CISM (ISACA): Practice Questions

Answered 0 · Correct 0

1. Information Security Governance easy

   Compared with CISSP, CISM is most focused on:

   A Hands-on technical configuration B Penetration testing C Network engineering D Security governance, risk and management

2. Information Security Governance easy

   The primary goal of information security governance is to:

   A Eliminate all risk B Buy the latest tools C Align the security strategy with business objectives D Pass audits

3. Information Security Risk Management medium

   'Risk appetite' is best described as:

   A The total risk that exists B The number of incidents per year C The amount of risk an organisation is willing to accept in pursuit of its objectives D The cost of controls

4. Information Security Risk Management medium

   When an identified risk exceeds the organisation's risk appetite, the security manager should FIRST:

   A Shut down the system B Recommend a risk response and escalate per the risk process C Ignore it D Buy insurance immediately

5. Information Security Risk Management medium

   The primary purpose of a Business Impact Analysis (BIA) is to:

   A Train staff B Identify critical functions and the impact of their disruption C Test backups D List all assets

6. Information Security Governance medium

   A Key Risk Indicator (KRI) differs from a Key Performance Indicator (KPI) in that a KRI:

   A Signals rising risk exposure B Counts staff C Measures past performance D Tracks budget

7. Information Security Risk Management medium

   'Residual risk' is the risk that remains:

   A Only in third parties B Before any controls C After insurance only D After controls have been applied

8. Information Security Program medium

   When establishing a new security programme, the BEST first step is to:

   A Hire a SOC team B Write technical standards C Understand business strategy and obtain governance/management support D Deploy a firewall

9. Incident Management medium

   During a serious incident, the security manager's priority is to:

   A Notify the press B Contain and recover according to the incident response plan C Rebuild everything immediately D Find who to blame

10. Information Security Risk Management medium

    Third-party (vendor) risk should be managed by:

    A Ignoring it if they are large B Only after an incident C Assessing and contractually addressing the vendor's security before and during the relationship D Trusting vendor marketing

11. Information Security Governance medium

    An information security strategy should be aligned primarily with:

    A The organisation's business objectives and strategy B The auditor's personal preferences C The IT helpdesk schedule D The newest available technology

12. Information Security Governance medium

    For an information security programme to succeed, ultimate sponsorship should come from:

    A The firewall administrator B Senior management (executive leadership or the board) C An external vendor D Each individual end user

13. Information Security Governance medium

    A security policy differs from a standard in that a policy:

    A Is identical to a standard B States high-level intent and direction, while a standard sets mandatory specifics C Lists exact product settings D Is optional guidance only

14. Information Security Governance hard

    The MOST important reason to align security with a recognised framework (ISO 27001, NIST CSF) is to:

    A Replace the security manager B Avoid all audits C Provide a structured, repeatable basis to manage and measure security D Impress customers

15. Information Security Governance easy

    'Due diligence' for a security manager means:

    A Buying insurance only B Ignoring low-rated risks C Delegating all responsibility D Taking reasonable steps to identify risks and verify that controls work

16. Information Security Risk Management medium

    Qualitative risk analysis differs from quantitative analysis in that qualitative analysis:

    A Uses ratings such as high/medium/low rather than monetary values B Is only for compliance C Always uses precise dollar figures D Ignores likelihood

17. Information Security Risk Management medium

    When valuing an asset for risk purposes, the security manager should consider:

    A Only its purchase price B The vendor's brand C Its physical weight D Its value to the business, including the impact if it is compromised

18. Information Security Risk Management medium

    Risk treatment options include accept, mitigate, transfer and:

    A Delay indefinitely B Ignore C Avoid D Hide

19. Information Security Risk Management hard

    Annual Loss Expectancy (ALE) is calculated as:

    A Asset value minus control cost B The number of incidents last year C Threat plus vulnerability D Single Loss Expectancy x Annualised Rate of Occurrence

20. Information Security Risk Management medium

    A control that detects an incident after it occurs (e.g., log review or an IDS) is a:

    A Corrective control B Preventive control C Detective control D Directive control

21. Information Security Program medium

    A security awareness programme's primary objective is to:

    A Replace technical controls B Change user behaviour to reduce human-related risk C Pass the audit only D Train the IT team alone

22. Information Security Program medium

    The security manager should measure programme effectiveness mainly through:

    A Metrics tied to objectives, such as KPIs and KRIs B The size of the budget C The number of tools owned D The number of emails sent

23. Information Security Program medium

    Segregation (separation) of duties primarily reduces the risk of:

    A Patch frequency B Network latency C Hardware cost D Fraud or error from one person controlling an entire process

24. Information Security Program hard

    When selecting controls, the security manager should prioritise based on:

    A Risk reduced versus the cost of the control B Alphabetical order C The newest technology D Vendor popularity

25. Information Security Program medium

    Proper encryption key management matters because:

    A If keys are lost or compromised, the encryption's protection fails B It speeds up the CPU C It applies only to email D It reduces storage

26. Incident Management medium

    During an incident, the response plan's FIRST priority is usually to:

    A Assign blame B Contain and limit the damage C Buy new hardware D Notify the press

27. Incident Management medium

    The difference between an event and an incident is that an incident:

    A Is identical to an event B Has (or may have) an adverse impact on security, while an event is any observable occurrence C Is always minor D Is always caused externally

28. Incident Management medium

    A post-incident review (lessons learned) mainly aims to:

    A Improve future response and prevent recurrence B Close the ticket faster C Reduce the budget D Punish staff

29. Incident Management hard

    The Recovery Time Objective (RTO) defines:

    A The target time to restore a process after a disruption B The total cost of the incident C The number of backups kept D The acceptable amount of data loss

30. Information Security Risk Management medium

    Third-party (vendor) risk is best reduced by:

    A Ignoring vendors entirely B Only checking price C Trusting the vendor's marketing D Assessing the vendor's security and setting contractual security requirements

Practice questions FAQ

Are these real CISM exam questions?

No. These are original study questions written to test understanding. They are not real exam questions, exam dumps, or copied from any provider.

How should I use these practice questions?

Answer each one, read the explanation (including why the wrong options are wrong), and use the per-domain score below to focus your revision on weak areas. Revisit before exam day.

How many questions should I do before the exam?

Enough to score consistently across every domain, alongside full-length practice from official or reputable providers. Understanding why each answer is right matters more than raw volume.

What score means I am ready?

A good signal is consistently scoring around 80% or higher across all domains on questions you have not seen before, and being able to explain why the wrong options are wrong.

Should I use exam dumps?

No. Dumps (real or leaked questions) breach provider policy, can void your certification, and do not build the understanding the exam actually tests.

Sources

• ISACA - CISM ↗