CISM practice questions
ISACA · CISM · 300 questions
Original practice questions for the ISACA CISM exam under the 2026 job practice (effective 3 November 2026), covering information security governance, information security risk management, information security program, and incident management from the information security manager's perspective. The questions follow ISACA's official 2026 domain names and weights; ISACA has not yet published the 2026 task and knowledge statements publicly, so subtopic coverage follows the prior (2022) outline plus the newly announced enterprise architecture and information security architecture areas.
This course contains the use of artificial intelligence.
About the CISM exam
- Time allowed
- 4 hours
- Questions
- 150
- Passing score
- 450 (scaled 200-800)
- Format
- Multiple-choice (one best answer)
Schedule this exam The certification this earns
Exam details published by the vendor, checked 7 October 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Information Security Governance · 54 questions
- A newly hired information security manager discovers that business units routinely skip the security review step so they can hit product launch dates, and no one has been sanctioned for it. What should the security manager do FIRST?
- After several employees were disciplined for clicking phishing links, staff have stopped reporting suspicious emails, and the security team now learns of compromises only days later. Which action would BEST restore timely reporting?
- A fast-moving technology startup is being merged into a heavily regulated bank, and the two organizations have very different attitudes toward security. The security manager is asked to establish a common security culture for the combined entity. Which approach is BEST?
- In a strategy workshop, several executives describe information security as purely an IT department problem and decline to take part in security decisions. Which action is MOST likely to shift ownership toward the business?
- A security manager wants to show the executive committee whether the organization's security culture is actually improving. Which indicator is the MOST meaningful?
- A global policy requires that confidential documents be stored only in approved repositories, but a regional office keeps sharing them through personal messaging groups because that is how local teams have always collaborated. What should the security manager do?
- Business units view the security team as an obstacle and increasingly launch projects without involving it, discovering security requirements only late in delivery. Which action is MOST likely to build partnership and bring security in earlier?
- The chief executive asks the security manager to exempt the executive team from multifactor authentication because it slows them down when traveling. What is the BEST response?
- A company plans to begin selling services in a new country that has recently enacted a data protection law. What should the security manager do FIRST?
- One country where the company operates requires transaction records to be retained for several years, while another jurisdiction's privacy law requires that personal data in those same records be deleted once it is no longer needed. What is the BEST approach?
- A key customer contract requires the company to notify the customer of any breach affecting its data within a shorter window than the applicable regulator requires. How should the incident response procedures address this?
- An external audit found the organization fully compliant with its industry regulation, yet a month later attackers exploited a weakness in a business system that the regulation does not cover and that had never been risk assessed. What does this MOST likely indicate?
- A regulator asks who in the organization is ultimately accountable for ensuring that customer personal data is handled in line with legal requirements. Which answer is correct?
- The business wants to move customer records to a cloud provider region located outside the home country to reduce costs. What should the security manager do FIRST?
- Over the past year, several new regulations affecting the organization were missed until external auditors raised them. What is the BEST long-term remedy?
- Remediation funds can close only one of two compliance gaps this quarter. One gap relates to a regulator that has been especially active in public enforcement; the other exposes a larger volume of sensitive data to a threat that is actively exploited. How should the security manager prioritize?
- The security manager currently reports to the CIO, who also runs IT operations and has repeatedly delayed security findings that would affect operational targets. The board is reviewing where the security role should report. What is the MOST important consideration?
- A database administrator and the manager of the business unit that uses a customer data set disagree about who may grant access to it. According to sound governance, who should decide the access rules?
- An organization is forming an information security steering committee to set priorities and resolve cross-functional issues. Which membership would make the committee MOST effective?
- The RACI chart for a new cloud platform lists several teams as responsible for quarterly user access reviews, but no one is marked as accountable. What is the BEST action?
- Newly appointed board members ask the security manager what their role in information security should be. Which description is MOST appropriate?
- A security administrator who grants and modifies user privileges is also the person who reviews the logs of privilege changes each week. What is the BEST corrective action?
- Internal audit offers to take over the security team's continuous monitoring of key controls, arguing that its independence would make the results more reliable. How should the security manager respond?
- A global group with subsidiaries regulated in several different jurisdictions is deciding whether its information security function should be centralized or federated. What should drive the decision?
- A security manager has been asked to develop a new information security strategy for the organization. What should the security manager do FIRST?
- While developing the information security strategy, the security manager has documented the current state of security and now needs to define the desired state for a gap analysis. How should the desired state be determined?
- The board approved a three-year information security strategy, but no executive has taken ownership of it, and most initiatives have stalled waiting for decisions from business units. What is MOST likely to restore momentum?
- Midway through a three-year security strategy, the company announces a cloud-first transformation that will move most business applications to external providers within two years. What is the BEST action for the security manager?
- A risk assessment is complete, and the security manager must sequence a three-year roadmap. Proposed initiatives are a behavioral analytics platform, data loss prevention that relies on data labels, a policy refresh with a data classification scheme, and an automated response tool. Which initiative should be scheduled FIRST?
- After approving a new information security strategy, board members ask how they will know whether it is working. Which measure would BEST answer their question?
- The security manager reviews recent internal and external developments to decide whether the information security strategy needs revision. Which development is MOST likely to require a strategic change rather than an operational adjustment?
- A draft information security strategy lists several items in a single table. Which item is a constraint on the strategy rather than an objective of it?
- The security manager begins developing an information security strategy and finds that the organization has never defined its risk appetite. What is the BEST course of action?
