvotes

      Voting B: Defense in depth does cover awareness training so it would be the best given the choices.

   2. D

      dark_3k03r

      2023-11-06

      Selected B3 upvotes

      The keyword is a strategy and the only one that does that is (B) Defense in depth as a defense in depth is a strategy of how things should be done and why. As mentioned by MSKid, this means that Defense in Depth includes the rest. Even if the other were strategies... the fact that defense in depth has multiple layers means that it should be able to succeed even if one fails and this is incredibly useful for operations. Rationale: (A) Increased security awareness is a goal/objective (C) Threat management is a process (D) Vulnerability management is a process

   3. C

      Cyberbug2021

      2024-05-21

      Selected B1 upvote

      The answer is B. Defense in depth. Defense in depth is a security strategy that involves layering multiple security controls at different stages of an attack to provide redundancy and make it more difficult for attackers to succeed. This strategy is often compared to peeling an onion, as each layer of defense must be breached before the attacker can reach the core asset. Here's why the other options are not as effective: A. Increased security awareness: While security awareness is important, it is not a standalone strategy for implementing an effective operational security posture. It needs to be combined with other security controls to provide a comprehensive defense.

   4. O

      oluchecpoint

      2024-07-26

      Selected B2 upvotes

      B. Defense in depth Defense in depth is considered the best strategy to implement an effective operational security posture. This approach involves layering multiple security measures and controls throughout an organization's infrastructure to provide multiple layers of protection. It goes beyond any single point of failure and helps mitigate various types of threats and vulnerabilities.

7. Question 7 of 25

   An incident management team leader sends out a notification that the organization has successfully recovered from a cyberattack. Which of the following should be done NEXT?

   • ASecure and preserve digital evidence for analysis.
   • BGather feedback on business impact.
   • CConduct a meeting to capture lessons learned.
   • DPrepare an executive summary for senior management.

   Show answer

   Correct answer: C

   How others answered

   • C75%
   • A25%

   Explanation

   securing and preserving digital evidence for analysis (Option A) is important, but it typically occurs earlier in the incident response process. Correct answer is C.

   Adapted from community discussion by SHERLOCKAWS · 2023-12-11 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

   1. S

      SHERLOCKAWS

      2023-12-11

      6 upvotes

      securing and preserving digital evidence for analysis (Option A) is important, but it typically occurs earlier in the incident response process. Correct answer is C.

   2. K

      koala_lay

      2023-12-12

      Selected C1 upvote

      Conducting a meeting to capture lessons learned as the next step after a notification is sent out stating that the organization has successfully recovered from a cyberattack. This meeting will allow the incident management team to gather insights and feedback on the incident response process, identify any areas for improvement, and share best practices for future incidents. It is important to capture these lessons learned while the incident is still fresh in everyone's minds to ensure that the organization can better prepare and respond to any future cyberattacks. Once the lessons learned have been captured, the team can proceed with securing and preserving digital evidence for analysis, gathering feedback on business impact, and preparing an executive summary for senior management.

   3. B

      Booict

      2024-07-22

      2 upvotes

      C - After an incident, it’s crucial to analyze what went well and what could be improved. A lessons-learned meeting helps identify areas for enhancement, update incident response procedures, and enhance overall resilience. A is important too, BUT it’s typically done during the incident response process, not immediately after recovery.

   4. D

      d3fa4d2

      2024-04-23

      Selected C1 upvote

      Option A should be done before sending email that recovery is complete. How can you recover without finding root cause and identifying entry point of malware and blocking it from happening again.

8. Question 8 of 25

   Which of the following defines the MOST comprehensive set of security requirements for a newly developed information system?

   • ABaseline controls
   • BAudit findings
   • CRisk assessment results
   • DKey risk indicators (KRIs)

   Show answer

   Correct answer: C

   How others answered

   • C50%
   • A50%

   Only 50% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Baseline controls are applied for a group of IT systems. Since the question is asking about the most comprehensive controls, I would go for C, since a risk assessment specifically addresses a systems risk.

   Adapted from community discussion by Josef4CISM · 2025-01-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

   1. K

      koala_lay

      2023-12-12

      Selected C1 upvote

      The most comprehensive set of security requirements for a newly developed information system would be defined by C. Risk assessment results. Risk assessment is a systematic process of identifying, analyzing, and evaluating potential risks to determine the effectiveness of existing security controls and identify any additional security requirements that may be necessary. By analyzing the results of a risk assessment, one can determine the specific security measures and controls needed to protect the information system effectively.

   2. J

      Josef4CISM

      2025-01-20

      Selected C2 upvotes

      Baseline controls are applied for a group of IT systems. Since the question is asking about the most comprehensive controls, I would go for C, since a risk assessment specifically addresses a systems risk.

   3. S

      SHERLOCKAWS

      2025-03-29

      Selected C1 upvote

      Answer is C: Risk assessment results. Because they offer a complete, context-driven foundation for defining security requirements that are relevant, justifiable, and aligned with organizational risk posture. Baseline controls are valuable and necessary, but they are not enough on their own to define the most comprehensive security requirements. A risk assessment ensures controls are justified, appropriate, and aligned to business needs

   4. U

      Uncle_Lucifer

      2023-12-06

      Selected C2 upvotes

      Risk assessment first, before developing Baseline controls. You cannot apply controls blindly without knowing what needs it

9. Question 9 of 25

   Which of the following is a viable containment strategy for a distributed denial of service (DDoS) attack?

