4 Flashcards
- Management would like to understand the risk associated with engaging an Infrastructure- as-a-Service
(laaS) provider compared to hosting internally. Which of the following would provide the BEST method of
comparing risk scenarios?
A. Mapping risk scenarios according to sensitivity of data
B. Reviewing mitigating and compensating controls for each risk scenario
C. Mapping the risk scenarios by likelihood and impact on a chart
D. Performing a risk assessment on the laaS provider
Answer: C
Explanation:
Mapping the risk scenarios by likelihood and impact on a chart is the best method of comparing risk
scenarios, as it helps to visualize and prioritize the different types and levels of risks associated with each
option. A chart can also facilitate the communication and decision-making process by showing the
trade-offs and benefits of each option. A chart can be based on qualitative or quantitative data, depending
on the availability and accuracy of the information.
References = CISM Review Manual 2022, page 371; CISM Exam Content Outline, Domain 1, Task 1.32; A
risk assessment model for selecting cloud service providers; Security best practices for IaaS workloads in
Azure
- In addition to executive sponsorship and business alignment, which of the following is MOST critical for
information security governance?
A. Ownership of security
B. Compliance with policies
C. Auditability of systems
D. Allocation of training resources
Answer: A
Explanation: Information security governance is the process of establishing and maintaining a framework to
provide assurance that information security strategies are aligned with business objectives and consistent
with applicable laws and regulations. In addition to executive sponsorship and business alignment, a critical
factor for effective information security governance is ownership of security, which means that the roles and
responsibilities for information security are clearly defined and assigned to the appropriate stakeholders,
such as business owners, information owners, information custodians, and users. Ownership of security
also implies accountability for the protection of information assets and the management of security risks.
References: https://www.isac
A.org/credentialing/cism https://www.nist.gov/publications/informationsecurity-
handbook-guide-managers
- Which of the following tools provides an incident response team with the GREATEST insight into insider
threat activity across multiple systems?
A. A security information and event management (SIEM) system
B. An intrusion prevention system (IPS)
C. A virtual private network (VPN) with multi-factor authentication (MFA)
D. An identity and access management (IAM) system
Answer: A
Explanation:
A SIEM system is the best tool for providing an incident response team with the greatest insight into insider
threat activity across multiple systems because it can collect, correlate, analyze, and report on security
events and logs from various sources, such as network devices, servers, applications, and user activities. A
SIEM system can also detect and alert on anomalous or suspicious behaviors, such as unauthorized
access, data exfiltration, privilege escalation, or policy violations, that may indicate an insider threat. A
SIEM system can also support forensic investigations and incident response actions by providing a
centralized and comprehensive view of the security posture and incidents.
References: The CISM Review Manual 2023 defines SIEM as “a technology that provides real-time
analysis of security alerts generated by network hardware and applications” and states that “SIEM systems
can help identify insider threats by correlating user activity logs with other security events and detecting
deviations from normal patterns” (p. 184). The CISM Review Questions, Answers & Explanations Manual
2023 also provides the following rationale for this Answer: “A security information and event management
(SIEM) system is the correct answer because it can provide the most insight into insider threat activity
across multiple systems by collecting, correlating, analyzing, and reporting on security events and logs from
various sources” (p. 95). Additionally, the Detecting and Identifying Insider Threats article from the CISA
website states that “threat detection and identification is the process by which persons who might present
an insider threat risk due to their observable, concerning behaviors come to the attention of an organization
or insider threat team. Detecting and identifying potential insider threats requires both human and
technological elements” and that “technological elements include tools such as security information and
event management (SIEM) systems, user and entity behavior analytics (UEBA) systems, and data loss
prevention (DLP) systems, which can monitor, analyze, and alert on user activities and network events” (p.
1)1.
- Which of the following should be the GREATEST concern for an information security manager when an
annual audit reveals the organization’s business continuity plan (BCP) has not been reviewed or updated in
more than a year?
A. An outdated BCP may result in less efficient recovery if an actual incident occurs.
B. The organization may suffer reputational damage for not following industry best practices.
C. The audit finding may impact the overall risk rating of the organization.
D. The lack of updates to the BCP may result in noncompliance with internal policies.
Answer: A
Explanation:
A BCP is a document that outlines the processes and procedures to maintain or resume critical business
functions and minimize the impact of a disruption on the organization’s objectives, customers, and
stakeholders. A BCP should be reviewed and updated regularly to reflect the changes in the organization’s
environment, risks, resources, and requirements. An outdated BCP may result in less efficient recovery if
an actual incident occurs, as it may not account for the current situation, dependencies, priorities, or
recovery strategies. This may lead to increased downtime, losses, or damages for the organization.
