ISACA CISM — Certified Information Security Manager

Question 1

A manufacturing enterprise is acquiring a smaller competitor. The acquiring company follows ISO/IEC 27001, while the target has an informal, undocumented security program built around a different framework. The board has asked the information security manager how to approach integrating the two security programs to deliver value while managing risk. What should the information security manager do FIRST?

Accepted Answer

Perform a gap assessment of the target's security posture against the acquiring organization's governance framework and risk appetite

Answer

Immediately impose the acquiring company's ISO/IEC 27001 controls and policies on the target to enforce consistency

Answer

Retain the target's existing framework indefinitely to avoid disrupting its operations during the transition

Answer

Purchase additional cyber insurance to transfer the risk introduced by the acquired entity

Question 2

An information security manager compiles monthly KRI data showing that failed patch-deployment rates have steadily risen over three consecutive reporting cycles, though no individual threshold has yet been breached. Before the next executive risk committee meeting, what is the MOST important action the manager should take?

Accepted Answer

Analyze the upward trend, correlate it to affected risk scenarios, and report the deteriorating condition to the committee

Answer

Wait until a KRI threshold is formally breached before escalating the metric to the committee

Answer

Lower the KRI threshold so the current values register as a breach requiring immediate action

Answer

Replace the failed patch-deployment KRI with a lagging indicator that is easier to interpret

Question 3

An information security manager notices that several individually low-rated risks across different business units all stem from the same unpatched legacy authentication service. Each business unit has independently accepted its portion of the risk as within its local tolerance. What should the security manager do FIRST?

Accepted Answer

Aggregate the related risks into a single enterprise-level risk scenario and reassess the combined impact

Answer

Override the business units' acceptance decisions and mandate immediate patching of the legacy service

Answer

Record each acceptance in the risk register and continue monitoring the individual risks separately

Answer

Transfer the aggregated exposure to a cyber insurance policy to cover potential losses

Question 4

A newly appointed information security manager at a mid-sized financial services firm discovers that the organization's information security policies were written years ago and reference no external standard. The board has asked for assurance that the security program reflects recognized good practice and can be benchmarked against peers. Which action should the security manager take FIRST to address the board's request?

Accepted Answer

Select and adopt an appropriate industry framework or standard that aligns with the firm's business objectives and regulatory context

Answer

Immediately rewrite all existing policies to include detailed technical control statements

Answer

Purchase a governance, risk, and compliance (GRC) tool to automate control tracking

Answer

Schedule an external penetration test to demonstrate the current security posture to the board

Question 5

A newly appointed information security manager at a manufacturing firm finds that a technically sound security strategy approved two years ago has been largely ignored by business units. Interviews reveal that employees view security controls as obstacles to production targets, and line managers routinely grant exceptions to keep operations moving. Which action would BEST address the underlying cause of the strategy's poor adoption?

Accepted Answer

Engage business leaders to integrate security objectives into operational goals and performance measures

Answer

Increase the frequency of security awareness training sessions for all staff

Answer

Implement automated technical controls that prevent employees from bypassing security requirements

Answer

Escalate the exceptions to the audit committee and enforce disciplinary measures for non-compliance

Question 6

An information security manager is developing the security program for a large enterprise and must ensure that protection levels applied to data are appropriate and cost-effective. Before selecting and applying baseline controls to the organization's information assets, which activity provides the MOST essential foundation for these decisions?

Accepted Answer

Classifying information assets according to their value, sensitivity, and criticality to the business

Answer

Deploying data loss prevention technology across all endpoints and network egress points

Answer

Conducting a penetration test to identify exploitable vulnerabilities in production systems

Answer

Assigning encryption to every database and file share regardless of content

Question 7

An information security manager is developing handling requirements for a newly classified dataset that feeds an automated financial trading algorithm. Business owners emphasize that the data is not confidential (it is derived from public market feeds) but that corrupted or altered values could trigger erroneous multimillion-dollar trades. When defining the protection baseline for this asset, which control emphasis should the manager prioritize?

Accepted Answer

Integrity controls such as input validation, checksums, and change detection

Answer

Strong encryption at rest and in transit to prevent unauthorized disclosure

Answer

Redundant storage and geographically dispersed backups for availability

Answer

Role-based access restrictions to limit who can view the dataset

Question 8

An information security manager finds that an organization has a documented data classification policy with four sensitivity levels, but a recent review reveals that employees frequently store confidential files in shared repositories accessible to all staff. Investigation shows the classification levels are well understood, but there is no consistent way to identify how sensitive a given file is once it leaves its original system. What is the MOST likely root cause the security manager should address?