   • ABlock IP addresses used by the attacker.
   • BDisable firewall ports exploited by the attacker.
   • CPower oft affected servers.
   • DRedirect the attacker's traffic.

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   A viable containment strategy for a distributed denial of service (DDoS) attack is to D. redirect the attacker's traffic. Redirecting the attacker's traffic involves rerouting the malicious traffic away from the target servers or network infrastructure. This can be done by implementing techniques such as traffic scrubbing or utilizing specialized DDoS mitigation services. By redirecting the attacker's traffic, the impact on the targeted servers or network is minimized, allowing legitimate traffic to flow smoothly.

   Adapted from community discussion by koala_lay · 2024-06-12 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

   1. K

      koala_lay

      2024-06-12

      Selected D4 upvotes

      A viable containment strategy for a distributed denial of service (DDoS) attack is to D. redirect the attacker's traffic. Redirecting the attacker's traffic involves rerouting the malicious traffic away from the target servers or network infrastructure. This can be done by implementing techniques such as traffic scrubbing or utilizing specialized DDoS mitigation services. By redirecting the attacker's traffic, the impact on the targeted servers or network is minimized, allowing legitimate traffic to flow smoothly.

   2. B

      blehbleh

      2024-07-13

      Selected D2 upvotes

      I get the idea behind A but is says distributed denial of service (DDOS) attack. We don't know how many IPs are being utilized or the size of the attack. Therefore redirecting the attack would be simpler than trying to block each IP that we associate with the attack.

   3. U

      Uncle_Lucifer

      2024-06-06

      Selected D2 upvotes

      don't mistake containment with preventive measures. Blocking IP will prevent attack but not contain it Redirecting it contains the attack, gives you time to analyze the issue

   4. A

      AlexJacobson

      2024-07-29

      Selected D1 upvote

      Redirect traffic to a "black hole". Blackholing involves redirecting traffic to a “black hole” or null route, which drops all traffic to the targeted IP address or range. This technique is used to prevent malicious traffic from reaching the targeted network or system during a DDoS attack.

10. Question 10 of 25

    In a cloud technology environment, which of the following would pose the GREATEST challenge to the investigation of security incidents?

    • ANon-standard event logs
    • BAccess to the hardware
    • CData encryption
    • DCompressed customer data

    Show answer

    Correct answer: B

    How others answered

    • B59%
    • A41%

    Only 59% agreed on this answer — treat it as contested rather than settled.

    Explanation

    CISM AIO 2nd - "Acquiring Additional Hardware" section gives a good chart (7-7 Table) on pro's and con's as to why this answer is correct given the options

    Adapted from community discussion by MSKid · 2022-11-14 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. M

       MSKid

       2022-11-14

       Selected B8 upvotes

       CISM AIO 2nd - "Acquiring Additional Hardware" section gives a good chart (7-7 Table) on pro's and con's as to why this answer is correct given the options

    2. C

       CISSPST

       2023-09-21

       6 upvotes

       I mostly agree with your explanation for the wrong answers. B is the correct answer, but not because of the difficulty of acquiring additional hardware, because the question is specifically talking about investigation, not recovery. Unless it is a private cloud environment (and sometimes even if it is), taking bit-for-bit copy of hard-disk for instance may not be allowed because the resources are shared.

    3. H

       helg420

       2024-05-08

       Selected B2 upvotes

       B. Access to the hardware In a cloud technology environment, one of the greatest challenges to the investigation of security incidents is access to the hardware. Cloud environments typically abstract the hardware layer from users, which means that customers do not have direct access to the physical servers, network equipment, or storage devices where their data is processed and stored. This limitation can significantly impede forensic investigations, as investigators may require physical access to gather evidence, analyze hardware configurations, or perform other forensic tasks that are simply not possible in a cloud setting where the infrastructure is managed by a service provider.

    4. S

       Saisharan

       2023-05-29

       3 upvotes

       While access to hardware is a significant challenge, the lack of standardized and consistent event logs (Option A) is generally considered a more pervasive and widespread challenge in cloud environments, as it affects multiple aspects of incident investigation and analysis. So Option would be A

11. Question 11 of 25

    Which of the following is MOST important when selecting an information security metric?

    • AEnsuring the metric is repeatable
    • BAligning the metric to the IT strategy
    • CDefining the metric in qualitative terms
    • DDefining the metric in quantitative terms

    Show answer

    Correct answer: B

    How others answered

    • B46%
    • A31%
    • D23%

    Only 46% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Ensuring repeatability is important when selecting an information security metric, but it is not the most important factor. Repeatable metrics provide consistent and reliable data, which is crucial for tracking progress over time and making comparisons. However, repeatability alone is not enough to ensure that the metric is useful and meaningful. Aligning the metric to the IT strategy and ensuring that it supports the overall objectives of the organization is more critical, as this will ensure that the metric provides relevant and valuable information that can be used to drive meaningful improvements in information security.

    Adapted from community discussion by Broesweelies · 2023-02-05 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. B

       Broesweelies

       2023-02-05

       Selected B10 upvotes

       Ensuring repeatability is important when selecting an information security metric, but it is not the most important factor. Repeatable metrics provide consistent and reliable data, which is crucial for tracking progress over time and making comparisons. However, repeatability alone is not enough to ensure that the metric is useful and meaningful. Aligning the metric to the IT strategy and ensuring that it supports the overall objectives of the organization is more critical, as this will ensure that the metric provides relevant and valuable information that can be used to drive meaningful improvements in information security.