References = CISM Review Manual 2022, page 3101; CISM Exam Content Outline, Domain 4, Knowledge
Statement 4.82; CISM 2020: Business Continuity3; Part Two: Business Continuity and Disaster Recovery
Plans
- Which of the following would BEST enable a new information security manager to obtain senior
management support for an information security governance program?
A. Demonstrating the program’s value to the organization
B. Discussing governance programs found in similar organizations
C. Providing the results of external audits
D. Providing examples of information security incidents within the organization
Answer: A
Explanation: The best way to obtain senior management support for an information
security governance program is to demonstrate the program’s value to the organization, such as how it can
help achieve business objectives, reduce operational risks, enhance resilience, and comply with
regulations. Demonstrating the value of information security governance can help senior management
understand the benefits and costs of the program, and motivate them to participate in the decision-making
process. The other options, such as discussing governance programs in similar organizations, providing
external audit results, or providing examples of incidents, may not be sufficient or persuasive enough to
obtain senior management support, as they may not reflect the specific needs and goals of the organization.
References:
✑ https://www.isac
A.org/resources/news-and-trends/isaca-now-blog/2020/how-toinvolve-
senior-management-in-the-information-security-governance-process
✑ https://www.sans.org/white-papers/992/
✑ https://www.govtech.com/blogs/lohrmann-on-cybersecurity/how-to-getmanagement-
support-for-your-security-program.html
- Which type of recovery site is MOST reliable and can support stringent recovery requirements?
A. Cold site
B. Warm site
C. Hot site
D. Mobile site
Answer: C
Explanation: A hot site is the most reliable type of recovery site and can support stringent recovery
requirements because it is a fully operational facility that mirrors the primary production center. A hot site
has all the hardware, software, data, network, and personnel ready to resume the critical business functions
within minutes of a disruptive event. A hot site also has backup power, security, and communication
systems to ensure the continuity of operations.
References: The CISM Review Manual 2023 defines a hot site as “a fully operational facility that mirrors the
primary production center” and states that “a hot site can support stringent recovery requirements and
provide the shortest recovery time” (p. 190). The CISM Review Questions, Answers & Explanations Manual
2023 also provides the following rationale for this Answer: “A hot site is the correct answer because it is the
most reliable type of recovery site and can support stringent recovery requirements, as it is a fully
operational facility that mirrors the primary production center and can resume the critical business functions
within minutes of a disruptive event” (p. 96). Additionally, the web search result 1 states that “the recovery
site can be hot, warm, cold or mobile. Hot sites are facilities that mirror the primary production center” and
that “hot sites are the most reliable
and can support stringent recovery requirements” (p. 1).
- Which of the following should an information security manager do FIRST upon learning that a competitor
has experienced a ransomware attack?
A. Perform a full data backup.
B. Conduct ransomware awareness training for all staff.
C. Update indicators of compromise in the security systems.
D. Review the current risk assessment.
Answer: D
- Which of the following is MOST helpful in determining the criticality of an organization’s business functions?
A. Disaster recovery plan (DRP)
B. Business impact analysis (BIA)
C. Business continuity plan (BCP)
D. Security assessment report (SAR)
Answer: B
Explanation:
Business impact analysis (BIA) is the most helpful in determining the criticality of an organization’s business
functions because it is a process of identifying and evaluating the potential effects of disruptions or
interruptions to those functions. BIA helps to prioritize the recovery of the most critical functions and to
estimate the resources and time needed for the recovery. Therefore, business impact analysis (BIA) is the
correct answer. References:
✑ https://www.linkedin.com/pulse/business-continuity-critical-functions-tino-marquez
✑ https://www.techtarget.com/searchitchannel/feature/Business-impact-analysis-forbusiness-
continuity-Understanding-impact-criticality
- Which of the following should be the PRIMARY outcome of an information security program?
A. Strategic alignment
B. Risk elimination
C. Cost reduction
D. Threat reduction
Answer: A
Explanation: According to the CISM Review Manual (Digital Version), Chapter 3, Section 3.2.1, strategic
alignment is the primary outcome of an information security
program1. Strategic alignment means that the information security program supports and is tailored to the
organization’s objectives and business strategy1. It also means that the information security program is
aligned with other assurance functions, such as physical, human resources, quality, and IT1.
The CISM Review Manual (Digital Version) also states that strategic alignment is essential for achieving a
competitive advantage, enhancing customer trust, reducing legal and regulatory risks, and improving
organizational performance1. Strategic alignment requires effective communication and collaboration
among all stakeholders, including senior management, information owners, information security managers,
information security steering committees, and external partners1.
