CISM Practice Questions: Information Risk and Incident Response Scenarios
Introduction
Preparing for the Certified Information Security Manager (CISM) exam requires more than just memorizing concepts; you must apply your knowledge to realistic scenarios. The exam tests your ability to make decisions that align with business goals while managing risk and responding to incidents. In this article, we present 8-10 CISM practice questions focusing on information risk and incident response. Each question is followed by the correct answer and a detailed explanation of why it is correct and why the other options are not. These questions mirror the style and difficulty of the actual exam.
Question 1
An organization has experienced a data breach involving customer personal data. Which of the following should be the first step in the incident response process? If this interests you, CEH Practice Questions: Network Scanning and Exploitation Scenarios goes into more detail.
- A. Eradicate the threat from affected systems
- B. Notify law enforcement
- C. Contain the incident to prevent further damage
- D. Perform a root cause analysis
Correct Answer: C
Explanation: The incident response process typically follows: Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. The first priority after detecting an incident is to contain it to limit the impact. Notifying law enforcement (B) may be necessary but is not the first step. Eradication (A) and root cause analysis (D) occur after containment. Therefore, C is the correct answer.
Question 2
During a risk assessment, a security manager identifies that the likelihood of a cyberattack is low, but the potential impact is high. The organization decides to purchase cyber insurance to mitigate the financial risk. This risk treatment strategy is known as:
- A. Risk avoidance
- B. Risk reduction
- C. Risk transfer
- D. Risk acceptance
Correct Answer: C
Explanation: Risk transfer involves shifting the financial impact of a risk to a third party, such as through insurance. Risk avoidance (A) would eliminate the risk entirely, risk reduction (B) would implement controls to lower likelihood or impact, and risk acceptance (D) would acknowledge the risk without action. Thus, C is correct.
Question 3
An organization has a critical application that generates revenue. The security team proposes to implement a new authentication mechanism that will require all users to change their passwords every 30 days. The business unit opposes this due to user productivity concerns. What should the security manager do?
- A. Implement the policy as proposed because security is paramount
- B. Evaluate the risk and business impact, and recommend a balanced approach
- C. Escalate to the CEO to enforce the policy
- D. Accept the business unit's objection and drop the requirement
Correct Answer: B
Explanation: CISM emphasizes aligning security with business goals. The security manager should assess the risk and work with the business to find a compromise, such as longer password intervals or multi-factor authentication, that meets security needs without undue productivity loss. Implementing unilaterally (A) or escalating (C) ignores business input, while dropping the requirement (D) may leave unacceptable risk. Therefore, B is best.
Question 4
Which of the following is the most important factor when determining the priority of incident response activities?
- A. The number of systems affected
- B. The criticality of the affected assets to business operations
- C. The type of malware involved
- D. The time of day the incident occurred
Correct Answer: B Related reading: CISM Passing Score: The ISACA 450/800 Threshold Unpacked.
Explanation: Incident response prioritization should focus on the impact to business operations. Assets that are critical to the organization's mission should be addressed first, regardless of the number of systems (A) or the specific malware (C). Time of day (D) is irrelevant. Thus, B is correct.
Question 5
A security manager is developing a risk communication plan. Which of the following is the primary objective of risk communication?
- A. To ensure all stakeholders understand the risks and the measures in place
- B. To report all risks to regulatory authorities
- C. To provide a detailed technical report to the IT department
- D. To justify security budget increases
Correct Answer: A
Explanation: Risk communication aims to inform stakeholders about risks and the organization's risk management efforts, enabling informed decision-making. It is not limited to regulatory reporting (B), technical details (C), or budget justification (D). Therefore, A is correct.
Question 6
During an incident, the incident response team discovers that the attacker used a zero-day vulnerability. Which of the following actions should be taken first to prevent similar attacks in the future?
- A. Immediately patch all systems with the vendor's update
- B. Implement compensating controls to mitigate the vulnerability
- C. Disconnect all affected systems from the network
- D. Document the incident and move on
Correct Answer: B
Explanation: A zero-day vulnerability means no vendor patch is available. The first priority is to implement compensating controls, such as network segmentation, firewall rules, or intrusion prevention signatures, to reduce the risk. Patching (A) is not possible if no patch exists. Disconnecting all systems (C) may be too disruptive and is not the first step. Documentation (D) is important but not the immediate action. Thus, B is correct.
Question 7
Which of the following is the best indicator that an organization's incident response plan is effective?
- A. The plan is updated annually
- B. The plan was tested through tabletop exercises and lessons learned were incorporated
- C. The plan is stored in a secure location
- D. The plan includes contact information for all employees
Correct Answer: B
Explanation: An effective incident response plan is regularly tested and improved based on exercises and real incidents. Updating annually (A) is good but does not guarantee effectiveness. Storing securely (C) and having contacts (D) are necessary but not sufficient for effectiveness. Testing and incorporating lessons learned (B) is the best indicator. This topic pairs well with CISM Difficulty: Why Security Managers Fail Their First Attempt.
Question 8
A security manager is evaluating the risk of a new cloud service. The service provider offers a service-level agreement (SLA) with 99.9% uptime. Which of the following is the most important additional factor to consider?
- A. The cost of the service
- B. The provider's security certifications
- C. The organization's ability to monitor and audit the provider
- D. The number of other customers using the service
Correct Answer: C
Explanation: While certifications (B) are important, the organization must ensure it can maintain visibility and control over its data and operations in the cloud. The ability to monitor and audit (C) is crucial for ongoing risk management. Cost (A) and number of customers (D) are less critical.
Question 9
During a post-incident review, the team identifies that the incident was caused by an employee falling for a phishing email. Which of the following is the most effective control to prevent recurrence?
- A. Implement a spam filter
- B. Conduct security awareness training for all employees
- C. Disable email attachments
- D. Increase password complexity requirements
Correct Answer: B
Explanation: Phishing attacks exploit human behavior. Security awareness training (B) educates employees to recognize and report phishing attempts, which is the most effective preventive control. Spam filters (A) help but are not foolproof. Disabling attachments (C) is impractical and not a complete solution. Password complexity (D) does not address phishing directly. Therefore, B is correct.
Question 10
Which of the following is the primary purpose of a business impact analysis (BIA) in the context of incident response?
- A. To identify the financial cost of potential incidents
- B. To determine the maximum tolerable downtime for critical business processes
- C. To list all hardware and software assets
- D. To assign roles and responsibilities to incident response team members
Correct Answer: B
Explanation: A BIA helps identify the impact of disruptions on business processes and determines recovery priorities, including the maximum tolerable downtime (MTD) and recovery time objectives (RTO). While cost (A) is a component, the primary purpose is to understand time-criticality. Listing assets (C) is part of asset management, and assigning roles (D) is part of plan development.
Conclusion
These practice questions cover key areas of information risk management and incident response, reflecting the real CISM exam's scenario-based approach. Use them to assess your understanding and identify areas for further study. For more comprehensive preparation, consider additional practice tests and review of ISACA's CISM Review Manual.
A free CISM study plan can turn that preparation into a week-by-week schedule that fits your available time.
Use ISACA Certified Information Security Manager (CISM) practice questions to confirm that what you have studied actually translates to correct answers.
To quickly see which topics still need review, answer the free CISM readiness check questions.