Accepted Answer

The absence of data labeling and handling procedures that operationalize the classification scheme

Answer

Insufficient encryption applied to the shared repositories storing the files

Answer

Lack of a formal risk assessment covering the shared repositories

Answer

Inadequate security awareness training on the existence of the classification policy

Question 9

During the rollout of a new information security program, the security manager discovers that many critical data assets have been classified inconsistently, with IT staff making classification decisions based on technical storage requirements rather than business value. Which action should the security manager take FIRST to correct this?

Accepted Answer

Assign classification responsibility to the designated business data owners

Answer

Reclassify all affected assets based on the security team's assessment of sensitivity

Answer

Deploy a data discovery tool to automatically classify assets by content

Answer

Apply the highest classification level to all critical assets to ensure protection

Question 10

An information security manager discovers that customer datasets originally classified as 'Confidential' three years ago are now aggregated into analytics reports and used broadly across marketing, finance, and operations. The datasets still carry the original classification labels, but their sensitivity and regulatory exposure have grown significantly since the initial classification. What should the security manager do FIRST to address this situation?

Accepted Answer

Initiate a reclassification review with the data owners to reassess sensitivity based on current use

Answer

Encrypt all analytics reports containing the datasets to reduce exposure risk

Answer

Restrict access to the analytics reports until a new classification is assigned

Answer

Update the data handling procedures to reflect the broader distribution of the datasets

Question 11

A newly appointed information security manager discovers that the organization's security program applies controls inconsistently, and several recent incidents involved systems that no one in IT was aware of. Before proposing new technical controls, which action will provide the MOST foundational basis for building an effective information security program?

Accepted Answer

Establish and maintain a complete inventory of information assets and their owners

Answer

Deploy an endpoint detection and response (EDR) solution across all known devices

Answer

Conduct enterprise-wide security awareness training for all employees

Answer

Purchase a cyber insurance policy to transfer residual risk from unknown systems

Question 12

A newly appointed information security manager presents monthly reports to the board consisting of the number of blocked malware events, patched vulnerabilities, and firewall rule changes. Board members repeatedly ask why the security program deserves continued funding and how it supports strategic objectives. Which change to the reporting approach would BEST address the board's concern?

Accepted Answer

Report on how security initiatives reduce enterprise risk to acceptable levels and enable business objectives, expressed in business terms

Answer

Increase the frequency of the existing technical reports from monthly to weekly to demonstrate ongoing activity

Answer

Add detailed logs and raw event counts from security tools so the board can independently verify operational effectiveness

Answer

Benchmark the number of security incidents against industry peers to show the organization performs better than competitors

Question 13

During a business impact analysis (BIA) for a manufacturing company, the information security manager finds that the finance department claims its payroll system is the most critical asset requiring the shortest recovery time. However, an operations manager insists the production control system must be restored first, as a shutdown halts all revenue-generating output within hours. The two departments cannot agree on relative priority. What is the security manager's BEST next step to resolve the conflict and produce a defensible BIA?

Accepted Answer

Quantify and compare the time-based operational, financial, and regulatory impacts of each system's disruption against defined impact criteria

Answer

Assign recovery priority to the production control system because operational downtime has the most immediate revenue impact

Answer

Escalate the disagreement to executive management and let them decide which department's system takes priority

Answer

Give both systems the highest priority tier to ensure neither department's concerns are overlooked

Question 14

During the investigation of a suspected fraud incident, a security analyst copies key log files and a disk image from the affected server to a shared network folder so that several team members can review them simultaneously. The incident may later result in legal action against an employee. From an evidence-handling perspective, what is the MOST significant problem with the analyst's action?

Accepted Answer

Storing evidence in a shared, uncontrolled location breaks the chain of custody and undermines its admissibility

Answer

Copying the data consumes storage that could delay the recovery of the affected server

Answer

The analyst should have compressed the files first to reduce network bandwidth usage

Answer

Multiple reviewers will slow down the containment and eradication phases of the incident

Question 15

A multinational retailer operates in several countries, each with different breach notification timelines and data protection obligations. The information security manager discovers that one jurisdiction requires notification within 72 hours, while a contractual clause with a major partner requires immediate notification of any incident, and a third country mandates notification only after confirmed harm to individuals. To address these conflicting legal, regulatory, and contractual requirements when developing the incident response and governance approach, what should the information security manager do FIRST?

Accepted Answer

Perform a consolidated analysis of all applicable legal, regulatory, and contractual obligations to identify overlaps and conflicts

Answer

Adopt the single strictest requirement across all jurisdictions to ensure universal compliance

Answer

Escalate the matter to the legal department and defer all governance decisions until they respond

Answer

Default to the 72-hour statutory timeline because regulatory law takes precedence over contracts

Question 16

A manufacturing company signs a contract with a large retail customer that includes strict information security clauses requiring encryption of all customer data and 24-hour breach notification. The company stores this data with a third-party cloud provider whose standard service agreement offers only 72-hour breach notification and does not commit to the required encryption controls. What should the information security manager do FIRST?