The CISM Exam Content Outline also covers the topic of strategic alignment in Domain 3
— Information Security Program Development and Management (33% exam weight)2. The subtopics
include:
✑ 3.2.1 Information Security Strategy
✑ 3.2.2 Information Security Governance
✑ 3.2.3 Information Security Risk Management
✑ 3.2.4 Information Security Compliance
I hope this answer helps you prepare for your CISM exam. Good luck!
- Which of the following events is MOST likely to require an organization to revisit its information security
framework?
A. New services offered by IT
B. Changes to the risk landscape
C. A recent cybersecurity attack
D. A new technology implemented
Answer: B
Explanation:
Changes to the risk landscape are the most likely events to require an organization to revisit its information
security framework, because they may affect the organization’s risk appetite, risk tolerance, risk profile, and
risk treatment strategies. The information security framework should be aligned with the organization’s
business objectives and risk management approach, and should be reviewed and updated regularly to
reflect the changing internal and external environment.
References =
CISM Review Manual, 16th Edition, ISACA, 2020, p. 35: “The information security framework should be
reviewed and updated regularly to ensure that it remains aligned with the enterprise’s business objectives
and risk management approach and reflects the changing internal and external environment.”
CISM Review Manual, 16th Edition, ISACA, 2020, p. 36: “Changes in the risk landscape may require the
enterprise to revisit its risk appetite, risk tolerance, risk profile, and risk treatment strategies.”
- Which of the following is the MOST important consideration when updating procedures for managing
security devices?
A. Updates based on the organization’s security framework
B. Notification to management of the procedural changes
C. Updates based on changes m risk technology and process
D. Review and approval of procedures by management
Answer: C
Explanation: According to the CISM Manual, updating procedures for managing security devices should be
based on changes in risk technology and process, not on the organization’s security framework, notification
to management of the procedural changes, or review and approval of procedures by management1. These
are not the most important considerations when updating procedures for managing security devices, as
they do not reflect the actual impact of the changes on the security posture of the organization.
The CISM Manual states that “procedures for managing security devices should be updated whenever
there are significant changes in the risk technology or process that affect the security devices” (IR 8287A)1.
For example, if a new security device is introduced or an existing one is replaced, its procedures should be
updated
accordingly. Similarly, if a new risk technology or process is implemented that affects how security devices
are configured, monitored, or maintained, its procedures should be updated as well1.
The CISM Manual also provides guidance on how to update procedures for managing security devices in a
systematic and consistent manner. It recommends using a change management process that involves
identifying, analyzing, approving, implementing, and evaluating changes to security device procedures1. It
also suggests using a change control board (CCB) that consists of representatives from different
stakeholders who review and approve changes to security device procedures before they are
implemented1.
References: 1: IR 8287A - Managing Security Devices | CSRC NIST
- Which of the following is MOST important to maintain integration among the incident response plan,
business continuity plan (BCP). and disaster recovery plan (DRP)?
A. Asset classification
B. Recovery time objectives (RTOs)
C. Chain of custody
D. Escalation procedures
Answer: B
Explanation: Recovery time objectives (RTOs) are the maximum acceptable time that an organization can
be offline or unavailable after a disruption. RTOs are important to maintain integration among the incident
response plan, business continuity plan (BCP), and disaster recovery plan (DRP) because they help align
the recovery goals and strategies of each plan. By defining clear and realistic RTOs, an organization can
ensure that its IT infrastructure and systems are restored as quickly as possible after a disaster, minimizing
the impact on business operations and customer satisfaction.
References = CISM Manual, Chapter 6: Incident Response Planning, Section 6.2: Recovery Time
Objectives (RTOs), page 971
1: https://store.isac
A.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles
- When assigning a risk owner, the MOST important consideration is to ensure the owner has:
A. adequate knowledge of risk treatment and related control activities.
B. decision-making authority and the ability to allocate resources for risk.
C. sufficient time for monitoring and managing the risk effectively.
D. risk communication and reporting skills to enable decision-making.
Answer: B
Explanation: Comprehensive and Detailed Explanation = The risk owner is the person or entity with the
accountability and authority to manage a risk. The risk owner should have the decision-making authority
and the ability to allocate resources for risk treatment and related control activities. The risk owner should
also be responsible for monitoring and reporting on the risk, but these are not the most important
considerations when assigning a risk owner. The risk owner may not have adequate knowledge of risk
treatment and related control activities, but can delegate or consult with experts as needed. The risk owner
should also have sufficient time for managing the risk effectively, but this is not a prerequisite for assigning
a risk owner.
References =
✑ CISM Review Manual 15th Edition, page 76
✑ CISM Practice Quiz, question 4171
- Which of the following is the BEST way to contain an SQL injection attack that has been detected by a web
application firewall?