    2. A

       angellorv

       2024-05-11

       6 upvotes

       (A) ISACA CISM 15ed Review Manuan Section 1.6.1: Effective Security Metrics (SMART CRAAP): Specific, Measurable, Attainable, Relevant, Timely, Cost-effective, Repeatable, Accurate, Actionable, Predictive

    3. C

       CISSPST

       2023-09-21

       5 upvotes

       I respectfully disagree. A security metric should align to business strategy, but not every security metric need align to IT strategy. For example, security resource management (metric: cost per user for security services) is integral to business strategy but is not impacted by and does not impact IT strategy. Answer is Repeatability.

    4. S

       sphenixfire

       2023-09-08

       Selected B3 upvotes

       I would say A but AIO 2nd means B A formal metrics program provides qualitative and quantitative data on the effective- ness of many elements of an organization’s security program and operations. Metrics can be developed via the SMART method: specific, measurable, attainable, relevant, and timely. Metrics must align with the organization’s mission, strategy, and objectives. Some metrics can be used to report on results in the recent past, but some metrics should serve as leading indicators or drive a call to action by the leadership team

12. Question 12 of 25

    Which of the following is the BEST way for an information security manager to justify ongoing annual maintenance fees associated with an intrusion prevention system (IPS)?

    • AEstablish and present appropriate metrics that track performance.
    • BPerform industry research annually and document the overall ranking of the IPS.
    • CPerform a penetration test to demonstrate the ability to protect.
    • DProvide yearly competitive pricing to illustrate the value of the IPS.

    Show answer

    Correct answer: A

    How others answered

    • A79%
    • C21%

    Explanation

    A. Establish and present appropriate metrics that track performance. The best way for an information security manager to justify ongoing annual maintenance fees associated with an intrusion prevention system (IPS) is to establish and present appropriate metrics that track the system's performance. This approach demonstrates the tangible value of the IPS and its effectiveness in protecting the organization's network and data. By using metrics related to the system's performance, such as the number of detected and blocked intrusion attempts, reduction in security incidents, or the cost savings resulting from prevented breaches, the manager can provide concrete evidence of the IPS's impact on security.

    Adapted from community discussion by oluchecpoint · 2023-09-02 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. O

       oluchecpoint

       2023-09-02

       3 upvotes

       A. Establish and present appropriate metrics that track performance. The best way for an information security manager to justify ongoing annual maintenance fees associated with an intrusion prevention system (IPS) is to establish and present appropriate metrics that track the system's performance. This approach demonstrates the tangible value of the IPS and its effectiveness in protecting the organization's network and data. By using metrics related to the system's performance, such as the number of detected and blocked intrusion attempts, reduction in security incidents, or the cost savings resulting from prevented breaches, the manager can provide concrete evidence of the IPS's impact on security.

    2. C

       CISSPST

       2023-09-21

       4 upvotes

       PenTest is just a snapshot in time of the system's effectiveness but tracking the system's performance (e.g. no. of incidents prevented successfully and impact to business if the incidents were not prevented) gives more visibility to the RoI on the TCO. Correct answer is A.

    3. M

       mad68

       2022-11-14

       Selected A3 upvotes

       Establishing and presenting appropriate metrics that track performance is the only way to justify the cost, a penetration test only shows it works and can be used in the metrics.

    4. R

       richck102

       2023-05-25

       2 upvotes

       A. Establish and present appropriate metrics that track performance.

13. Question 13 of 25

    An organization wants to enable digital forensics for a business-critical application. Which of the following will BEST help to support this objective?

    • AInstall biometric access control.
    • BDevelop an incident response plan.
    • CDefine data retention criteria.
    • DEnable activity logging.

    Show answer

    Correct answer: D

    How others answered

    • D88%

    Explanation

    Enabling activity logging would be the BEST option to support digital forensics for a business-critical application. Activity logging allows for detailed tracking of user actions within the application, which can be invaluable for forensic analysis in the event of an incident or security breach. The other options may be important for overall security and incident response, but are not specifically focused on supporting digital forensics.

    Adapted from community discussion by mad68 · 2023-11-09 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. M

       mad68

       2023-11-09

       Selected D7 upvotes

       Enabling activity logging would be the BEST option to support digital forensics for a business-critical application. Activity logging allows for detailed tracking of user actions within the application, which can be invaluable for forensic analysis in the event of an incident or security breach. The other options may be important for overall security and incident response, but are not specifically focused on supporting digital forensics.

    2. P

       Prospect57

       2023-07-15

       2 upvotes

       To add, forensics is concerned with chain of custody and knowing who did what at what times. If there was an incident caused by someone, a forensic analyst needs to know when they did it, what device, what they accessed, etc. So it makes sense that D would be the answer here.

    3. D

       Dravidian

       2023-10-17

       2 upvotes

       I see how this would be D but wouldn't D be a part of the incident response plan with is B?

    4. O

       oluchecpoint

       2024-03-02

       1 upvote

       D. Enabling activity logging, on the other hand, is a proactive step to capture relevant information that can be invaluable when investigating security incidents or breaches within the business-critical application.