- An organization adopted a well-known security governance framework exactly as published. A year later, teams are overwhelmed by requirements that do not fit the business, and many controls address risks the organization does not face. What should the security manager do?
- A project team is preparing for ISO/IEC 27001 certification and keeps confusing it with ISO/IEC 27002. Which statement correctly describes the relationship between the two standards?
- Executives want a framework focused on the governance and management of enterprise information and technology, aligning IT with stakeholder goals, rather than a catalogue of technical controls. Which framework BEST fits this need?
- The security manager needs a common, nontechnical language to explain the organization's cybersecurity posture and priorities to the board. Which approach would BEST meet this need?
- An organization claims that information security governance is integrated into its corporate governance. Which observation provides the BEST evidence that this is true?
- Three frameworks, one required by a regulator and two by major customers, each impose separate audits on the same operational teams, causing duplicate evidence requests and audit fatigue. What is the BEST approach?
- In an organization's information security governance structure, which element sets direction by stating management's intent and expectations?
- The security manager is preparing a business case for a security monitoring platform to present to the executive committee. Which content would be MOST persuasive to that audience?
- Halfway through the year, the security budget is cut by a significant amount, and not all planned initiatives can continue. What should the security manager do?
- The steering committee returns a draft business case for a new identity management platform because it presents only the chosen product and its benefits. Which addition would MOST improve the business case?
- A business case rests entirely on a single annualized loss expectancy figure, and executives question how reliable that number is. What should the security manager do?
- The security team is short-staffed for round-the-clock monitoring, and management must choose between hiring more analysts and outsourcing monitoring to a managed service provider. What is the MOST important consideration?
- A proposal to buy a data protection platform shows the purchase price and implementation fees but nothing beyond go-live. What key information is missing that management needs to make a sound decision?
- A large security program was funded two years ago on the basis of expected risk reduction, but no one has checked whether the promised benefits were delivered. What should the security manager do?
- Security budget requests are repeatedly submitted after the enterprise annual planning cycle has closed, so they compete for leftover contingency funds. What is the BEST long-term fix?
- The enterprise architecture team has started designing a new target-state architecture to support the company's five-year business strategy. At what point should information security be involved?
- A newly appointed security manager asks how the organization's enterprise architecture repository can help the information security program. Which answer BEST describes its value?
- An information security manager must decide which systems deserve the strongest protection, but the IT inventory lists hundreds of applications with no indication of business importance. The enterprise architecture repository maps business capabilities to the processes and applications that support them. Which approach BEST determines system criticality?
- During an enterprise architecture review, the information security manager discovers that several business units run cloud-based applications that are not recorded in the architecture inventory and were never assessed for security. What should the information security manager do FIRST?
- An organization's architecture review board approves all new solution designs, but its review criteria cover only cost, performance and interoperability. Several approved designs later required expensive security rework. Which action would BEST address the underlying problem?
- A legacy customer platform will be retired over three years through several interim architecture states in which old and new systems exchange data. The target architecture has already been fully assessed for security. What should the information security manager ensure?
Information Security Risk Management · 60 questions
- The security operations team subscribes to several commercial and open-source threat intelligence feeds and now receives thousands of indicators a day. Analysts say they cannot act on most of it. What would MOST improve the value of the threat intelligence program?
- The information security manager learns that employees in several departments are pasting customer and internal data into public generative AI tools to speed up their work. Senior management has not yet taken a position on these tools. What should the information security manager do FIRST?
- Threat intelligence reports that a ransomware group has begun targeting organizations in the company's industry sector, using techniques not considered in the last annual risk assessment. What should the information security manager do FIRST?
- Several recent high-profile breaches in the company's sector entered through updates from trusted software suppliers. The organization's risk assessment currently covers only internally developed and hosted systems. What is the MOST appropriate response?
- A board member asks how the organization is addressing the long-term threat that quantum computing poses to current public-key encryption. No practical attack exists today, but some customer data must remain confidential for many years. What should the information security manager recommend?
- The company has announced significant layoffs that will take place over the next six months. Morale is low, and many affected staff have privileged access to sensitive systems. What should the information security manager do FIRST?
- The business is designing a new customer-facing payment service. The information security manager wants the security requirements to reflect who is realistically likely to attack the service and how. Which activity BEST supports this goal?
- A risk workshop notes that a phishing group is targeting the sector, that an internet-facing server is missing a security patch, and that customer records could be exposed if the server were compromised. Which statement correctly classifies these elements?
- A regional bank's security team usually learns of relevant attack campaigns from news reports, often after peer institutions have already been hit. The information security manager is considering joining the sector's information sharing and analysis center. What is the PRIMARY benefit of membership?
- A geopolitical conflict has sharply increased state-sponsored cyberattacks against companies in the organization's country and sector. The related scenarios in the risk register carry likelihood ratings assessed eighteen months ago. What should the information security manager do?
- A quarterly vulnerability scan returns thousands of findings across servers, workstations and network devices. The remediation team can address only a fraction of them each month. How should the information security manager prioritize remediation?
- Senior management has received a vulnerability scan report and asks whether an external attacker could actually chain the reported findings together to reach customer data. Which activity would BEST answer this question?
- An internal audit finds that a required control is not implemented on a payments system. The system team says a different control already in place compensates for it. What should the information security manager do FIRST?
