Free CISM Practice Test & Questions

Q1.During an active security incident, the containment team must decide between two strategies: isolating the compromised segment immediately, which will disrupt a critical business process for approximately 4 hours; or implementing a targeted containment that takes longer but maintains partial business operations. Which factor should MOST influence this decision?

• A.The number of incident response team members currently available
• B.The preference of the legal counsel regarding potential liability
• C.Whether the incident occurred during business hours or after hours
• D.The rate at which the threat is actively spreading and the scope of ongoing damage

Domain: Incident Management

Q2.A multinational corporation is implementing a cross-border data transfer mechanism to move employee data from its EU subsidiary to its US headquarters. The information security manager must advise on the MOST appropriate legal mechanism following the invalidation of the EU-US Privacy Shield. What should be recommended?

• A.Implement Standard Contractual Clauses supplemented by a Transfer Impact Assessment
• B.Continue relying on the EU-US Privacy Shield framework
• C.Establish Binding Corporate Rules as the sole transfer mechanism
• D.Encrypt all data before transfer and consider the legal basis satisfied

Domain: Information Security Governance

Q3.An organization is mapping its security controls to the NIST Cybersecurity Framework (CSF) to improve communication with regulators and business partners. The security team asks which benefit is MOST significant from adopting a recognized control framework.

• A.Providing a common language and structured methodology for assessing and communicating security posture
• B.Reducing the total number of controls the organization must implement
• C.Guaranteeing compliance with all applicable regulations automatically
• D.Eliminating the need for independent risk assessments

Domain: Information Security Program

Q4.A risk owner has been informed that a newly identified vulnerability in a critical business application has a high likelihood of exploitation. The cost to remediate the vulnerability exceeds the potential loss from exploitation. Which risk treatment option is MOST appropriate?

• A.Implement the full remediation regardless of cost
• B.Accept the risk with formal documentation and ongoing monitoring
• C.Avoid the risk by decommissioning the business application
• D.Transfer the risk by purchasing cyber insurance

Domain: Information Security Risk Management

Q5.During a confirmed ransomware incident affecting multiple departments, the CSIRT lead needs to communicate status updates. Multiple stakeholders are requesting information simultaneously, including the CEO, legal counsel, affected department heads, and the media. What communication approach is MOST appropriate?

• A.Allow any incident response team member to respond to any stakeholder requests directly
• B.Follow the pre-established communication plan with designated spokespersons and tiered messaging for each audience
• C.Withhold all information until the incident is fully resolved to avoid premature disclosure
• D.Share complete technical details with all stakeholders simultaneously for full transparency

Domain: Incident Management

Q6.An organization is deciding between adopting COBIT and ISO 27001 as its primary security governance framework. The organization is a publicly traded financial services firm subject to multiple regulatory requirements. Which factor is MOST important when making this selection?

• A.Alignment of the framework with the organization's regulatory obligations and business goals
• B.Which framework the organization's primary competitor uses
• C.Availability of certification programs for the chosen framework
• D.Total implementation cost including consulting and tooling

Domain: Information Security Governance

Q7.An organization is evaluating its service continuity management capabilities. The information security manager discovers that while disaster recovery plans exist for IT systems, there are no plans for maintaining critical business processes during an extended outage. What gap does this represent?

• A.A business continuity planning gap where business process recovery is not addressed alongside IT disaster recovery
• B.A disaster recovery planning deficiency requiring additional IT recovery procedures
• C.An incident response gap in the escalation and communication procedures
• D.A capacity planning issue affecting the organization's ability to scale during outages

Domain: Information Security Program

Q8.During a risk assessment workshop, a department head insists that the risk of a ransomware attack on their department is low because they have never experienced one. The security team's analysis indicates the risk is high. How should the risk manager handle this disagreement?

• A.Present objective threat intelligence and industry data to support the risk rating methodology
• B.Override the department head's opinion and record the risk as high
• C.Escalate the disagreement to the CEO for a final decision
• D.Accept the department head's lower risk rating to maintain the relationship

Domain: Information Security Risk Management

Q9.During a ransomware incident affecting operational technology (OT) systems at a manufacturing plant, the IT incident response team wants to immediately isolate the affected OT network. The plant manager warns that abrupt isolation could cause physical safety hazards. What should the incident commander prioritize?

• A.Coordinating with plant operations to implement containment measures that maintain physical safety while limiting the spread of the ransomware
• B.Immediately isolating the OT network regardless of the plant manager's safety warnings because cyber containment takes priority
• C.Ignoring the ransomware and continuing normal operations to avoid any physical safety risks
• D.Deferring all containment decisions to the IT team because cybersecurity incidents are an IT responsibility

Domain: Incident Management

Q10.An organization subject to PCI DSS requirements has recently migrated its payment processing to a cloud-based platform. The information security manager is determining how to address compliance in this new environment. Which approach BEST ensures continued PCI DSS compliance?

• A.Review the cloud provider's Attestation of Compliance and document the shared responsibility matrix
• B.Assume the cloud provider is fully responsible for PCI DSS compliance
• C.Conduct annual on-site assessments of the cloud provider's data centers
• D.Revert to on-premises payment processing to simplify compliance

Domain: Information Security Governance