Accepted Answer

Perform a gap analysis comparing the customer contractual obligations against the cloud provider's contractual commitments

Answer

Accept the cloud provider's terms and document the gap as a residual risk in the risk register

Answer

Immediately terminate the cloud provider contract and migrate data to an in-house data center

Answer

Notify the retail customer that the 24-hour breach notification requirement cannot be met

Question 17

An information security manager is establishing a security control baseline for a new application being deployed on a third-party PaaS provider. The provider publishes a SOC 2 Type II report and a shared responsibility matrix indicating it manages physical, network, and hypervisor controls. What should the manager do FIRST when tailoring the organization's control baseline for this application?

Accepted Answer

Identify which baseline controls are inherited from the provider and which remain the organization's responsibility

Answer

Adopt the provider's controls in full and remove the corresponding controls from the organization's baseline

Answer

Require the provider to implement the organization's complete internal control baseline

Answer

Schedule an independent penetration test of the provider's underlying infrastructure

Question 18

During a security review, an information security manager identifies that the organization has deployed strong perimeter firewalls but has no monitoring of lateral movement within the internal network. Recent threat intelligence indicates attackers in the industry increasingly use credential theft to move laterally after gaining an initial foothold. Which of the following BEST describes what the manager has identified?

Accepted Answer

A control deficiency, because an existing control does not adequately address a relevant threat

Answer

An accepted risk, because perimeter controls are already in place

Answer

A key risk indicator that has breached its threshold

Answer

A residual risk that has been formally transferred to a third party

Question 19

Following a ransomware incident that encrypted several file servers, an organization successfully restored operations from backups within its recovery objectives. The information security manager is now reviewing the control set to reduce the impact of any future occurrence. Which type of control was MOST directly responsible for limiting the business impact in this case, and should be prioritized for continued investment?

Accepted Answer

Corrective controls, such as tested backup and restoration capabilities

Answer

Preventive controls, such as email filtering and application allow-listing

Answer

Detective controls, such as endpoint detection and response alerting

Answer

Deterrent controls, such as warning banners and acceptable use policies

Question 20

A newly appointed information security manager discovers that business units routinely adopt unsanctioned cloud applications ('shadow IT') because the formal approval process is perceived as slow and bureaucratic. Executives value the units' agility and are reluctant to impose heavy controls. Which action would BEST address the root cause while supporting enterprise governance objectives?

Accepted Answer

Redesign the security review process to be risk-based and responsive, and embed streamlined approval into business workflows

Answer

Issue an enterprise policy that blocks all unapproved cloud services and enforce it through technical controls immediately

Answer

Report the shadow IT usage to the board as a critical compliance violation requiring disciplinary action

Answer

Purchase a cloud access security broker (CASB) to detect and log all unsanctioned application usage

Question 21

An information security manager is establishing a new data classification scheme for an organization that currently stores all data at a single sensitivity level. After defining the classification categories (public, internal, confidential, restricted), what should the manager do NEXT to make the scheme operationally effective?

Accepted Answer

Define the handling, storage, and protection requirements associated with each classification level

Answer

Deploy a data loss prevention (DLP) solution to enforce the classification categories automatically

Answer

Conduct a full inventory of all structured and unstructured data across the enterprise

Answer

Require every data owner to immediately re-label all existing data assets

Question 22

An organization has deployed a data loss prevention (DLP) technology to prevent exfiltration of confidential customer data through email and web channels. Six months later, the DLP tool generates thousands of alerts, but employees continue to inadvertently send sensitive files externally, and staff are unaware which data is considered confidential. Which action would MOST effectively improve the DLP program's outcomes?

Accepted Answer

Establish and communicate a data classification and handling standard supported by targeted user training

Answer

Tune the DLP rules to reduce the volume of false-positive alerts

Answer

Add endpoint DLP agents to cover additional exfiltration channels such as USB devices

Answer

Route all DLP alerts directly to the incident response team for investigation

Question 23

A newly appointed information security manager discovers that during a recent ransomware incident, no one initiated the containment decision because staff assumed the IT operations team, the legal department, and the CISO each held that authority. Post-incident review shows overlapping and undocumented responsibilities across several security processes. Which action will BEST prevent this type of failure in the future?

Accepted Answer

Develop and formalize a RACI chart that clearly assigns responsibility and accountability for each security process and decision

Answer

Increase the frequency of incident response tabletop exercises to build team familiarity

Answer

Purchase an automated incident response orchestration platform to trigger containment actions

Answer

Require the CISO to personally approve all containment decisions during future incidents

Question 24

A retail organization has strong preventive controls at its network perimeter, but a recent tabletop exercise revealed that if an attacker bypasses these controls, the security team would have no reliable way to identify malicious activity occurring on internal servers. The information security manager wants to close this gap most effectively. Which control should be prioritized?