A. Force password changes on the SQL database.
B. Reconfigure the web application firewall to block the attack.
C. Update the detection patterns on the web application firewall.
D. Block the IPs from where the attack originates.
Answer: B
Explanation: According to the CISM Review Manual, one of the best ways to contain an SQL injection
attack that has been detected by a web application firewall is to reconfigure the web application firewall to
block the attack. This means that the web application firewall should be updated with the latest detection
patterns and rules that can identify and prevent SQL injection attacks. By doing so, the web application
firewall can reduce the impact and damage of the attack, and prevent further exploitation of the vulnerable
database1
The other options are not as effective as reconfiguring the web application firewall to block the attack. Force
password changes on the SQL database is a reactive measure that does not address the root cause of the
problem, and may cause data loss or corruption if not done properly. Updating the detection patterns on the
web application firewall is a preventive measure that can help to detect SQL injection attacks, but it does
not stop them from happening in the first place. Blocking IPs from where the attack originates is a defensive
measure that can limit or stop some SQL injection attacks, but it does not protect all possible sources of
malicious traffic, and may also affect legitimate users or applications1
References = 1: CISM Review Manual, 16th Edition, ISACA, 2020, pp. 32-33…
- The PRIMARY consideration when responding to a ransomware attack should be to ensure:
A. backups are available.
B. the most recent patches have been applied.
C. the ransomware attack is contained
D. the business can operate
Answer: D
Explanation: Ensuring the business can operate is the primary consideration when responding to a
ransomware attack because it helps to minimize the disruption and impact of the attack on the
organization’s mission-critical functions and services. Ransomware is a type of malware that encrypts the
files or systems of the victims and demands payment for their decryption. Ransomware attacks can cause
significant operational, financial, and reputational damage to organizations, especially if they affect their
core business processes or customer dat
A. Therefore, ensuring the business can operate is the primary
consideration when responding to a ransomware attack.
References:
✑ https://www.cis
A.gov/stopransomware/ransomware-guide
✑ https://csrc.nist.gov/Projects/ransomware-protection-and-response
✑ https://learn.microsoft.com/en-us/azure/security/fundamentals/ransomware-detect- respond
- Which of the following should have the MOST influence on an organization’s response to a new industry
regulation?
A. The organization’s control objectives
B. The organization’s risk management framework
C. The organization’s risk appetite
D. The organization’s risk control baselines
Answer: C
Explanation:
The most influential factor on an organization’s response to a new industry regulation is the organization’s
risk appetite. This is because the risk appetite defines the level of risk that
the organization is willing to accept in pursuit of its objectives, and it guides the decision- making process
for managing risks. The risk appetite also determines the extent to which the organization needs to comply
with the new regulation, and the resources and actions required to achieve compliance. The risk appetite
should be aligned with the organization’s strategy, culture, and values, and it should be communicated and
monitored throughout the organization.
- A financial institution is planning to develop a new mobile application. Which of the following is the BEST
time to begin assessments of the application’s security compliance?
A. During user acceptance testing (UAT)
B. During the design phase
C. During static code analysis
D. During regulatory review
Answer: B
- Which of the following BEST facilitates the development of a comprehensive information security policy?
A. Alignment with an established information security framework
B. An established internal audit program
C. Security key performance indicators (KPIs)
D. Areview of recent information security incidents
Answer: A
Explanation:
Alignment with an established information security framework is the BEST way to facilitate the development
of a comprehensive information security policy, because it provides a consistent and structured approach to
define, implement, and maintain the policy across the organization. An information security framework is a
set of best practices, standards, and guidelines that help to ensure the effectiveness, efficiency, and
compliance of the information security policy.
References =
CISM Review Manual, 16th Edition, ISACA, 2020, p. 35: “An information security framework is a set of best
practices, standards, and guidelines that provide a consistent and structured approach to information
security governance.”
CISM Review Manual, 16th Edition, ISACA, 2020, p. 36: “The information security policy
should be aligned with an established information security framework to ensure its effectiveness, efficiency,
and compliance.”
- A finance department director has decided to outsource the organization’s budget application and has
identified potential providers. Which of the following actions should be initiated FIRST by IN information
security manager?
