8 CISM Questions Most Candidates Get Wrong
Here are 8 CISM-style multiple-choice questions designed to match the difficulty and analytical nature of the ISACA exam. These questions focus on governance, risk management, and incident response, requiring you to choose the best answer rather than just a technically correct one.
Question 1
An organization's executive management has approved a new business initiative that requires the use of a third-party cloud provider. The CISM has identified that the provider's security controls do not meet the organization's baseline standards. What is the CISM's PRIMARY course of action? Want to go further? 10 SC-900 Questions Most Candidates Get Wrong is a good next step.
A. Reject the business initiative until the provider meets all standards.
B. Document the risk and present it to executive management for an informed decision.
C. Implement compensating controls at the network layer to mitigate the gap.
D. Select a different cloud provider that fully complies with the standards.
Answer: B
Explanation: The CISM's role is to enable business objectives while managing risk. Since executive management approved the initiative, the CISM must present the residual risk (the control gaps) and the cost of mitigation to them so they can make a risk acceptance decision based on full information. Rejecting the initiative (A) oversteps the advisory role, while (C) and (D) are tactical solutions that bypass the proper governance and risk acceptance process.
Question 2
Which of the following is the MOST critical factor in ensuring the success of an information security strategy?
A. The implementation of advanced security technologies.
B. The alignment of the strategy with business goals and objectives.
C. The number of security awareness training hours completed by staff.
D. The frequency of vulnerability scans performed on internal systems.
Answer: B
Explanation: The primary purpose of an information security strategy is to support the organization's mission and objectives. If the strategy is not aligned with business goals, it will lack executive support and be treated as a cost center rather than an enabler. (A), (C), and (D) are operational tactics that, while important, are meaningless if they do not directly support the strategic business direction.
Question 3
During a post-incident review, the CISM discovers that the incident response team could not access the necessary forensic tools because the credentials were stored on a server that was encrypted by the ransomware. Which of the following would have MOST effectively prevented this issue?
A. Performing daily backups of the forensic tools.
B. Storing break-glass access credentials in a secure, offline vault.
C. Implementing a more robust antivirus solution on the server.
D. Purchasing additional forensic software licenses.
Answer: B Our post on 10 CRISC Questions Most Candidates Get Wrong covers this further.
Explanation: The scenario describes a failure of credential management during a crisis. Break-glass access procedures ensure that emergency accounts and passwords are stored securely and are accessible even when primary systems (like the credential vault server) are compromised. (A) helps with tool availability but not credential access, (C) addresses the root cause of the malware but not the access issue, and (D) is irrelevant to the immediate access failure.
Question 4
An organization is implementing a new policy requiring multi-factor authentication (MFA) for all remote access. A business unit manager argues this will impede productivity and requests an exception. What is the CISM's BEST response?
A. Deny the exception request immediately to ensure security is not weakened.
B. Accept the exception request to maintain a positive relationship with the business unit.
C. Evaluate the exception request formally, documenting the associated risk and compensating controls.
D. Ask the business unit manager to submit the request in writing for the audit trail.
Answer: C
Explanation: A formal exception process is a cornerstone of risk management. The CISM should not arbitrarily deny (A) or accept (B) exceptions; they must be evaluated based on risk. (D) is a component of the process but not the "best" response, as it lacks the risk evaluation. The CISM must analyze the specific risk of the exception and determine if compensating controls make the residual risk acceptable.
Question 5
Which of the following is the PRIMARY objective of a Business Impact Analysis (BIA) within the context of information security management?
A. To identify specific vulnerabilities in the network infrastructure.
B. To determine the criticality of business processes and their resource dependencies.
C. To calculate the return on investment for security controls.
D. To assign blame for past security incidents and system failures.
Answer: B
Explanation: The BIA is the foundational step for business continuity and disaster recovery planning. It identifies which processes are most critical to the organization's survival and quantifies the impact of their disruption, including the IT resources they depend on. (A) is part of vulnerability management, (C) is cost-benefit analysis, and (D) is a post-incident review activity, not a BIA objective.
Question 6
A security manager is reviewing the results of a recent penetration test. The test successfully exploited a known vulnerability in a web application. Which of the following metrics would provide the MOST useful information for prioritizing the remediation of this vulnerability?
A. The number of attempts it took to exploit the vulnerability.
B. The Common Vulnerability Scoring System (CVSS) base score.
C. The potential business impact if the vulnerability is exploited. If this interests you, 8 CompTIA Linux+ Questions Most Candidates Get Wrong goes into more detail.
D. The name of the penetration testing team that found the vulnerability.
Answer: C
Explanation: While CVSS scores (B) provide a technical severity rating, they do not reflect the specific business context. For prioritization, the CISM must understand the value of the affected asset and the potential financial, legal, or reputational impact to the organization. A vulnerability in a customer database is more critical than the same vulnerability in a public brochure website, regardless of the CVSS score.
Question 7
An employee has been terminated and their access rights have been revoked. However, three weeks later, the CISM discovers that the employee's personal mobile device is still able to access the corporate email server. What is the MOST likely root cause of this issue?
A. The employee has guessed their former password.
B. The IT department failed to disable the device's certificate-based authentication.
C. The employee is using a stolen laptop to access the network.
D. The email server is not configured with a strong password policy.
Answer: B
Explanation: This is a classic identity and access management (IAM) failure. Certificate-based authentication on mobile devices is often tied to a device certificate that is separate from the user's Active Directory password. If the IT team only disabled the user account but did not revoke the device certificate or add the device to a blocklist, the device can still authenticate and access resources. (A) is unlikely if the password was reset, (C) is possible but less likely than a direct certificate issue, and (D) is irrelevant to the specific scenario.
Question 8
The CISM is asked to provide a budget for the upcoming fiscal year. Which of the following approaches BEST demonstrates the value of the security program to executive management?
A. Presenting a list of all security software and hardware that needs to be purchased.
B. Comparing the proposed security budget as a percentage of the overall IT budget.
C. Linking the budget request to specific business risks and the reduction of potential financial losses.
D. Justifying the budget based on industry benchmarks and best practices.
Answer: C
Explanation: Executive management responds to business risk and financial impact. To secure funding, the CISM must frame the budget in terms of risk reduction (e.g., "Investing $100k in X will reduce our exposure to a $5M data breach"). (A) is a shopping list, (B) and (D) are useful benchmarks but do not connect the expenditure to business value or risk mitigation.
These questions highlight the shift from a technical "security expert" mindset to a strategic "risk advisor" mindset required for the CISM certification. Remember to focus on governance, risk alignment, and enabling business objectives in your answers.
Before moving on, a free CISM readiness check gives you a quick set of practice questions with explanations and a snapshot of weak topics.
Finish your study plan with full-length ISACA Certified Information Security Manager (CISM) mock tests — they are the last step before booking your exam.
A free CISM study plan shapes that final stretch into a schedule matched to your preparation time.