- A policy requires monthly review of privileged access, and the procedure is well documented and appropriate. Sample testing shows that no reviews have been performed for the last five months. How should this deficiency be classified?
- A critical manufacturing control system runs on an unsupported operating system that cannot be patched without the vendor recertifying the whole production line, which will take two years. What is the BEST course of action?
- Every quarter, vulnerability scans find the same insecure configuration setting on newly built servers, and the operations team corrects each server by hand. What should the information security manager recommend?
- A zero-day vulnerability with no available patch is publicly announced for a widely used file-transfer product. What should the information security manager do FIRST?
- After adopting a control framework, the information security manager wants to know where the controls actually in place fall short of the control objectives that management has set. Which technique BEST meets this need?
- The information security manager must report to senior management whether the vulnerability management process is effective at reducing exposure. Which metric BEST demonstrates this?
- The remediation team reports that most of its time is spent investigating vulnerability scan findings that turn out not to be real, while confirmed critical issues wait in the queue. What should the information security manager do?
- The information security manager is assessing risk for a new line of business. There is little reliable historical loss data and no industry benchmarks for the scenarios involved. Which approach is MOST appropriate?
- A data breach scenario has a single loss expectancy of $200,000 and an annual rate of occurrence of 0.25. A proposed control costs $30,000 a year and would reduce the annual rate of occurrence to 0.05. What is the annualized loss expectancy before the control, and is the control cost-justified?
- A risk assessment rates a data leakage scenario as high before any controls are considered and as medium after encryption and access controls are taken into account. What do these two ratings represent, in order?
- A business unit is about to perform its first information security risk assessment, and the scope has been agreed with management. Which step should come FIRST?
- The security team completed a risk assessment in which it assigned business impact values to each application on its own, without consulting anyone outside IT. Business leaders now dispute the results. What should have been done differently?
- Senior management wants risk scenarios that show how information security events could prevent the company from achieving its strategic objectives, so they can be discussed at the executive level. Which approach to scenario development BEST fits this purpose?
- Each of twelve business units has a minor data-handling risk that is individually within the tolerance set for that unit. All twelve units depend on the same shared file-transfer platform. What should concern the information security manager MOST?
- An organization performs its information security risk assessment annually. Four months after the last one, the core customer database is migrated to a public cloud service. What should the information security manager do?
- A project team has completed a business impact analysis for its systems and proposes to use it as the systems' security risk assessment to save time. Why is this insufficient?
- Business units submit risk assessments using their own scoring scales, ranging from three-point to ten-point ratings with different definitions. The information security manager must present an enterprise view of the top risks. What is the BEST action?
- A proposed control would cost $250,000 a year to reduce a risk whose expected annual loss is $40,000. The current level of risk is within the organization's risk appetite. What is the MOST appropriate risk response?
- After the company purchases a cyber insurance policy that covers data breach costs, a business executive proposes cutting the security budget because the breach risk now belongs to the insurer. How should the information security manager respond?
- After a risk assessment, management decides to discontinue an online service that handled sensitive customer data because the cost of securing it would exceed the revenue it earns. Which risk response does this represent?
- Planned controls for a new trading platform have been implemented, but the residual risk is still above the organization's risk appetite. The business wants to launch next week. What should the information security manager do?
- A business unit head asks the information security manager to sign the risk acceptance for an unpatched vulnerability in the unit's sales system, saying security is the expert on the risk. What should the information security manager do?
- A review of the risk register shows dozens of risk acceptances recorded several years ago with no expiry or review dates. Some of the underlying systems have changed significantly since then. What should the information security manager recommend?
- An online payments business wants to reduce fraud losses, but it will not accept any control that blocks or delays legitimate customer transactions. Which type of control is MOST appropriate?
- The board has stated that the company will accept only a low level of risk to customer data. A business unit asks how far a specific key risk indicator may deviate from its target before escalation is required. Which concept answers the business unit's question?
- Business leaders want to move a customer-facing application to a cloud provider and state that the move will transfer all security risk for the application to the provider. How should the information security manager respond?
- Five risk treatment plans compete for a limited security budget that cannot fund all of them this year. How should the information security manager recommend which plans to fund?
- The risk register lists an IT database administrator as both the owner of the risk 'loss of customer order data' and the owner of the backup control that treats it. What change should the information security manager recommend?
- A significant risk to the company's online ordering capability has sat in the risk register for months without an owner, and no treatment decision has been made. What should the information security manager do?
- A quarterly user access review stopped being performed after the employee who ran it left the company, and nobody noticed for three quarters. Which measure would BEST prevent this from happening again?
- The head of IT insists on owning the risk for the company's claims-processing application because IT built and runs it. The claims department relies on the application for its core business process. Who should own this risk?
- Several recent outages and data exposures were traced to changes that went into production without anyone considering their security impact. What should the information security manager recommend?
- A project manager wants to skip the security risk assessment for a new customer portal so the project can meet its launch date. What is the BEST way to prevent this situation in future projects?
- A centrally run quarterly access-review control covers applications used by three business units. An audit finds that no reviews were completed for two quarters, and each unit's manager states that another unit or IT was responsible. What should the information security manager do to BEST prevent a recurrence?
- Annual control self-assessment results show that every control owner rated all of their controls as effective, although two significant incidents last year involved controls on the list. What is the MOST appropriate next step for the information security manager?
- A business unit head who owns a customer portal declines to fund remediation of a vulnerability that the risk assessment rated high, above the organization's documented risk appetite. The unit head says the business will simply accept the risk. What should the information security manager do?