A. Determine the required security controls for the new solution
B. Review the disaster recovery plans (DRPs) of the providers
C. Obtain audit reports on the service providers’ hosting environment
D. Align the roles of the organization’s and the service providers’ stats.
Answer: A
Explanation: Before outsourcing any application or service, an information security manager should first
determine the required security controls for the new solution, based on the organization’s risk appetite,
security policies and standards, and regulatory requirements. This will help to evaluate and select the most
suitable provider, as well as to define the security roles and responsibilities, service level agreements
(SLAs), and audit requirements. References: https://www.isac
A.org/credentialing/cism
https://www.wiley.com/enus/
CISM+Certified+Information+Security+Manager+Study+Guide-p-9781119801948
- When developing a categorization method for security incidents, the categories MUST:
A. align with industry standards.
B. be created by the incident handler.
C. have agreed-upon definitions.
D. align with reporting requirements.
Answer: C
Explanation: When developing a categorization method for security incidents, the
categories must have agreed-upon definitions. This means that the categories should be clear, consistent,
and understandable for all the parties involved in the incident response process, such as the incident
handlers, the stakeholders, the management, and the external authorities. Having agreed-upon definitions
for the categories can help to ensure that the incidents are classified and reported accurately, that the
appropriate actions and resources are allocated, and that the communication and coordination are effective.
Aligning with industry standards, creating by the incident handler, and aligning with reporting requirements
are not mandatory for developing a categorization method for security incidents, although they may be
desirable or beneficial depending on the context and objectives of the organization. Aligning with industry
standards can help to adopt best practices and benchmarks for incident response, but it may not be
feasible or suitable for all types of incidents or organizations. Creating by the incident handler can allow for
flexibility and customization of the categories, but it may also introduce inconsistency and
ambiguity if the definitions are not shared or agreed upon by others. Aligning with reporting requirements
can help to comply with legal or contractual obligations, but it may not cover all the aspects or dimensions
of the incidents that need to be categorized. References = CISM Review Manual, 16th Edition, pages
200-2011; CISM Review Questions, Answers & Explanations Manual, 10th Edition, page 822
When developing a categorization method for security incidents, the categories MUST have agreed-upon
definitions. This is because having clear and consistent definitions for each category of incidents will help to
ensure a common understanding and communication among the incident response team and other
stakeholders. It will also facilitate the accurate and timely identification, classification, reporting and analysis
of incidents. Having agreed- upon definitions will also help to avoid confusion, ambiguity and inconsistency
in the incident management process
- Which of the following is the BEST way lo monitor for advanced persistent threats (APT) in an organization?
A. Network with peers in the industry to share information.
B. Browse the Internet to team of potential events
C. Search for anomalies in the environment
D. Search for threat signatures in the environment.
Answer: C
Explanation: An advanced persistent threat (APT) is a stealthy and sophisticated attack
that aims to compromise and maintain access to a target network or system over a long period of time,
often for espionage or sabotage purposes. APTs are difficult to detect by conventional security tools, such
as antivirus or firewalls, that rely on signatures or rules to identify threats. Therefore, the best way to
monitor for APTs is to search for anomalies in the environment, such as unusual network traffic, user
behavior, file activity, or system configuration changes, that may indicate a compromise or an ongoing
attack. References: https://www.isac
A.org/credentialing/cism https://www.nist.gov/publications/informationsecurity-
handbook-guide-managers
- Which of the following is the BEST starting point for a newly hired information security manager who has
been tasked with identifying and addressing network vulnerabilities?
A. Controls analysis
B. Emerging risk review
C. Penetration testing
D. Traffic monitoring
Answer: C
Explanation: The best starting point for a newly hired information security manager who has been tasked
with identifying and addressing network vulnerabilities is C. Penetration testing. This is because penetration
testing is a method of simulating real-world attacks on a network to evaluate its security posture and identify
any weaknesses or gaps that could be exploited by malicious actors. Penetration testing can help the
information security manager to assess the effectiveness of the existing controls, prioritize the remediation
efforts, and demonstrate compliance with the relevant standards and regulations. Penetration testing can
also provide valuable insights into the network architecture, configuration, and behavior, as well as the
potential impact and likelihood of different types of attacks.
References = CISM Review Manual 15th Edition, Chapter 4, Section 4.2.1, page 2091; CISM Review
Questions, Answers & Explanations Manual 9th Edition, Question 50, page 14
- Which of the following is the PRIMARY benefit of implementing an information security governance
framework?
A. The framework defines managerial responsibilities for risk impacts to business goals.
B. The framework provides direction to meet business goals while balancing risks and controls.
C. The framework provides a roadmap to maximize revenue through the secure use of technology.
D. The framework is able to confirm the validity of business goals and strategies.
Answer: B
Explanation:
An information security governance framework is a set of principles, policies, standards, and processes that
guide the development, implementation, and management of an effective information security program that
supports the organization’s objectives and strategy. The framework provides direction to meet business
goals while balancing risks and controls, as it helps to align the information security activities with the
business needs, priorities, and risk appetite, and to ensure that the security resources and investments are
optimized and justified.