Accepted Answer

Deploy centralized log collection with security monitoring and alerting on internal systems

Answer

Add a second firewall behind the perimeter to strengthen network segmentation

Answer

Require multi-factor authentication for all internal administrative accounts

Answer

Establish a documented incident response plan with defined escalation paths

Question 25

During a disaster recovery test, the information security manager observes that a critical order-processing system was restored and made operational within 5 hours, meeting its documented 6-hour recovery time objective (RTO). However, the recovered database was missing the last 3 hours of transactions before the outage, while the documented recovery point objective (RPO) for that system is 30 minutes. Which of the following is the MOST important conclusion the security manager should draw from this test result?

Accepted Answer

The backup/replication strategy is inadequate to meet the defined RPO and must be remediated

Answer

The test was successful because the system was recovered within the defined RTO

Answer

The RTO should be shortened to reduce the amount of data lost during recovery

Answer

The RPO should be relaxed to 3 hours to reflect the actual recovery capability observed

Question 26

Employees across several business units have rapidly begun using a third-party generative AI service to accelerate their work. The information security manager becomes aware of this trend but has no formal record of the tool in the risk register or any assessment of its data handling. Which action should the information security manager take FIRST to address this emerging risk?

Accepted Answer

Identify and document how the AI service is being used and what data is being exposed to it

Answer

Immediately block access to the AI service at the network perimeter

Answer

Purchase cyber insurance coverage that includes AI-related data exposure

Answer

Add a clause to the acceptable use policy prohibiting all AI tools

Question 27

An organization's help desk logs all reported events into a ticketing system. The information security manager notices that unrelated events—malware alerts, data exposure reports, and phishing attempts—are all handled by the same generic workflow, causing specialized teams to be engaged inconsistently. Which improvement to the incident management process would MOST directly address this problem?

Accepted Answer

Introduce incident categorization to route each incident type to the appropriate response resources

Answer

Assign a higher severity rating to all security-related tickets

Answer

Shorten the recovery time objective for affected systems

Answer

Increase the frequency of post-incident review meetings

Question 28

During a security event, a SOC analyst detects unusual outbound traffic from a server that hosts a customer-facing payment application. The analyst is unsure how urgently to escalate and which stakeholders to notify. Which activity, if performed FIRST, would BEST determine the appropriate escalation path and response resources?

Accepted Answer

Classify and categorize the incident based on its potential business impact and severity

Answer

Immediately isolate the server from the network to stop the outbound traffic

Answer

Notify the payment card brands and affected customers of a suspected breach

Answer

Begin capturing forensic images of the affected server for later investigation

Question 29

During a major data breach affecting customers, a journalist calls a help-desk technician directly and asks for confirmation of the number of records exposed. The technician is aware of internal chatter about the incident. What should the incident response plan direct the technician to do?

Accepted Answer

Refer the inquiry to the designated public relations spokesperson and disclose nothing further

Answer

Provide only the confirmed record count and refer the journalist to the company website for updates

Answer

State that no breach has occurred until the investigation is complete

Answer

Answer factual questions but decline to speculate about the cause

Question 30

A security analyst at a financial services firm notices unusual outbound traffic from a database server during routine monitoring. The analyst is unsure whether this rises to the level of a formal security incident that should activate the incident response team. Which of the following would MOST effectively help the analyst make this determination consistently?

Accepted Answer

Predefined incident declaration criteria based on classification and severity thresholds

Answer

A more detailed network diagram showing all database server connections

Answer

Escalating every anomaly directly to the CISO for a decision

Answer

A post-incident review report from a previous data exfiltration event

Question 31

During a contained malware incident, the response team discovers the infection has spread to the systems supporting the organization's primary customer-facing platform, and full restoration is now expected to exceed the documented maximum tolerable downtime. As the information security manager, what is the MOST appropriate next action?

Accepted Answer

Invoke the business continuity plan and escalate to crisis management, activating alternate processing arrangements

Answer

Continue technical eradication and recovery efforts without changing the response structure, since the incident team is already engaged

Answer

Reclassify the incident to a lower severity to avoid unnecessary stakeholder alarm while recovery proceeds

Answer

Wait until the maximum tolerable downtime is actually breached before triggering any continuity measures

Question 32

A SOC analyst receives an automated alert from the intrusion detection system indicating possible lateral movement on an internal subnet. Before any containment actions are taken, what should the analyst do FIRST?