14. Question 14 of 25

    An employee clicked on a link in a phishing email, triggering a ransomware attack. Which of the following should be the information security manager's FIRST step?

    • ANotify internal legal counsel.
    • BIsolate the impacted endpoints.
    • CWipe the affected system.
    • DNotify senior management.

    Show answer

    Correct answer: B

    How others answered

    • B50%
    • D50%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    B. Isolate the impacted endpoints. Isolating the impacted endpoints should be the information security manager's FIRST step upon discovering that a ransomware attack has been triggered by an employee clicking on a link in a phishing email. This action is essential to prevent the ransomware from spreading further across the organization's network, thereby containing the attack and minimizing potential damage. Isolating affected systems helps in protecting unaffected resources and is a critical step in managing and mitigating the incident effectively. While senior management's involvement and guidance are essential, especially in handling communications, legal considerations, and overarching organizational responses, the urgency of containing the ransomware attack to minimize its impact dictates that notifying senior management should follow after initial containment efforts have been initiated. This approach aligns with incident response best practices that prioritize immediate actions to secure the organization’s IT environment.

    Adapted from community discussion by helg420 · 2024-05-08 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. H

       helg420

       2024-05-08

       Selected B2 upvotes

       B. Isolate the impacted endpoints. Isolating the impacted endpoints should be the information security manager's FIRST step upon discovering that a ransomware attack has been triggered by an employee clicking on a link in a phishing email. This action is essential to prevent the ransomware from spreading further across the organization's network, thereby containing the attack and minimizing potential damage. Isolating affected systems helps in protecting unaffected resources and is a critical step in managing and mitigating the incident effectively. While senior management's involvement and guidance are essential, especially in handling communications, legal considerations, and overarching organizational responses, the urgency of containing the ransomware attack to minimize its impact dictates that notifying senior management should follow after initial containment efforts have been initiated. This approach aligns with incident response best practices that prioritize immediate actions to secure the organization’s IT environment.

    2. A

       Adabach

       2025-02-19

       Selected B2 upvotes

       B > D > A > C > (+). Noting that it's the ISSM who is responding, "Stop the bleeding," B. Isolate the impacted end-points, ("cyber tourniquet") and take the system completely off line. Scan all other systems on the shared NW for the signatures. Then, D, "notify senior management" as well as all stakeholders with interconnecting systems and Interconnect Security Agreements (ISA). Then A, "notify internal legal counsel." If a backup (incremental or full) exists, then, C, "wipe the affected system" and restore to the last-known-good restore-point. (+) Scan the restored system before placing it back on the NW. Test it. Monitor the port traffic. Review awareness training and re-train the employee(s).

    3. D

       dark_3k03r

       2023-05-06

       3 upvotes

       he will not be doing the isolation himself, but instead instructing his direct reports to do it. From there he will reach out to management. But simply not telling their analyst to stop it will allow the problem to go unabated.

    4. [

       [Removed]

       2023-06-24

       3 upvotes

       after confirming an incident, the second step is always containment.

15. Question 15 of 25

    A recent audit found that an organization's new user accounts are not set up uniformly. Which of the following is MOST important for the information security manager to review?

    • ASecurity policies
    • BAutomated controls
    • CGuidelines
    • DStandards

    Show answer

    Correct answer: D

    How others answered

    • D78%
    • A22%

    Explanation

    The correct answer is D: Standards The reason for this as followed: (a) Security policies - dictate what must be done, but not how. This leaves it open to interpretation and thus the possibilities for inconsistencies. (b) Automated Control do make things consistent, but this is not the security manager's role. This is a tech solution. (c) Guidelines are suggestions, not mandatory things to do, and thus can result in inconsistencies. (d) Standard make things mandatory and consistent. Thus why it's the correct answer.

    Adapted from community discussion by dark_3k03r · 2023-10-08 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. D

       dark_3k03r

       2023-10-08

       Selected D11 upvotes

       The correct answer is D: Standards The reason for this as followed: (a) Security policies - dictate what must be done, but not how. This leaves it open to interpretation and thus the possibilities for inconsistencies. (b) Automated Control do make things consistent, but this is not the security manager's role. This is a tech solution. (c) Guidelines are suggestions, not mandatory things to do, and thus can result in inconsistencies. (d) Standard make things mandatory and consistent. Thus why it's the correct answer.

    2. M

       Maccaoidh

       2023-10-17

       Selected D5 upvotes

       Policies should not include procedures (that question comes up routinely). Uniformity of creating user accounts would be listed under a procedure.

    3. S

       Seasondream

       2023-10-13

       Selected D3 upvotes

       Standards are specific technical applications of something to be implemented. For example you will make accounts utilizing XYZ. Policies are vague and do not have technical jargon. For example "Sensitive data must be protected" is something in a policy. If you changed it to say "Sensitive data will be protected using high end encryption and MFA" that's a standard

    4. C

       CarlPTY07

       2023-09-18

       Selected D2 upvotes

       This is about proper configurations. So its D. Standards: An organization’s security standards describe, in detail, the methods, techniques, technologies, specifications, brands, and configurations to be used throughout the organization. Gregory, Peter H.; Gregory, Peter H.. CISM Certified Information Security Manager Bundle (p. 115). McGraw Hill LLC. Kindle Edition.

16. Question 16 of 25

    Which of the following is MOST important for effective cybersecurity incident management?