References = CISM Review Manual 2022, page 321; CISM Exam Content Outline, Domain 1, Knowledge
Statement 1.22; CISM domain 1: Information security governance Updated 2022
- Which of the following is the MOST important benefit of using a cloud access security broker when
migrating to a cloud environment?
A. Enhanced data governance
B. Increased third-party assurance
C. )Improved incident management
D. Reduced total cost of ownership (TCO)
Answer: A
Explanation:
According to the web search results, a cloud access security broker (CASB) is a software solution that
stands between the cloud service provider and the cloud service user to enforce security controls. One of
the most important benefits of using a CASB when migrating to a cloud environment is enhanced data
governance, as it helps to protect sensitive information from unauthorized access, sharing, or loss. A CASB
can also provide data classification, encryption, data loss prevention (DLP), and other features that enable
organizations to manage and secure their data in the cloud.
References = What Is a Cloud Access Security Broker (CASB)?, A beginner’s guide to cloud access
security brokers
- An organization is planning to outsource network management to a service provider. Including which of the
following in the contract would be the MOST effective way to mitigate information security risk?
A. Requirement for regular information security awareness
B. Right-to-audit clause
C. Service level agreement (SLA)
D. Requirement to comply with corporate security policy
Answer: D
Explanation: The most effective way to mitigate information security risk when outsourcing network
management to a service provider is to include a requirement for the service provider to comply with the
corporate security policy in the contract. This requirement ensures that the service provider follows the
same security standards, procedures, and controls as the organization, and protects the confidentiality,
integrity, and availability of the organization’s data and systems. The requirement also defines the roles and
responsibilities, the reporting and escalation mechanisms, and the penalties for non- compliance.
References = A Risk-Based Management Approach to Third-Party Data Security, Risk and Compliance,
CISM Domain 2: Information Risk Management (IRM) [2022 update]
- An organization is considering the feasibility of implementing a big data solution to analyze customer dat
A.
In order to support this initiative, the information security manager should FIRST:
A. inventory sensitive customer data to be processed by the solution.
B. determine information security resource and budget requirements.
C. assess potential information security risk to the organization.
D. develop information security requirements for the big data solution.
Answer: C
Explanation: Assessing potential information security risk to the organization is the first step that the
information security manager should take when considering the feasibility of implementing a big data
solution to analyze customer data, as it helps to identify and evaluate the threats, vulnerabilities, and
impacts that may arise from the collection, processing, storage, and sharing of large volumes and varieties
of customer dat
A. Assessing risk also helps to determine the risk appetite and tolerance of the organization,
and to prioritize the risk treatment options and security controls that are needed to protect the customer
data and the big data solution. (From CISM Review Manual 15th Edition) References: CISM Review
Manual 15th Edition, page 64, section 2.2.1.2; Big Data Security and Privacy Issues in Healthcare1, page 1,
section 1. Introduction.
- Which of the following is a PRIMARY responsibility of the information security goxernance function?
A. Administering information security awareness training
B. Defining security strategies to support organizational programs
C. Ensuring adequate support for solutions using emerging technologies
D. Advising senior management on optimal levels of risk appetite and tolerance
Answer: B
Explanation:
Defining security strategies to support organizational programs is a primary responsibility of the information
security governance function, as it involves providing strategic direction for security activities and ensuring
that objectives are achieved. According to ISACA, information security governance is a subset of corporate
governance that provides guidance for aligning information security with business objectives, managing
information security risks, and using information resources responsibly12.
References = CISM Review Manual, 27th Edition, Chapter 4, Section 4.1.1, page 2131; CISM Online
Review Course, Module 4, Lesson 1, Topic 12
- What should an information security manager verify FIRST when reviewing an information asset
management program?
A. System owners have been identified.
B. Key applications have been secured.
C. Information assets have been classified.
D. Information assets have been inventoried.
Answer: C
Explanation: According to the CISM Review Manual, information asset classification is the first step in an
information asset management program, as it provides the basis for determining the level of protection
required for each asset. System owners, key applications and information asset inventory are subsequent
steps that depend on the classification of the assets.
References = CISM Review Manual, 27th Edition, Chapter 1, Section 1.4.2, page 381.
- Which of the following BEST enables the restoration of operations after a limited ransomware incident
occurs?