- A vendor that processes customer data was onboarded and paid for months before the security team learned of the contract, because purchasing signs agreements without any information risk step. What should the information security manager do to BEST address the root cause?
- Management wants an indicator that will warn of increasing exposure to account-compromise risk before any loss occurs. Which metric BEST meets this need?
- A key risk indicator tracking critical systems with overdue patches has exceeded its approved threshold for the second consecutive month. The risk management procedure defines an escalation path for each threshold level. What should the information security manager do FIRST?
- The information security manager is preparing the quarterly information risk report for the board of directors. Which content would BEST serve the board?
- During a review, the information security manager finds that no entry in the information risk register has been updated in two years, although the business has since launched two online services and moved its payroll to a cloud provider. What should be done to BEST correct this?
- A compliance review shows that several business units are not following the organization's laptop encryption standard, citing performance concerns. What should the information security manager do NEXT?
- Executives review information risk using only a red-amber-green heat map. In the last meeting they treated two amber risks as equivalent, although one could cause a loss many times larger than the other. What should the information security manager do?
- The organization has just completed the acquisition of a smaller company whose systems will be connected to the corporate network over the next six months. What should the information security manager do to BEST support senior management's integration decisions?
- Continuous monitoring tools generate a large volume of technical alerts, and executives say the resulting security reports do not help them make decisions. What should the information security manager do?
- The information security manager is defining how often each risk in the register should be monitored. Which approach is MOST appropriate?
- The information risk dashboard has shown every key risk indicator as green for three quarters, yet the number of security incidents has risen in each of those quarters. What should the information security manager conclude and do?
Information Security Program · 99 questions
- A newly hired information security manager finds that the security program was started two years ago without a charter, defined scope or documented link to the information security strategy. Teams disagree about which activities belong to the program. What should be done FIRST?
- The organization is moving several critical workloads to a public cloud platform, and the security team has limited experience with cloud environments. What should the information security manager do FIRST?
- A review finds that the organization owns many security tools with overlapping capabilities, and licence and support costs are rising. What should the information security manager do to BEST address this?
- An internal auditor asks the information security manager for evidence that the security program supports the organization's information security strategy. Which evidence would BEST demonstrate this?
- The security program has more planned activities than available staff can deliver this year, and hiring is frozen. How should the information security manager assign the existing staff?
- The organization has outsourced its security operations center to a managed security service provider. Which responsibility should remain with the organization?
- The security program roadmap schedules a zero trust access initiative to begin before the project that consolidates the organization's several identity directories into one authoritative source. What should the information security manager do?
- Departing employees often keep system access for weeks because HR, legal and operations run their processes without involving the security program. What should the information security manager do to BEST address this?
- A mid-size company with no existing data classification is designing its first scheme. Staff will classify information themselves as they create it. Which design is MOST likely to succeed?
- The marketing department has created a new customer analytics data set combining purchase history and contact details. Who should assign its classification?
- Before launching a data classification project, the information security manager learns that the organization's information asset inventory is known to be incomplete and lacks named owners for many assets. What should be done FIRST?
- During awareness training, several employees ask why they should bother applying classification labels to the documents they create each day. Which explanation BEST answers them?
- Product specifications were classified as confidential during development. The product has now launched, and the same specifications are published on the company's public website. What should happen to the internal copies?
- Analysts propose combining several fields that are each classified as internal, such as job titles, office locations and travel schedules, into one data set describing senior executives. How should the combined data set be classified?
- A collaboration platform holds thousands of unlabeled documents. The information security manager proposes requiring classification labels so that data loss prevention and external sharing restrictions are applied automatically according to each label. What is the PRIMARY objective of this approach?
- An information owner is determining the value of a customer database to set its classification. On what should the valuation PRIMARILY be based?
- A data discovery scan finds customer identity records in a departmental file share that is not listed in the information asset inventory and has broad access permissions. There is no evidence that the data has been accessed improperly. What should the information security manager do?
- A parent company has two subsidiaries: one delivers government contracts that require a specified government security control baseline, and the other is a commercial retailer with no such obligation. The parent wants a consistent approach to choosing control frameworks. What should PRIMARILY drive framework selection?
- A team implementing an industry control framework is working through it as a checklist, implementing every control in order regardless of the organization's circumstances. What should the information security manager advise?
- An organization is preparing to seek ISO/IEC 27001 certification to support bids for contracts in its managed services business line. How should the scope of the information security management system BEST be defined?
- A small organization with a limited budget and no dedicated security staff wants a starting set of controls that will address the most common attacks first. Which approach is MOST suitable?
- During a capability maturity assessment of security processes, management asks what target maturity level should be set for each process. What is the BEST guidance?
- After a competitor received public praise for its security program, executives ask the information security manager to copy that program's structure and priorities. What should the information security manager recommend?
- Systems that store, process or transmit payment card data are spread across a flat internal network, so the payment card industry standard applies to nearly every system. What is the MOST effective way to reduce the compliance effort?
- The control framework the organization adopted three years ago has just been released in a substantially revised version. What should the information security manager do FIRST?
- A document states that all user passwords must be at least 14 characters long and must be changed if compromise is suspected. It applies to every system and does not describe how to configure any system. How should this document be classified?
- The organization's information security policy contains specific product configuration settings and must be revised and reapproved by senior management several times a year as technology changes. What should the information security manager do?