Accepted Answer

Validate the alert to confirm whether an actual incident has occurred

Answer

Immediately isolate all affected hosts on the subnet to prevent spread

Answer

Escalate the alert to executive management for a containment decision

Answer

Begin eradication by removing suspected malware from the affected hosts

Question 33

A security manager wants to improve the organization's ability to detect intrusions early. The SIEM currently generates thousands of alerts daily, but most are false positives, and a recent breach went undetected for weeks because malicious activity blended in with normal traffic. Which action would MOST effectively improve the organization's detection capability?

Accepted Answer

Establish baselines of normal system and network behavior to enable anomaly-based detection and correlation

Answer

Increase the retention period of SIEM logs to support future forensic investigations

Answer

Add more signature-based detection rules to the SIEM to catch additional known threats

Answer

Escalate every SIEM alert to the incident response team for manual review

Question 34

Six months after deploying a SIEM, the incident response team reports that analysts are ignoring most alerts because the vast majority turn out to be benign, and a recent malware infection went unnoticed for two weeks despite generating log entries. Which action should the information security manager prioritize to improve incident detection effectiveness?

Accepted Answer

Tune and correlate SIEM detection rules to reduce false positives and surface genuine threats

Answer

Increase the number of analysts assigned to monitor the SIEM console during business hours

Answer

Replace the SIEM with an endpoint detection and response (EDR) platform

Answer

Extend log retention so that historical events are available for future investigations

Question 35

During a security incident, the response team has successfully contained a compromised web server by isolating it from the network. Application services are being restored to a standby environment to maintain business operations. Before declaring the incident resolved, the incident manager insists on one additional step during the eradication phase. Which action is MOST important to complete before recovery is finalized?

Accepted Answer

Identify and remove the underlying vulnerability that allowed the initial compromise

Answer

Notify affected customers and regulators of the confirmed breach

Answer

Conduct a post-incident review to document lessons learned

Answer

Restore the isolated server from the most recent full backup

Question 36

During a confirmed intrusion, an attacker has established a foothold on a single server in a segmented DMZ but has not yet moved laterally. The incident response team is under pressure from operations to keep the customer-facing application online. The information security manager must decide on a containment strategy. Which factor should MOST influence the choice between immediate isolation and delayed containment?

Accepted Answer

The balance between preserving business operations and limiting the risk of further compromise or evidence loss

Answer

The preference of the operations team to avoid any application downtime

Answer

The amount of disk space available for capturing forensic images

Answer

The time remaining before the next scheduled vulnerability scan

Question 37

A security analyst receives multiple SIEM alerts indicating suspicious lateral movement across several servers in a data center. The incident response team has confirmed the activity is malicious. Before selecting a containment approach, what is the MOST important activity the team should complete during the analysis phase?

Accepted Answer

Determine the full scope of affected systems and the extent of the compromise

Answer

Immediately disconnect all servers exhibiting suspicious activity from the network

Answer

Notify law enforcement so a criminal investigation can begin promptly

Answer

Draft the post-incident report to document lessons learned

Question 38

A newly appointed information security manager reviews the organization's incident management capability and finds that the response team performs well during active incidents but consistently struggles because tools, access credentials, and contact lists are gathered on the fly. Which phase of the incident management lifecycle should the manager strengthen FIRST to address the root cause of these repeated struggles?

Accepted Answer

Preparation — establishing tools, access, and resources in advance

Answer

Detection and analysis — improving alert triage accuracy

Answer

Containment, eradication, and recovery — refining response playbooks

Answer

Post-incident activity — capturing lessons learned

Question 39

Following a sophisticated malware incident, the response team has removed the malicious code, patched the exploited vulnerability, and restored affected systems from clean backups. Business operations have resumed normally. Before formally declaring the incident closed, what should the incident manager ensure is done FIRST?

Accepted Answer

Conduct enhanced monitoring of the restored systems and environment for signs of recurrence or residual compromise

Answer

Schedule the post-incident review meeting with all stakeholders

Answer

Update the asset inventory to reflect the rebuilt systems

Answer

Submit the final incident cost report to executive management

Question 40

Following a widespread malware outbreak that forced a shutdown of multiple systems, the incident response team has completed eradication and validated that all affected hosts are clean. The information security manager must now guide the recovery phase. Several business units are demanding immediate restoration of their applications. What should PRIMARILY determine the sequence in which systems are brought back online?

Accepted Answer

The recovery priorities established in the business impact analysis

Answer

The order in which each business unit submitted its restoration request

Answer

The relative technical complexity of restoring each system

Answer

The number of users affected by each unavailable system

Question 41

Following the eradication of malware from a compromised customer-facing application, the incident response team has rebuilt the affected servers from known-good images. The business unit is pressuring the information security manager to return the application to production immediately to minimize revenue loss. Before authorizing the transition of the system back to normal operations, what should the information security manager ensure has been established FIRST?