A. Reliable image backups
B. Impact assessment
C. Documented eradication procedures
D. Root cause analysis
Answer: A
- A technical vulnerability assessment on a personnel information management server should be performed
when:
A. the data owner leaves the organization unexpectedly.
B. changes are made to the system configuration.
C. the number of unauthorized access attempts increases.
D. an unexpected server outage has occurred.
Answer: B
Explanation: A technical vulnerability assessment is a process of identifying and evaluating the
weaknesses and risks associated with a specific system, component, or network. A technical vulnerability
assessment can help to determine the potential impact and likelihood of a security breach, as well as the
appropriate measures to prevent or mitigate it. A technical vulnerability assessment should be performed
on a personnel information management server whenever there is an increase in the number of
unauthorized access attempts to the server, as this indicates that the server may have been compromised
or targeted by an attacker12. Therefore, option C is the correct answer. References =
✑ CISM Review Manual (Digital Version), Chapter 5: Information Security Program
Management
✑ CISM Review Manual (Print Version), Chapter 5: Information Security Program Management
- When determining an acceptable risk level which of the following is the MOST important
consideration?
A. Threat profiles
B. System criticalities
C. Vulnerability scores
D. Risk matrices
Answer: C
Explanation: The effectiveness of an incident response team will be greatest when the incident response
process is updated based on lessons learned. This ensures that the team can continuously improve its
performance and capabilities, and address any gaps or weaknesses identified during previous incidents.
Updating the incident response process based on lessons learned also helps to align the process with the
changing business and security environment, and to incorporate best practices and standards. Meeting on
a regular basis to review log files, having trained security personnel as team members, and using a security
information and event monitoring (SIEM) system are all important factors for an incident response team, but
they are not sufficient to ensure the effectiveness of the team. Reviewing log files may help to detect and
analyze incidents, but it does not guarantee that the team can respond appropriately and efficiently. Having
trained security personnel may enhance the skills and knowledge of the team, but it does not ensure that
the team can work collaboratively and communicate effectively. Using a SIEM system may facilitate the
identification and prioritization of incidents, but it does not ensure that the team can follow the established
procedures and protocols. References = CISM Review Manual, 16th Edition, page 1361; CISM Review
Questions, Answers & Explanations Manual, 10th Edition, page 1492
- Which of the following is the PRIMARY reason that an information security manager should restrict the use
of generic administrator accounts in a multi-user environment?
A. To ensure separation of duties is maintained
B. To ensure system audit trails are not bypassed
C. To prevent accountability issues
D. To prevent unauthorized user access
Answer: C
- Which of the following is MOST important to the successful implementation of an information security
program?
A. Adequate security resources are allocated to the program.
B. Key performance indicators (KPIs) are defined.
C. A balanced scorecard is approved by the steering committee.
D. The program is developed using global security standards.
Answer: A
Explanation: The successful implementation of an information security program depends largely on the
availability and allocation of adequate security resources, such as budget, staff, technology, and training.
Without sufficient resources, the program may not be able to achieve its objectives, comply with the
security strategy, or address the security risks. Key performance indicators (KPIs), a balanced scorecard,
and global security standards are also important elements of an information security program, but they are
not as critical as the resource allocation.
References = CISM Review Manual, 16th Edition, page 69
- Which of the following is the BEST method to protect the confidentiality of data transmitted over the
Internet?
A. Network address translation (NAT)
B. Message hashing
C. Transport Layer Security (TLS)
D. Multi-factor authentication
Answer: C
Explanation: Transport Layer Security (TLS) is a protocol that provides encryption, authentication, and
integrity for data transmitted over the Internet. TLS protects the confidentiality of data by encrypting it
before sending it and decrypting it after receiving it. TLS also verifies the identity of the communicating
parties by using certificates and
prevents data tampering by using message authentication codes. References = CISM
Review Manual, 16th Edition, Chapter 4, Section 4.3.2.11
- Which of the following provides the BEST evidence that a recently established infofmation security program
is effective?
A. The number of reported incidents has increased
B. Regular IT balanced scorecards are communicated.
C. Senior management has reported fewer junk emails.
D. The number of tickets associated with IT incidents have stayed consistent
Answer: A
Explanation: The number of reported incidents has increased is the best evidence that a recently
established information security program is effective because it indicates that the organization has
improved its detection and reporting capabilities and has raised awareness among employees about
security issues. Regular IT balanced scorecards are communicated is not a good evidence because it does
not measure the actual performance or outcomes of the security program. Senior management has
reported fewer junk emails is not a good evidence because it does not reflect the overall security posture or
maturity of the organization. The number of tickets associated with IT incidents have stayed consistent is
not a good evidence because it does not show any improvement or reduction in security incidents or risks.
References: https://www.isac
A.org/resources/isacajournal/
issues/2016/volume-6/how-to-measure-the-effectiveness-of-information-security- using-iso-27004
https://www.isac
A.org/resources/isaca-journal/issues/2014/volume-6/howto-
measure-the-effectiveness-of-your-information-security-management-system
- An online trading company discovers that a network attack has penetrated the firewall. What should be the
information security manager’s FIRST response?