- The information security manager has drafted a revised information security policy that sets direction for the whole organization. Who should approve it?
- A business unit cannot meet the encryption standard on a legacy production system until its planned replacement next year, and it asks to operate the system without compliance. What should the information security manager do?
- The information security manager discovers that the organization's security policy set has not been reviewed in three years, during which the company adopted remote working and moved key systems to cloud services. What should be done?
- Two months after a new acceptable use policy was published on the intranet, a survey shows that most employees are unaware of it. What should the information security manager do?
- Following a merger, the two combined companies have conflicting acceptable use policies, and managers are unsure which one applies to integrated teams. What should the information security manager do?
- An internal audit draft report cites a development team for not following the organization's secure coding guideline, which recommends but does not require certain practices. The team fully complied with the mandatory secure coding standard. How should the information security manager respond?
- The executive committee asks the information security manager for one security metric to review each quarter. Which metric would be MOST useful to them?
- The security operations center collects detailed data on detection times, alert volumes and analyst workload. The chief financial officer now also wants a security view drawn from the same data. What should the information security manager do?
- A department proposes 'improve security awareness' as one of its security metrics for the coming year. How should the information security manager BEST improve this proposal?
- Each quarter the security operations team reports the growing number of firewall rules to the steering committee as evidence that perimeter security is improving. The committee wants metrics it can use to make decisions. What is the PRIMARY weakness of this metric?
- Management has funded a new vulnerability management program and asks the information security manager to demonstrate, within a year, that it has improved the organization's security posture. What should the manager do FIRST?
- A security help desk is measured on the average time to close tickets. Closure times have fallen sharply, yet the same malware infections keep recurring on the same endpoints. What is the BEST action for the information security manager?
- The board has set a goal that no more than two business-critical services suffer a security-related outage in the coming year. Which indicator is a key goal indicator (KGI) for this objective rather than a key performance indicator (KPI)?
- An information security manager compiles monthly risk metrics by hand from spreadsheets that each regional office maintains differently, and the figures often change after they have been reported. What should the manager address FIRST to make the metrics useful to management?
- A company relies on a single perimeter firewall to protect all internal systems, and once traffic is inside, it flows freely between them. An assessment notes that one misconfiguration would expose every system. Which architectural principle BEST addresses this weakness?
- A distributed workforce now reaches company applications from home, hotels and client sites. The current design grants broad internal network access once a user connects through the VPN. Which design intent BEST supports the redesign of remote access?
- Different project teams make conflicting security design choices: one encrypts data at rest, another relies only on network controls, and design reviews argue every decision from scratch. What would MOST effectively bring consistency to these decisions?
- In a manufacturing company, the systems that control production lines sit on the same flat network as office workstations used for email and web browsing. What is the PRIMARY benefit of separating them into distinct network segments?
- An organization is migrating workloads to an infrastructure as a service (IaaS) provider. A business sponsor believes the provider will now be responsible for all security. Under the shared responsibility model, which responsibility remains with the organization?
- Each of the organization's 40 business applications maintains its own user store, and departing employees often keep accounts in some applications for months. Which architectural change would BEST address this problem?
- Every new project designs its security controls from scratch, which causes delays, duplicated effort and uneven protection for systems that have similar risks. What should the information security manager develop to address this?
- An architecture review finds that all internet traffic passes through one security inspection appliance, and its failure would halt customer transactions. What should the information security manager recommend?
- The security architecture team designs its standards separately from the enterprise architecture function, and business units complain that security designs ignore their processes and planned changes. What is the BEST way to resolve this?
- A risk assessment has rated unauthorized access to a customer database above the organization's risk appetite. Several controls are proposed, each with a different cost and effect. Which control should the information security manager recommend?
- During a control mapping exercise, the information security manager must label each control by its function. Which of the following controls is primarily DETECTIVE?
- An information security manager is categorizing controls by type for a control inventory. Which of the following is an ADMINISTRATIVE (managerial) control?
- A project team has already shortlisted data loss prevention products for a new customer data platform, but no one has agreed what the controls must achieve. What should the information security manager do FIRST?
- Security requirements for a new customer portal were added during user acceptance testing, causing rework and a delayed launch. What should the information security manager do to prevent this on future development projects?
- A payment platform must check that every transaction respects the customer's account limits, and it processes several thousand transactions each day. Which type of control is MOST appropriate for this requirement?
- A new approval control added to the order process doubles processing time, and sales staff now use personal email to send orders around it. What is the BEST action for the information security manager?
- A new finance application is being deployed, and the business wants to assign access efficiently while limiting the risk of fraud. Which approach BEST meets both goals?
- The organization plans to roll out multifactor authentication to 20,000 employees in several countries, and leadership is concerned about disruption to daily operations. Which approach BEST reduces that risk?
- Shortly after deployment began, a new endpoint security agent caused a critical business application to crash on the first group of machines. What should have been done to prevent this?
- Security engineers have been deploying firewall changes and new controls directly to production to respond quickly, bypassing the normal change process, and two outages have resulted. What should the information security manager do?
- Access to business systems is granted from email requests sent by managers, and no process links access to hiring, transfers or terminations. Audits keep finding active accounts belonging to former employees. Which action BEST addresses the root cause?
- A data loss prevention control was installed six months ago and the project was closed, but nobody confirmed that it actually blocks the data types it was meant to protect. What should the information security manager do NEXT?
- A database team encrypted customer records at rest, but the encryption keys are stored in a file on the same server as the database. What is the PRIMARY concern for the information security manager?