    • AEarly detection and response
    • BRegular tabletop exercises
    • CRoot cause analysis
    • DInvestigation and forensics

    Show answer

    Correct answer: A

    How others answered

    • A80%
    • B20%

    Explanation

    If refer to effective incident management, then it is identify and response. The faster it detect and better procedure or incident classification , the better to minimise risk.

    Adapted from community discussion by afoo1314 · 2024-08-27 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. A

       afoo1314

       2024-08-27

       Selected A3 upvotes

       If refer to effective incident management, then it is identify and response. The faster it detect and better procedure or incident classification , the better to minimise risk.

    2. B

       Booict

       2024-07-16

       2 upvotes

       A - Swiftly identifying and containing incidents minimizes damage. Timely response prevents further compromise and limits impact. Early detection reduces recovery time and costs.

    3. S

       shootnot

       2024-04-18

       2 upvotes

       A- without effective 'A' all other options are useless and may not even kick in.

    4. P

       Pichon

       2025-03-16

       Selected A1 upvote

       Siem, edr, ndr, are most important for incident management, its all about speed, early detection

17. Question 17 of 25

    Which of the following metrics is the BEST measure of the effectiveness of an information security program?

    • AReduction in the amount of risk exposure in an organization
    • BReduction in the number of threats to an organization
    • CReduction in the cost of risk remediation for an organization
    • DReduction in the number of vulnerabilities in an organization

    Show answer

    Correct answer: A

    How others answered

    • A75%
    • C25%

    Explanation

    Both ChatGPT and Bard have stated that Risk Exposure is the correct answer since that is the ultimate goal of the organization. The following answers are incorrect for the following reasons: (B) Threat may increase or decrease due to environmental factors outside of the program's control. (C) The Cost of remediation is inherently hard to predict as every incident will be different. (D) Vulnerabilities are subject to changes in the environment and the numbers will fluctuate regardless of the security program in place and thus is not a good place to get numbers from.

    Adapted from community discussion by dark_3k03r · 2023-10-08 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. D

       dark_3k03r

       2023-10-08

       Selected A4 upvotes

       Both ChatGPT and Bard have stated that Risk Exposure is the correct answer since that is the ultimate goal of the organization. The following answers are incorrect for the following reasons: (B) Threat may increase or decrease due to environmental factors outside of the program's control. (C) The Cost of remediation is inherently hard to predict as every incident will be different. (D) Vulnerabilities are subject to changes in the environment and the numbers will fluctuate regardless of the security program in place and thus is not a good place to get numbers from.

    2. O

       oluchecpoint

       2024-03-02

       3 upvotes

       A. Measuring the reduction in risk exposure considers the holistic impact of security efforts, including vulnerability management, threat detection and response, and risk mitigation strategies. It aligns with the primary goal of information security, which is to manage and reduce risk to an acceptable level. Therefore, it is considered the most comprehensive and meaningful measure of the effectiveness of an information security program.

    3. A

       AlexJacobson

       2024-07-20

       Selected A2 upvotes

       I would also say it's A. Since risk exposure is a measure of possible future loss which may result from an activity or occurrence. In business, risk exposure is often used to rank the probability of different types of losses and to determine which losses are acceptable or unacceptable. So if infosec program manages to reduce to losses, it directly provided value to the business.

    4. R

       richck102

       2023-11-25

       2 upvotes

       A. Reduction in the amount of risk exposure in an organization

18. Question 18 of 25

    Which of the following functions is MOST critical when initiating the removal of system access for terminated employees?

    • AHelp desk
    • BLegal
    • CInformation security
    • DHuman resources (HR)

    Show answer

    Correct answer: D

    How others answered

    • D69%
    • C31%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    why not Information Security? Human resources (HR) is an important function when initiating the removal of system access for terminated employees, as they are responsible for managing employee information and communication, including the termination process. However, the MOST critical function is still information security. Information security is responsible for ensuring the confidentiality, integrity, and availability of sensitive information, and the removal of system access for terminated employees is a critical step in maintaining the security of this information. Information security must ensure that all necessary steps are taken to remove the terminated employee's access to sensitive information, including revoking all user accounts, disabling access to systems and applications, and removing any network access privileges. Help desk and legal functions may also be involved in the process, but their role is secondary to that of information security in ensuring the security of sensitive information.

    Adapted from community discussion by ccKane · 2023-08-02 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. B

       bambs

       2023-09-29

       Selected D6 upvotes

       When an employee is terminated, HR is responsible for notifying the appropriate personnel, including the information security team, to initiate the removal of system access for the terminated employee. This is critical to prevent unauthorized access to sensitive company data and systems, which could result in data breaches, intellectual property theft, and other security incidents.

    2. C

       ccKane

       2023-08-02

       4 upvotes

       why not Information Security? Human resources (HR) is an important function when initiating the removal of system access for terminated employees, as they are responsible for managing employee information and communication, including the termination process. However, the MOST critical function is still information security. Information security is responsible for ensuring the confidentiality, integrity, and availability of sensitive information, and the removal of system access for terminated employees is a critical step in maintaining the security of this information. Information security must ensure that all necessary steps are taken to remove the terminated employee's access to sensitive information, including revoking all user accounts, disabling access to systems and applications, and removing any network access privileges. Help desk and legal functions may also be involved in the process, but their role is secondary to that of information security in ensuring the security of sensitive information.