Accepted Answer

Predefined recovery validation criteria confirming the system meets a known-good, secure operating state

Answer

A signed acceptance-of-risk memo from the business unit owner acknowledging the reduced revenue

Answer

An updated business impact analysis reflecting the outage duration and financial loss

Answer

A press statement prepared for customers explaining the service interruption

Question 42

During a malware incident, the incident response team has isolated the affected servers and removed the identified malicious files. Management is pressuring the information security manager to restore the servers to production immediately to minimize downtime. What should the information security manager do BEFORE authorizing recovery to production?

Accepted Answer

Verify that the root cause has been eradicated and that no persistence mechanisms remain

Answer

Restore the systems from the most recent backup and monitor for reinfection

Answer

Complete the post-incident review and document lessons learned

Answer

Notify all affected business units that services are being restored

Question 43

During a post-incident review, an information security manager discovers that the organization detected a sophisticated intrusion three weeks after the initial compromise, well after data had been exfiltrated. The SIEM was properly tuned and alerts were triaged promptly, but no rule existed to detect the specific attacker technique used. Which improvement would MOST effectively reduce the detection time for similar future attacks?

Accepted Answer

Integrate external threat intelligence feeds to develop detection rules for emerging adversary techniques

Answer

Increase the frequency of vulnerability scans across the environment

Answer

Shorten the alert triage service-level target for the security operations team

Answer

Expand the log retention period to preserve more historical data

Question 44

A security analyst monitoring the SIEM detects confirmed malware spreading laterally across multiple servers in a production environment. The incident response plan is activated. As the analyst begins isolating affected hosts, a business unit manager calls demanding immediate details and a public statement. According to good incident management practice, what should the analyst do FIRST regarding this request?

Accepted Answer

Refer the request to the incident response plan's designated communication channel and continue technical response activities

Answer

Provide the manager a full technical briefing so the business unit can decide on a public statement

Answer

Draft and release a preliminary public statement to prevent reputational damage

Answer

Escalate directly to the CEO to obtain approval for disclosing incident details

Question 45

An information security manager is developing the organization's first formal incident response plan. During a tabletop discussion, several managers argue over who has the authority to shut down a production system during an active incident. To prevent this confusion from recurring during a real event, what should the security manager address FIRST in the plan?

Accepted Answer

Predefined roles, responsibilities, and decision-making authority for incident response

Answer

A detailed technical playbook for isolating compromised production systems

Answer

The forensic evidence-handling and chain-of-custody procedures

Answer

The recovery time objectives (RTO) for each production system

Question 46

An information security manager is developing an incident response plan for an organization that already maintains a business continuity plan (BCP) and a disaster recovery plan (DRP). To ensure these plans work together effectively during a major disruptive cyber incident, which of the following is the MOST important action the manager should take?

Accepted Answer

Define clear activation triggers and escalation criteria that hand off between the incident response, business continuity, and disaster recovery plans

Answer

Ensure the incident response plan specifies the same recovery point objectives (RPO) already documented in the disaster recovery plan

Answer

Assign the incident response team leader as the owner of the business continuity and disaster recovery plans

Answer

Consolidate all three plans into a single document to eliminate duplicated procedures

Question 47

An information security manager is finalizing the organization's incident response plan and wants to ensure that the effectiveness of the response process can be objectively evaluated over time. During plan development, which element is MOST important to define so that future incident performance can be meaningfully measured?

Accepted Answer

Predefined, measurable performance targets such as maximum detection and response times aligned to incident severity

Answer

The names and contact details of every member of the incident response team

Answer

A list of forensic tools approved for evidence collection during investigations

Answer

The escalation path for notifying executive management of major incidents

Question 48

Following a significant data breach, an organization completed its post-incident review and documented several lessons learned, including gaps in detection tooling and unclear escalation thresholds. Six months later, a similar incident occurs and the response team struggles with the same escalation confusion. What did the information security manager MOST likely fail to do?

Accepted Answer

Feed the post-incident review findings back into updates of the incident response plan and procedures

Answer

Assign a legal hold to preserve evidence from the original breach

Answer

Escalate the original breach to executive management in a timely manner

Answer

Calculate the mean time to respond (MTTR) for the original incident

Question 49

An information security manager wants to validate that the organization's newly documented incident response plan will function correctly during a real event, without disrupting production systems or requiring staff to perform actual technical recovery steps. The manager needs the response team to walk through their roles, decision points, and communication flows for a simulated ransomware scenario. Which testing method is MOST appropriate to meet these objectives?