A. Notify the regulatory agency of the incident.
B. Implement mitigating controls.
C. Evaluate the impact to the business.
D. Examine firewall logs to identify the attacker.
Answer: C
- Which of the following would BEST support the business case for an increase in the information security
budget?
A. Cost-benefit analysis results
B. Comparison of information security budgets with peer organizations
C. Business impact analysis (BIA) results
D. Frequency of information security incidents
Answer: A
Explanation: Cost-benefit analysis results are the best way to support the business case for an increase in
the information security budget because they help to demonstrate the value and return on investment of the
proposed security initiatives or projects. A cost- benefit analysis is a method of comparing the costs and
benefits of different alternatives or options, taking into account both quantitative and qualitative factors. A
cost-benefit analysis helps to justify the need and feasibility of the security budget, as well as to prioritize
the security spending based on the expected outcomes and impacts. Therefore, cost-benefit analysis
results are the correct answer.
References:
✑ https://www.cis
A.gov/resources-tools/resources/business-case-security
✑ https://www.cis
A.gov/resources-tools/resources/isc-best-practices-making- business-case-security
✑ https://risk3sixty.com/2020/09/21/how-to-build-a-business-case-for-security- initiatives-part-4/
- Which of the following metrics is MOST appropriate for evaluating the incident notification process?
A. Average total cost of downtime per reported incident
B. Elapsed time between response and resolution
C. Average number of incidents per reporting period
D. Elapsed time between detection, reporting, and response
Answer: D
Explanation: Elapsed time between detection, reporting, and response is the most appropriate metric for
evaluating the incident notification process because it measures how quickly and effectively the
organization identifies, communicates, and responds to security incidents. The incident notification process
is a critical part of the incident response plan that defines the roles and responsibilities, procedures, and
channels for reporting and escalating security incidents to the relevant stakeholders. Elapsed time between
detection, reporting, and response helps to assess the performance and efficiency of the incident
notification process, as well as to identify any bottlenecks or delays that may affect the incident resolution
and recovery. Therefore, elapsed time between detection, reporting, and response is the correct answer.
References:
✑ https://www.atlassian.com/incident-management/kpis/common-metrics
✑ https://securityscorecard.com/blog/how-to-use-incident-response-metrics/
✑ https://www.cis
A.gov/sites/default/files/publications/Incident-Response-Plan- Basics_508c.pdf
- Which of the following BEST enables the capability of an organization to sustain the delivery of products
and services within acceptable time frames and at predefined capacity during a disruption?
A. Service level agreement (SLA)
B. Business continuity plan (BCP)
C. Disaster recovery plan (DRP)
D. Business impact analysis (BIA)
Answer: B
Explanation:
The best option to enable the capability of an organization to sustain the delivery of products and services
within acceptable time frames and at predefined capacity during a disruption is B. Business continuity plan
(BCP). This is because a BCP is a documented collection of procedures and information that guides the
organization to prepare for, respond to, and recover from a disruption, such as a natural disaster, a
cyberattack, or a pandemic. A BCP aims to ensure the continuity of the critical business functions and
processes that support the delivery of products and services to the customers and
stakeholders. A BCP also defines the roles, responsibilities, resources, and actions required to maintain the
operational resilience of the organization in the face of a disruption.
References = CISM Review Manual 15th Edition, Chapter 4, Section 4.2.3, page 2141; CISM Review
Questions, Answers & Explanations Manual 9th Edition, Question 6, page 3
- The information security manager of a multinational organization has been asked to consolidate the
information security policies of its regional locations. Which of the following would be of
GREATEST concern?
A. Varying threat environments
B. Disparate reporting lines
C. Conflicting legal requirements
D. Differences in work culture
Answer: C
Explanation:
Conflicting legal requirements would be of greatest concern when consolidating the information security
policies of regional locations, as they may pose significant challenges and risks for the organization’s
compliance, privacy, and data protection obligations. Different jurisdictions may have different laws and
regulations regarding information security, such as the General Data Protection Regulation (GDPR) in the
European Union, the Health Insurance Portability and Accountability Act (HIPAA) in the United States, or
the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canad
A. These laws and
regulations may have different definitions, scopes, standards, and enforcement mechanisms for information
security, which may create conflicts or inconsistencies when applying a unified policy across the
organization. Therefore, the information security manager should conduct a thorough analysis of the legal
requirements of each location, and ensure that the consolidated policy meets the highest level of
compliance and avoids any violations or penalties.
References = CISM Review Manual 2022, page 361; CISM Exam Content Outline, Domain 1, Task 1.22;
CISM 2020: IT Security Policies; Information Security Due Diligence Questionnaire