    3. J

       Jess20

       2024-05-12

       Selected D3 upvotes

       D: CISM AIO 2nd: "Offboarding HR is responsible for processing the termination, or offboarding, of employees who are leaving the organization for any reason. HR is responsible for ensuring that security, IT, and other departments are notified of the termination so that all access rights can be terminated at the appropriate time."

    4. O

       oluchecpoint

       2024-07-26

       Selected D1 upvote

       HR plays a significant role in the termination process, including notifying IT or the relevant departments about employee terminations. However, HR may not have the technical expertise or direct control over system access. They rely on IT and information security to carry out access removal procedures effectively.

19. Question 19 of 25

    An online trading company discovers that a network attack has penetrated the firewall. What should be the information security manager's FIRST response?

    • AEvaluate the impact to the business.
    • BExamine firewall logs to identify the attacker.
    • CNotify the regulatory agency of the incident.
    • DImplement mitigating controls.

    Show answer

    Correct answer: A

    How others answered

    • A69%
    • D31%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The first part of the IR process is identifying and assessing the current state. An't do this without doing A. So (A) is the correct answer. Rationale: B. Knowing the attacker is great for attribution, but does little to address the issue C. This should only be done once the threat/impact is fully understood D. This should only be done once the threat/impact is fully understood

    Adapted from community discussion by dark_3k03r · 2023-04-11 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • isaca.org documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. D

       dark_3k03r

       2023-04-11

       Selected A5 upvotes

       The first part of the IR process is identifying and assessing the current state. An't do this without doing A. So (A) is the correct answer. Rationale: B. Knowing the attacker is great for attribution, but does little to address the issue C. This should only be done once the threat/impact is fully understood D. This should only be done once the threat/impact is fully understood

    2. R

       Rowlandmarc

       2023-02-27

       Selected A3 upvotes

       Following ISACA's own model below - A is the logical answer as it follows the analysis of the incident https://www.isaca.org/resources/isaca-journal/issues/2020/volume-4/incident-response-models Preparation Detection and analysis Containment, eradication and recovery Postincident activity

    3. C

       chanke

       2023-06-09

       Selected A3 upvotes

       Remember before you do anything like transfer, mitigate or etc... you need to evaluate the risk First to see how impactful it is to the business.

    4. A

       AaronS1990

       2023-08-15

       4 upvotes

       Nope, you're wrong again. No surprise really seeing as all you're capable of is using chatGPT

20. Question 20 of 25

    Which of the following BEST prepares a computer incident response team for a variety of information security scenarios?

    • ATabletop exercises
    • BForensics certification
    • CPenetration tests
    • DDisaster recovery drills

    Show answer

    Correct answer: A

    How others answered

    • A87%

    Explanation

    Tabletop exercises are simulated, interactive sessions where team members discuss and role-play their responses to various security incidents. These exercises help the incident response team practice and refine their incident response plans, communication strategies, and decision-making processes in a controlled environment. Tabletop exercises are valuable for preparing teams to handle a range of information security scenarios without the actual impact or disruption that may occur during live incidents. While options like forensics certification (option B), penetration tests (option C), and disaster recovery drills (option D) are important for specific aspects of information security, tabletop exercises offer a holistic approach to testing and improving the overall incident response capabilities of a team.

    Adapted from community discussion by Viperhunter · 2024-11-20 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • isaca.org documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. E

       EZPASS

       2023-11-07

       Selected A4 upvotes

       A is the correct answer. . Disaster Recovery Drills organization’s method of regaining access and functionality to its IT infrastructure after events like a "natural disaster". . Tabletop exercises are a comprehensive set of resources designed to assist stakeholders in conducting their own exercises and to initiate discussions within their organizations about their ability to address a "variety of threat scenarios".

    2. V

       Viperhunter

       2024-11-20

       Selected A2 upvotes

       Tabletop exercises are simulated, interactive sessions where team members discuss and role-play their responses to various security incidents. These exercises help the incident response team practice and refine their incident response plans, communication strategies, and decision-making processes in a controlled environment. Tabletop exercises are valuable for preparing teams to handle a range of information security scenarios without the actual impact or disruption that may occur during live incidents. While options like forensics certification (option B), penetration tests (option C), and disaster recovery drills (option D) are important for specific aspects of information security, tabletop exercises offer a holistic approach to testing and improving the overall incident response capabilities of a team.

    3. J

       jaiz

       2024-03-06

       Selected A2 upvotes

       Tabletop exercises are discussion-based and evaluate the effectiveness of an organization's plans, policies, and procedures in a hypothetical scenario. Disaster recovery drills are hands-on and involve testing actual recovery procedures to ensure they can be executed successfully in a real-world scenario.

    4. I

       inno

       2024-02-23

       2 upvotes

       I think it's D. Running through an actual scenario is more effective than discussing about it.

21. Question 21 of 25

    Which of the following would be MOST useful to help senior management understand the status of information security compliance?

    • AKey performance indicators (KPIs)
    • BRisk assessment results
    • CIndustry benchmarks
    • DBusiness impact analysis (BIA) results

    Show answer

    Correct answer: A

    How others answered

    • A69%
    • B31%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A. Key performance indicators (KPIs) would be MOST useful to help senior management understand the status of information security compliance. KPIs are metrics that are used to measure the performance of specific aspects of an organization's security program, such as the effectiveness of security controls, incident response times, and compliance with regulations and standards. These metrics can be presented in an easy-to-understand format, making it easier for senior management to understand the status of the organization's compliance efforts. Risk assessment results, industry benchmarks, and Business Impact Analysis (BIA) results can also provide important information but presenting it in a KPI format can make it easily understandable for senior management.