Accepted Answer

A tabletop exercise that discusses responses to a simulated scenario

Answer

A full interruption test that fails over to the alternate recovery site

Answer

A parallel test that processes live transactions at the recovery site

Answer

An unannounced technical penetration test against production systems

Question 50

An information security manager oversees an incident response program that has passed its annual tabletop exercise for the past three years. During the last exercise, the organization migrated most of its critical workloads to a new cloud service provider and adopted a new SaaS-based collaboration platform. Which factor should MOST strongly drive the manager to conduct an additional, out-of-cycle test of the incident response plan?

Accepted Answer

Significant changes to the technology environment may have invalidated existing response assumptions and procedures

Answer

The prior tabletop exercises were all completed successfully with no major findings

Answer

The annual test schedule mandated by policy has not yet arrived for the current year

Answer

The incident response team members have not rotated since the last exercise

Question 51

During a major data breach, the incident response team is fully engaged in containment and eradication activities. Several hours in, executive leadership, legal, and public relations begin independently reaching out to technical responders for updates, disrupting the technical work. The information security manager realizes the incident response plan lacked a critical component. Which element should have been defined in the plan to prevent this situation?

Accepted Answer

A communication plan that designates a single point of contact and defines stakeholder notification channels and cadence

Answer

A more detailed technical containment runbook for the affected systems

Answer

A revised incident severity classification matrix with additional tiers

Answer

An expanded chain-of-custody procedure for preserving forensic evidence

Question 52

During a risk assessment for a new customer-facing payment portal, a business unit leader argues that the risk should be rated as 'low' because the organization already has strong web application firewalls, encryption, and multifactor authentication in place. The information security manager wants the assessment to first establish an accurate baseline before comparing it against these safeguards. Which risk value should the information security manager insist on documenting first?

Accepted Answer

The inherent risk, assessed as if no controls were in place

Answer

The residual risk, reflecting the effect of existing controls

Answer

The accepted risk, as approved by the business unit leader

Answer

The transferred risk, based on the cyber insurance coverage

Question 53

A development team has adopted a DevOps model that releases code to production multiple times per day through an automated CI/CD pipeline. The information security manager finds that the existing manual security review, which occurred once per release cycle, can no longer keep pace and is being bypassed to meet delivery deadlines. Which approach BEST enables security to remain effective in this environment?

Accepted Answer

Integrate automated security testing tools directly into the CI/CD pipeline so scans run as part of the build process

Answer

Reinstate the manual security review as a mandatory gate before every production deployment

Answer

Schedule quarterly penetration tests of the production environment to catch accumulated vulnerabilities

Answer

Require developers to complete additional secure coding training before pipeline access is granted

Question 54

A newly appointed information security manager finds that security decisions are made informally within the IT department and are not visible to or endorsed by the enterprise's existing corporate governance structures (board committees, risk committee, and audit committee). The manager wants information security to become a sustainable part of how the organization is directed and controlled. Which action would BEST achieve this objective?

Accepted Answer

Integrate information security oversight into the existing enterprise governance framework so that security objectives, risk, and reporting align with board-level committees

Answer

Deploy a governance, risk, and compliance (GRC) tool to automate the collection of security control evidence across the IT department

Answer

Create a standalone information security governance body that operates independently of the enterprise's corporate governance structures

Answer

Publish a comprehensive set of security policies and require all IT staff to formally acknowledge them

Question 55

An information security manager discovers that several business units have independently purchased SaaS applications that store customer data, with no security review performed before contracts were signed. To prevent this from recurring, what is the MOST effective action?

Accepted Answer

Embed mandatory security requirements and review gates into the enterprise procurement process before contracts can be executed

Answer

Issue a company-wide memo reminding staff that unauthorized SaaS purchases are prohibited

Answer

Conduct a post-implementation security assessment of each SaaS application already acquired

Answer

Require the affected business units to attend additional security awareness training

Question 56

A development team at a financial services firm follows an agile methodology and releases new features every two weeks. The information security manager discovers that security requirements are only reviewed during a penetration test conducted just before production deployment, frequently causing last-minute delays and costly rework. Which action would MOST effectively address the root cause of this problem?

Accepted Answer

Embed security requirements and threat modeling into the design and planning phases of each sprint

Answer

Increase the frequency of penetration testing to weekly so issues are caught sooner

Answer

Require the CISO to sign off on every production release before deployment

Answer

Add a mandatory automated vulnerability scan as the final gate before release

Question 57

A SaaS provider contract is ending, and the business unit is migrating to a new vendor. The information security manager is asked to ensure the transition does not introduce risk. Which action is MOST important to complete during the offboarding of the outgoing vendor?

