If you’re looking to prepare for the Certified Information Security Manager (CISM) exam, then this blog and free resources on csexams.com will help you.
This article will provide you with 10 CISM sample exam questions to help you get a feel for the types of questions you can expect to see on the real exam.
The CISM exam is a four-hour, 150-question multiple-choice exam that tests your knowledge and skills in four key domains:
- Information security governance
- Information risk management
- Information security program development and management
- Information security incident management.
To help you prepare for the exam, we’ve provided 10 sample questions below.
CISM Sample Questions
1. Which outcomes would a company without a security architecture function be most likely to experience?
A. Security-related procedures that are inconsistent
B. Inconsistent standard application
C. Less mature procedure
D. Tools for vulnerability management becomes more complex.
Answer: B.
Explanation:
It is more likely that standards won’t be applied consistently in a company without a security architecture function. “Reference architectures,” which are documents that specify in detail how technology is installed, configured, and even managed in an organisation, would probably be a part of a security architecture role.
Even if inconsistent technology may also lead to uneven practises, this is not the most obvious outcome. It’s possible or unlikely that the absence of security architecture serves as a good proxy for overall process maturity.
Although it can be true that a lack of security architecture will make vulnerability management solutions more difficult to use, this is not the optimal solution.
2. The patch management team implements security fixes in response to the testing team’s quarterly vulnerability scan results. What process improvement would be most beneficial to introduce?
A. The team actively applies updates and performs vulnerability scans to ensure that patching is effective.
B. The team actively applies updates and performs security scans to ensure patching is effective and find any additional problems.
C. Testing team ups vulnerability scan frequency from quarterly to monthly for internal scans and weekly for external scans.
D. The testing team ups the vulnerability scan frequency from quarterly to monthly
Answer: B.
Explanation:
The biggest benefit is the basic shift from reactive to proactive patching, with scanning acting as a QA to make sure patching is performing as intended. Security scanning can also find problems with security configuration, as well as the presence of out-of-date or unsupported software, in addition to problems that require patching.
3. What actions must you take before creating a long-term security plan?
A. Evaluation of current security measures to determine their efficacy.
B. A gap analysis to pinpoint the variations.
C. Conduct a risk analysis.
D. A penetration test to find undiscovered weaknesses in crucial systems.
Answer: B.
Explanation:
Creating the intended end state, comprehending the current condition, and comprehending the gaps between the two are prerequisites for creating a strategy.
Therefore, the strategy will focus on the tasks necessary to fill in such gaps and change the organisation into the intended end state.
4. What should a risk management strategy’s main goal be?
A. Identify the risk tolerance of the organisation.
B. Determine reliable risks, then assign them to a third party.
C. Determine credible risks and bring them down to a manageable level.
D. Remove plausible risks.
Answer: C.
Explanation:
The main goal of a risk management strategy is to identify risks, then reduce those risks to levels that upper management can accept.
A risk management strategy’s primary goal is not to determine risk appetite, despite the fact that doing so is crucial to the efficient operation of a risk management programme.
One of the potential outcomes of identified hazards is to transfer those risks to third parties. Furthermore, hazards can only be diminished to levels that are acceptable.
5. When a thorough internal audit reveals that a number of controls are ineffective, what should be done next?
A. Compare these findings to those of a penetration test.
B. Create compensatory controls to bring the risk down to a manageable level.
C. Make a risk analysis.
D. Address inadequate controls by creating a risk-based action plan.
Answer: D.
Explanation:
Organizations are often required to correct the majority of findings discovered by an internal audit department. A risk-based strategy makes sense since it allows for the most effective remediation of results by focusing on the most dangerous ones first.
6. Which of the following approaches to determining asset value is invalid?
A. Net present value
B. Cost of replacement
C. Repair cost
D. Book value
Answer: C.
Explanation:
Repair costs are not a reliable way to value an item. Replacement cost, book value, net present value, redeployment cost, creation cost, reacquisition cost, and consequential financial cost are all acceptable techniques.
7. Advanced antimalware, IPS on all endpoints, and antivirus software are all used by the organisation. What further options should you take into account to strengthen ransomware defences?
A. Replication of data
B. Spam and phishing e-mail filtering
C. C. monitoring for file integrity
D. Firewalls
Answer: B.
Explanation:
The option that needs to be taken into account is one that prevents any inbound spam and phishing emails from getting through to end users. As a result of the other strong measures already in place, ransomware will be better protected thanks to this.
8. What procedure served as the official legal underpinning for information transfer from Europe to the United States?
A. Model clauses
B. Privacy Shield
C. Safe Harbor
D. Binding corporate rules
Answer: C.
Explanation:
The International Safe Harbor Privacy Principles, more commonly referred to as Safe Harbor, served as the previous legal basis for the movement of PII from Europe to the US. The European Court of Justice ruled in 2015 that Safe Harbor was unenforceable.
9. What should an administrator do if it is discovered in the SOC that a huge number of phishing emails are coming from a single address?
A. Create a serious security incident.
B. At the spam filter, reject all incoming emails from that address.
C. Send a warning to all staff members.
D. Blackhole the IP address of origin.
Answer: B.
Explanation:
The greatest option out of the ones offered is to ban any incoming new emails from the offender’s email address. The implementation of a technology that could perform this automatically and retrieve any hazardous communications that had already been transmitted to certain users before the message was identified as harmful would be a preferable approach.
10. Why is security awareness information being created in different forms?
A. Users are less inclined to disregard
B. the greatest possible use of security awareness training
C. Being creative
D. Recognizing that everyone has a unique learning and cognitive style
Answer: D.
Explanation:
In recognition of the fact that people have different learning and cognition styles, the most effective security awareness training programmes include content in a variety of formats, including but not limited to computer-based training, newsletters, e-mail messages, posters, flyers, and promotional items. When messages come in different formats, employees are more likely to be responsive to them.
Check our FREE CISM exam certification practice test with a full set of 150 questions.