    Adapted from community discussion by Broesweelies · 2023-01-15 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • isaca.org documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. B

       Broesweelies

       2023-01-15

       Selected A4 upvotes

       A. Key performance indicators (KPIs) would be MOST useful to help senior management understand the status of information security compliance. KPIs are metrics that are used to measure the performance of specific aspects of an organization's security program, such as the effectiveness of security controls, incident response times, and compliance with regulations and standards. These metrics can be presented in an easy-to-understand format, making it easier for senior management to understand the status of the organization's compliance efforts. Risk assessment results, industry benchmarks, and Business Impact Analysis (BIA) results can also provide important information but presenting it in a KPI format can make it easily understandable for senior management.

    2. V

       Viperhunter

       2023-11-20

       Selected A1 upvote

       Key performance indicators (KPIs) are measurable metrics that provide a clear and concise way to communicate the status of information security compliance to senior management. KPIs can include metrics related to policy adherence, incident response effectiveness, vulnerability management, and other aspects of the organization's information security program. Using KPIs allows senior management to quickly grasp the current state of compliance and make informed decisions based on measurable data. While risk assessment results (option B), industry benchmarks (option C), and business impact analysis (BIA) results (option D) are valuable for various aspects of information security management, KPIs are specifically designed to provide a snapshot of the performance and compliance status, making them a more focused and direct communication tool for senior management.

    3. P

       Patt70

       2023-06-26

       3 upvotes

       Answer is A . To understand better read the article here - https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2020/how-to-involve-senior-management-in-the-information-security-governance-process

    4. Q

       Q_K

       2023-03-02

       Selected A2 upvotes

       https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2020/how-to-involve-senior-management-in-the-information-security-governance-process

22. Question 22 of 25

    Which of the following BEST conveys minimum information security requirements to an organization in alignment with policies?

    • AProcedures
    • BRegulations
    • CBaselines
    • DStandards

    Show answer

    Correct answer: D

    How others answered

    • D65%
    • C35%

    Only 65% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Standards convey minimum information security requirements to an organization in alignment with policies. Standards are a set of guidelines, protocols, and best practices that an organization must adhere to in order to meet a certain level of security. They are established by a recognized authority and can be mandatory or voluntary. Standards provide a framework for an organization to develop and implement their own security policies, procedures, and controls. Baselines, regulations, and procedures are also important components of an organization's security program, but standards provide the minimum requirements that must be met.

    Adapted from community discussion by Broesweelies · 2023-01-28 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • isaca.org documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. B

       Broesweelies

       2023-01-28

       Selected D3 upvotes

       Standards convey minimum information security requirements to an organization in alignment with policies. Standards are a set of guidelines, protocols, and best practices that an organization must adhere to in order to meet a certain level of security. They are established by a recognized authority and can be mandatory or voluntary. Standards provide a framework for an organization to develop and implement their own security policies, procedures, and controls. Baselines, regulations, and procedures are also important components of an organization's security program, but standards provide the minimum requirements that must be met.

    2. P

       POWNED

       2024-01-03

       Selected D3 upvotes

       From ISACA there are the following: Policy, Control Objectives, standards, guidelines, and procedures. This eliminates B and C. Standards are defined as Established requirements in regard to processes, actions & configurations, also called baselines. Answer is D.

    3. S

       Soleandheel

       2023-11-22

       4 upvotes

       D. Standards is the correct answer. Standards always align with policy while Baselines are related to configurations and they are used to support the standard policies.

    4. 6

       6and0

       2023-09-18

       Selected D2 upvotes

       This is used as a specification to follow when applying policies and may dictate mandatory requirements. https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2020/differentiating-key-terms-in-the-information-security-hierarchy

23. Question 23 of 25

    An organization plans to utilize Software as a Service (SaaS) and is in the process of selecting a vendor. What should the information security manager do FIRST to support this initiative?

    • AReview independent security assessment reports for each vendor.
    • BBenchmark each vendor's services with industry best practices.
    • CDefine information security requirements and processes.
    • DAnalyze the risks and propose mitigating controls.

    Show answer

    Correct answer: C

    How others answered

    • C64%
    • A25%

    Only 64% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Defining information security requirements and processes is the first step that the information security manager should take when supporting the organization's use of Software as a Service (SaaS). This is because it sets the foundation for the selection of a SaaS vendor that meets the organization's security needs and expectations. Without clear security requirements and processes, it may be difficult to determine the level of security that each vendor can provide, or to assess the suitability of each vendor for the organization's specific needs. By establishing the security requirements and processes first, the information security manager can ensure that the selection of a SaaS vendor aligns with the organization's overall information security strategy.

    Adapted from community discussion by Broesweelies · 2023-01-29 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • isaca.org documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. B

       Broesweelies

       2023-01-29

       Selected C6 upvotes

       Defining information security requirements and processes is the first step that the information security manager should take when supporting the organization's use of Software as a Service (SaaS). This is because it sets the foundation for the selection of a SaaS vendor that meets the organization's security needs and expectations. Without clear security requirements and processes, it may be difficult to determine the level of security that each vendor can provide, or to assess the suitability of each vendor for the organization's specific needs. By establishing the security requirements and processes first, the information security manager can ensure that the selection of a SaaS vendor aligns with the organization's overall information security strategy.