- Developers release code many times a day through an automated pipeline. A quarterly manual security review cannot keep pace and finds flaws only after they reach production. What is the BEST approach?
- After an audit finding, logging was enabled on all servers, but no one reviews the logs or acts on what they contain. What is the information security manager's MOST important concern?
- Before relying on a new access approval control, the information security manager wants to know whether it actually worked throughout the past six months, not only whether it was designed correctly. Which evaluation is required?
- The team that operates the privileged access management control has offered to test its effectiveness for the annual assurance report presented to the board. What is the MAIN concern with this arrangement?
- An information security manager must determine whether a quarterly user access review control operated effectively during the past year. What is the BEST evidence to examine?
- The information security manager plans to have business units assess their own controls through control self-assessment. What is the MOST important consideration to ensure the results can be relied on?
- The information security manager is planning a penetration test of production customer-facing systems by an external firm. What must be in place BEFORE testing begins?
- Annual control testing has repeatedly found that a critical configuration control failed months before the test, leaving long periods of undetected exposure. What would BEST address this problem?
- Testing shows that a key control protecting payment card data has failed. Which response by the information security manager BEST addresses the failure?
- Senior management asks whether the security operations center (SOC) would actually detect and respond to a skilled, stealthy attacker. Which assessment BEST answers this question?
- The information security manager wants a metric that shows whether the security awareness program is actually changing employee behavior. Which metric is BEST?
- Developers and system administrators receive the same general awareness training as all other staff. Several recent incidents involved insecure code and misconfigured servers. What should the information security manager do?
- A small group of employees repeatedly fails phishing simulations despite completing the standard awareness training. What is the BEST response for the information security manager?
- The security awareness program consists of a single annual compliance module, and phishing click rates rise steadily in the months after it is completed. What would BEST improve the program?
- Senior executives are exempt from security training because of their schedules. Attackers recently impersonated the CEO in an attempted payment fraud targeting the finance team. What should the information security manager recommend?
- New employees receive full system access on their first day but attend security awareness training several weeks later. What should the information security manager recommend?
- An awareness program still focuses on threats from several years ago, while recent incidents involved voice phishing calls and malicious QR codes. What should the information security manager do?
- An employee disputes disciplinary action for misusing company systems, claiming never to have been told the rules. HR cannot show that the employee ever accepted the acceptable use policy. What would have BEST prevented this situation?
- A contract with a new cloud payroll provider that will process employee personal data is about to be signed. What should the information security manager ensure FIRST?
- A vendor risk team of three people must assess the security of more than 600 suppliers, ranging from stationery vendors to cloud providers that hold customer data. What is the BEST approach?
- A critical service provider hosts the organization's customer data with a subcontractor that the organization has no contract with. What is the BEST way to address this fourth-party risk?
- An information security manager is reviewing a service provider's independent assurance report on its controls before relying on it. Which review step is MOST important?
- During a contract renewal review, the information security manager finds that the agreement with a payroll vendor that processes employee personal data contains no clause requiring the vendor to report security incidents. What is the BEST way to address this gap?
- An organization plans to end its relationship with a cloud-based customer support provider that stores several years of customer records. Which contract provision is MOST important to the information security manager when planning the exit?
- A business unit wants to move a workload to a large public cloud provider. The provider's standard terms prohibit individual customer audits of its data centers. What is the BEST way for the information security manager to obtain assurance over the provider's controls?
- The information security manager discovers that the marketing department signed up for a SaaS analytics tool and uploaded customer lists without any security review. Several similar cases have occurred this year. What is the BEST long-term action?
- A review of the third-party risk program shows that vendors handling sensitive data are assessed thoroughly at onboarding but never reassessed, even though several have since changed hosting providers. What should the information security manager recommend?
- The information security manager has been asked to give a program status update at the next board meeting, with ten minutes on the agenda. Which content is MOST appropriate?
- The information security manager sends a single 40-page program report to both the infrastructure engineering team and the executive committee. Executives say it is too technical, and engineers say it lacks the detail they need. What should the manager do?
- After a new detection tool was deployed, the number of reported security incidents tripled compared with the previous quarter. The information security manager is preparing the quarterly report for senior management. What is the BEST way to present this metric?
- The security program will introduce mandatory multifactor authentication and a new data-handling standard affecting every department next quarter. What should the information security manager do FIRST to support adoption?
- A business unit has repeatedly declined to implement controls required by the approved information security standard, citing productivity. Discussions with the unit's manager have not resolved the issue. What should the information security manager do NEXT?
- The draft annual security program report lists projects completed, tools deployed and training sessions delivered. The CEO asks whether the organization is actually more secure than last year. What change would BEST answer that question?
- Business unit leaders complain that security program initiatives do not reflect their priorities and often disrupt their projects. What should the information security manager do to address this on an ongoing basis?
- Two key program milestones are behind schedule and a critical control has failed testing. The information security manager is concerned that reporting this will damage confidence in the program. What should the manager do?
Incident Management · 87 questions
- The information security manager finds that the incident response plan was written by the security team without reference to the business continuity and disaster recovery plans. What is the PRIMARY risk of this situation?
- While reviewing a draft incident response plan, the information security manager notes it contains detailed technical procedures for analyzing malware but does not say who decides to escalate or who communicates with stakeholders. What is the BEST recommendation?
- An organization is forming its incident response team. The draft roster includes only network, systems and security engineers. Which change would MOST improve the team's ability to manage a significant data breach?