Accepted Answer

Confirm the return or verified destruction of the organization's data and revocation of all access held by the vendor

Answer

Conduct a final penetration test against the new vendor's production environment

Answer

Update the security awareness training to reference the new vendor's portal

Answer

Recalculate the annualized loss expectancy for the retired service

Question 58

A newly appointed information security manager wants senior executives to approve funding for a multi-year security program. Previous requests were rejected because leadership viewed security spending as a cost with no measurable return. Which approach will BEST secure executive approval for the program?

Accepted Answer

Present a business case that links proposed security investments to reduced business risk, regulatory compliance, and enablement of strategic business objectives

Answer

Provide a detailed technical report showing gaps identified in the latest vulnerability scan and penetration test

Answer

Benchmark the organization's security spending against industry peers to show the company is underspending

Answer

Cite recent high-profile breaches at competitors and estimate the reputational damage the organization would suffer from a similar event

Question 59

An information security manager established a key risk indicator (KRI) that tracks the percentage of privileged accounts without multifactor authentication. The KRI was set with a threshold of 5%. Over the last three monthly reporting cycles the value has climbed from 4% to 6% to 9%, breaching the threshold. What is the security manager's BEST first action?

Accepted Answer

Escalate the trend to the accountable risk owner so a risk response decision can be made

Answer

Lower the KRI threshold to 10% so the metric no longer shows a breach

Answer

Immediately disable all privileged accounts that lack multifactor authentication

Answer

Remove the KRI from the risk dashboard because it is generating too many alerts

Question 60

An information security manager is designing key risk indicators (KRIs) for a program that has repeatedly been surprised by ransomware incidents. The manager wants indicators that give the business advance warning so preventive action can be taken before losses occur. Which of the following would be the MOST useful KRI to add for this purpose?

Accepted Answer

The percentage of critical servers missing security patches beyond the defined SLA

Answer

The number of ransomware incidents experienced in the previous quarter

Answer

The total financial loss attributed to malware incidents year-to-date

Answer

The average time taken to recover systems after the last outage

Question 61

A newly appointed CISO has operated the information security governance program for one year. The board now asks for evidence that governance itself—not just individual controls—is effective and delivering value. Which of the following would BEST demonstrate the effectiveness of the governance program to the board?

Accepted Answer

Evidence that security objectives are consistently aligned with and traceable to enterprise strategic goals, supported by key goal indicators

Answer

A report showing the percentage of security incidents resolved within the defined service-level targets over the past year

Answer

A summary of firewall rule changes, patch deployment rates, and vulnerability scan results across the environment

Answer

Confirmation that the security team completed all planned security awareness training sessions on schedule

Question 62

An organization is finalizing a contract with a SaaS provider that will process sensitive customer data. During review, the information security manager notices the agreement contains no provision allowing the organization to validate the vendor's ongoing security posture. Which contractual element is MOST important to add before signing?

Accepted Answer

A right-to-audit clause permitting security assessments or acceptance of independent attestation reports

Answer

A clause requiring the vendor to carry cyber insurance covering data breaches

Answer

A service-level agreement defining maximum acceptable system downtime

Answer

A clause obligating the vendor to encrypt data in transit using TLS

Question 63

An organization has outsourced its 24/7 security monitoring to a managed security service provider (MSSP). Six months into the engagement, the information security manager notices that although the MSSP delivers monthly reports, several confirmed incidents were escalated hours later than the contract's stated response times, and internal teams were unsure who owned remediation. Which action should the information security manager take FIRST to strengthen oversight of this external service?

Accepted Answer

Establish and monitor service level agreements with defined response metrics and clear escalation and responsibility handoffs

Answer

Terminate the MSSP contract and rebuild the monitoring capability internally

Answer

Increase the frequency of MSSP reporting from monthly to weekly

Answer

Require the MSSP to provide additional security certifications for its analysts

Question 64

An information security manager plans to commission an annual penetration test of a customer-facing application. The application is hosted in a third-party cloud provider's environment under a shared responsibility model. Before the test begins, what is the MOST important action the security manager should take?

Accepted Answer

Obtain the cloud provider's written authorization and confirm the scope permitted under the contract

Answer

Ensure the penetration testers hold recognized industry certifications

Answer

Schedule the test during off-peak hours to minimize business disruption

Answer

Require the testers to sign a non-disclosure agreement covering findings

Exam domain	Exam weight	Practice
Information Security Governance	17%	Practice this topic
Information Security Risk Management	20%	Practice this topic
Information Security Program	33%	Practice this topic
Incident Management	30%	Practice this topic

ISACA CISM — Certified Information Security Manager (CISM) practice exam & study guide

Start studying CISM

All CISM study resources

CISM exam domains

Sample CISM questions

Key CISM terms

CISM frequently asked questions

Information Security Governance (17%)

Information Security Risk Management (20%)

Information Security Program (33%)

Incident Management (30%)