    2. A

       AlexJacobson

       2024-01-25

       Selected C2 upvotes

       Damn...another one... So let's see... Looking at the scenario, the most logical sequence of things should be C, A, D, A. I guess if we're still in the process of selecting a vendor, that means nothing's really decided yet so first you figure out the security requirements and processes and based on that you start checking the vendors (through independent audit reports, so as objective as possible). Then when you understand all the risks with each vendor you propose mitigation. And lastly you do security monitoring of vendors services through security benchmarks.

    3. 6

       6and0

       2023-09-18

       Selected C1 upvote

       Once you have identified which processes can be outsourced as well as their inherent risks, you can begin performing due diligence on potential vendors. The level of due diligence should be tailored to the significance of the relationship as well as the potential risks it poses. Document your requirements and request prospective vendors to address each item directly https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2019/third-party-vendor-selection-if-done-right-its-a-win-win

    4. O

       oluchecpoint

       2023-09-09

       Selected C1 upvote

       Defining information security requirements and processes should be the initial step to ensure that the organization's specific security needs are understood and can serve as a foundation for subsequent activities such as risk analysis, benchmarking, and vendor assessment

24. Question 24 of 25

    When establishing metrics for an information security program, the BEST approach is to identify indicators that:

    • Asupport major information security initiatives.
    • Breflect the corporate risk culture.
    • Creduce information security program spending.
    • Ddemonstrate the effectiveness of the security program.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    D. demonstrate the effectiveness of the security program. When establishing metrics for an information security program, the BEST approach is to identify indicators that demonstrate the effectiveness of the security program. These metrics should measure the performance of the security controls in place, such as incident response time, vulnerability management, compliance with standards and regulations, and the overall effectiveness of the security program. By using these metrics, the organization can see how well the security program is working and make necessary adjustments.

    Adapted from community discussion by Broesweelies · 2024-01-15 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • isaca.org documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. B

       Broesweelies

       2024-01-15

       Selected D6 upvotes

       D. demonstrate the effectiveness of the security program. When establishing metrics for an information security program, the BEST approach is to identify indicators that demonstrate the effectiveness of the security program. These metrics should measure the performance of the security controls in place, such as incident response time, vulnerability management, compliance with standards and regulations, and the overall effectiveness of the security program. By using these metrics, the organization can see how well the security program is working and make necessary adjustments.

    2. V

       Viperhunter

       2024-11-20

       Selected D1 upvote

       Metrics in an information security program should focus on demonstrating the effectiveness of the security measures and their contribution to the overall security posture. Effectiveness metrics help assess how well security controls are working, the level of risk reduction achieved, and the program's ability to meet its objectives. These metrics provide valuable insights for decision-makers and help in continuous improvement efforts. While supporting major information security initiatives (option A) is important, the primary goal is to measure effectiveness. Reflecting the corporate risk culture (option B) is important but might not directly measure program effectiveness. Metrics that reduce information security program spending (option C) may not necessarily align with the goal of demonstrating effectiveness and may not provide a comprehensive view of the security program's success.

    3. V

       Viperhunter

       2024-11-21

       Selected D2 upvotes

       When establishing metrics for an information security program, it is important to focus on indicators that demonstrate the effectiveness of the security program. These metrics should provide insights into the program's performance, its ability to mitigate risks, and its overall impact on the organization's security posture. Metrics that demonstrate effectiveness help in assessing the success of security initiatives and provide valuable information for decision-making and continuous improvement.

    4. Q

       Q_K

       2024-03-02

       Selected D2 upvotes

       https://www.isaca.org/resources/isaca-journal/issues/2020/volume-6/key-performance-indicators-for-security-governance-part-1

25. Question 25 of 25

    An incident response team has established that an application has been breached. Which of the following should be done NEXT?

    • AMaintain the affected systems in a forensically acceptable state.
    • BInform senior management of the breach.
    • CIsolate the impacted systems from the rest of the network.
    • DConduct a risk assessment on the affected application.

    Show answer

    Correct answer: C

    How others answered

    • C75%
    • B25%

    Explanation

    ** Checked wrong box for answer in previous post. C. Isolate the impacted systems from the rest of the network. Containment follows detection. https://www.isaca.org/resources/isaca-journal/issues/2022/volume-1/cybersecurity-incident-response-exercise-guidance

    Adapted from community discussion by 6and0 · 2024-03-22 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • isaca.org documentation

    View community discussion3

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by CISM or CertExamHQ.

    1. 6

       6and0

       2024-03-22

       Selected C2 upvotes

       ** Checked wrong box for answer in previous post. C. Isolate the impacted systems from the rest of the network. Containment follows detection. https://www.isaca.org/resources/isaca-journal/issues/2022/volume-1/cybersecurity-incident-response-exercise-guidance

    2. R

       richck102

       2024-04-04

       2 upvotes

       C. Isolate the impacted systems from the rest of the network.

    3. Y

       yottabyte

       2024-09-21

       Selected C1 upvote

       If the IRP has established the breach, then it means that the senior management already knows.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 1 of 25