- A newly hired information security manager finds a well-written incident response plan that has never been approved by senior management. Responders report that business units ignore their containment requests. What should the manager do FIRST?
- Most of the organization's critical applications moved to cloud services over the past year, but the incident response plan still describes only on-premises systems and contacts. What should the information security manager do?
- Post-incident reviews of three ransomware events show responders took different containment steps each time, and in one case a server was restored before the attack vector was understood. What would BEST improve consistency?
- Security analysts frequently disagree about whether an alert should be treated as an incident, so similar alerts are handled in different ways. What is the BEST way for the information security manager to resolve this?
- The organization relies on an external firm for digital forensics during major incidents, but no agreement is in place and the firm's contacts appear nowhere in the incident response plan. What should the information security manager do?
- A new member of the steering committee asks why the organization should conduct a business impact analysis when it already has a risk assessment. Which answer BEST explains the purpose of a BIA?
- The information security manager is coordinating a business impact analysis. Who should provide the primary input on the impact of a disruption to each business process?
- A BIA for the order-processing service finds that the business can survive an outage of no more than 24 hours, systems must be back within 8 hours to leave time to clear backlogs, and no more than 1 hour of transactions can be lost. Which mapping is correct?
- IT has already purchased a recovery site contract and selected backup technologies, but no business impact analysis has been performed. What is the PRIMARY concern for the information security manager?
- A business impact analysis shows that a critical claims-processing function depends on a single external data provider, and no alternative source has been arranged. What should the information security manager do?
- A draft BIA rates the impact of each process disruption purely in lost revenue. As a result, a customer safety notification process shows low revenue impact and is ranked non-critical. What should the information security manager recommend?
- The organization's business impact analysis was completed five years ago. Since then it has launched online sales, closed two plants and outsourced payroll. What should the information security manager do?
- During a business impact analysis, every department head rates their own processes as most critical, making the results useless for prioritizing recovery. What is the BEST way to resolve this?
- Ransomware has encrypted the systems supporting order fulfillment, and the outage is expected to last several days. Staff are unsure whether the incident response plan or the business continuity plan applies. Which statement is correct?
- The information security manager is helping select a continuity strategy for a payment-clearing process. Several options with very different costs are available. What should PRIMARILY drive the selection?
- A flood will make the head office inaccessible for several weeks, although IT systems hosted in a remote data center are unaffected. Which element of the business continuity plan is MOST relevant?
- During a governance review, the information security manager notes that the IT director is named owner of the business continuity plan and business managers have not participated in developing it. What is the BEST recommendation?
- A major incident begins at 2 a.m. on a holiday weekend. The on-call engineer cannot reach anyone with authority to activate the business continuity plan. Which weakness does this reveal?
- A major reorganization has merged several departments, changed reporting lines and replaced many of the managers named in the business continuity plan. What should the information security manager ensure happens?
- A BIA shows that a hospital's medication dispensing process tolerates only a short outage. If its system fails there is no documented way to continue, and a redundant system has been rejected as too costly. What should the information security manager recommend?
- A BIA sets a recovery time objective of 72 hours for an internal reporting system and 2 hours for the customer transaction system. Which recovery site arrangement BEST balances cost and recovery needs?
- A business impact analysis sets a recovery point objective of one hour for the order database, but the database is backed up only once each night. What should the information security manager recommend?
- Threat intelligence shows ransomware groups now routinely locate and encrypt or delete backups before encrypting production systems. Which measure BEST protects the organization's ability to recover?
- The organization is moving its customer portal to an infrastructure-as-a-service platform. When updating the disaster recovery plan, what should the information security manager ensure FIRST?
- After the loss of the primary data center, the recovery team is planning the order in which systems will be restored at the recovery site. Which systems should generally be restored FIRST?
- During the annual disaster recovery test, the team finds that backups of a critical database cannot be restored because the encryption keys were never stored at the recovery site. What should the information security manager do?
- A major outage has lasted four hours. Engineers disagree about whether to fail over to the disaster recovery site, and nobody knows who can make the decision. What should have been defined in advance to prevent this?
- The information security manager is defining severity levels for the incident classification scheme. What should PRIMARILY determine an incident's severity?
- An incident was logged as low severity when a laptop was reported stolen. Two days later, investigators learn the laptop held unencrypted customer records. What should happen to the incident's classification?
- An incident team's reports are unreliable because analysts use a single field to record both the kind of incident, such as phishing or malware, and how serious it is. What should the information security manager do?
- A post-incident review finds that a high-severity incident was correctly classified but waited almost a day before senior management was informed, because analysts escalated incidents in the order received. What should be improved?
- An investigation confirms that an attacker accessed a database containing customers' personal data, and the access has now been contained. Which action is MOST important to take promptly?
- Incident reports from the organization's three regions show that similar incidents are rated differently, so senior management cannot compare risk across regions. What should the information security manager do?
- An analyst investigates an alert about unusual data transfers and determines it was an authorized backup job, not an incident. What should the analyst do next?
- A hospital wants proof that its responders can actually perform the technical recovery steps for its patient records system, but the business owner has ruled out any interruption to clinical operations. Which type of test BEST meets both requirements?
- A security manager proposes that a checklist review be this year's only test of the incident response plan. Senior management asks what assurance that review will actually provide. Which answer is MOST accurate?
- An incident response exercise is scheduled for next month. The scenario and participants have been chosen, but no one has documented what the exercise is meant to demonstrate. What should the security manager do FIRST?
- After-action reports from the last two tabletop exercises identified the same escalation gaps, yet the incident response plan has not changed since. What is the BEST action for the security manager?
- An organization moved its core ERP system to a cloud provider and restructured its IT team last year. Its incident response and recovery plans were last tested two years ago. What should concern the security manager MOST?
- The organization bought a new forensic analysis tool six months ago, and management expects the internal incident response team to operate it without vendor help. No responder has used it yet. What should the security manager do to BEST improve readiness?
- Post-incident reviews show that executives were slow to approve containment trade-offs and public statements during recent incidents. They have never taken part in an exercise. Which activity would BEST address this?
- Firewall, endpoint and identity systems each generate alerts reviewed by separate teams. A recent intrusion was missed because related events across those systems were never linked. Which capability would BEST address this?
- During a recent investigation, analysts could not determine which processes ran on the compromised laptops or how the malware moved from one laptop to another. Which capability would MOST improve future investigations?
- Analysts investigating an incident cannot reconstruct the sequence of events because timestamps on servers, firewalls and authentication systems differ by several minutes. Which control would MOST have prevented this problem?
- Security analysts perform the same manual triage steps for every user-reported phishing email: extracting indicators, checking reputation sources and searching mailboxes for copies. Report volumes are rising. What is the MOST efficient way to handle this workload?
- Monitoring dashboards generate thousands of alerts each day, most of which turn out to be false positives, and analysts have begun dismissing alerts without review. What should the security manager do to BEST address this?
- An attacker remained in the network for months using legitimate administrative tools, and no monitoring alert ever fired. What should the security manager implement to MOST improve detection of this type of activity?
- During the last incident, responders spent hours locating write blockers, clean media and approved forensic software before they could begin collecting evidence. What would BEST prevent this delay?
- Evidence gathered during a fraud-related incident may later be presented in court. What is MOST important for the security manager to ensure during evidence handling?
- A compromised production server is still running, and investigators need to preserve as much useful evidence as possible. Which approach should they follow?
- Following a data breach, legal counsel advises that litigation by affected customers is likely. Routine retention schedules will soon delete logs and emails related to the incident. What should the security manager do?
- Responders have confirmed that customer payment data was stolen in an intrusion. The incident response team lead asks whether the organization should report the crime to law enforcement. Who should make that decision?
- Suspicious activity was found on one database server, and early log review suggests the attacker may have reached other systems. The business wants that server restored immediately. What should the security manager ensure FIRST so that containment is effective?
- A regulator has indicated that it may review the organization's handling of a significant data breach. What should the security manager ensure about the incident investigation records?
- Data loss prevention alerts suggest that an employee may be copying confidential product designs to a personal cloud account. What should the security manager do FIRST?
- Endpoint alerts show that malware is active on several workstations in the finance department. The incident response plan requires evidence to be preserved for investigation. What is the BEST immediate containment action?
- Investigators confirm that a domain administrator account is being used by an attacker right now to access servers. What is the BEST containment action for this account?
- Ransomware has encrypted file servers in one network segment, and alerts show it is beginning to spread to systems in adjacent segments. What should the incident response team do FIRST?
- Containing an active intrusion would require taking the e-commerce platform offline during peak trading. The incident response plan does not pre-authorize the security team to shut down revenue systems. What should the security manager do?
- A compromised public web server has been isolated and the attacker's addresses blocked. The business needs the service back within days, but a clean rebuild and full investigation will take weeks. What is the appropriate longer-term containment step?
- A virtual machine hosted with an infrastructure cloud provider shows signs of compromise, and the incident response plan requires evidence to be preserved. What should responders do FIRST?
- Monitoring shows large volumes of data leaving a file server for an unfamiliar external host, and the transfer is still in progress. What should the incident response team do FIRST?
- Investigators discover that a skilled attacker has had quiet, persistent access to multiple systems for months. There is no sign of ongoing data theft or damage. What is the BEST approach to containment?
- An investigation confirms that personal data of customers in several countries was accessed without authorization. The organization is unsure which notification obligations apply. What should the security manager do?
- During a publicized incident, several employees have given conflicting statements to journalists, and the press is reporting contradictory details. What should the security manager recommend?
- Responders suspect the attacker has access to the corporate email system that the incident response team normally uses to coordinate. How should the team communicate during the response?
- Analysts are unsure whether a developing incident is serious enough to inform senior management. Some want to wait until the root cause is known. When should senior management be informed?
- Legal counsel has confirmed that customers must be notified about a breach of their personal data. The security manager is reviewing the draft notification. What content is MOST important to include?
- During a ransomware incident, rumours are spreading among staff that payroll data was stolen and that the company will close, and some employees are posting speculation online. What should the security manager recommend FIRST?
- A business partner's systems connect directly to the environment that has been compromised, and responders believe the partner may also be at risk. What should the security manager do?
- After an intrusion, the operations team wants to restore a key application to service immediately, although the attacker's persistence mechanisms and entry point have not yet been removed. What should the security manager advise?
- A server compromised by an attacker with administrative rights has been contained. Analysts removed the malware they found, but cannot be certain they found every change the attacker made. What is the BEST approach to recovery?
- After a ransomware attack, the team is preparing to restore systems from backups. Investigators believe the attacker was present for several weeks before the encryption began. What should the security manager ensure BEFORE restoration?
- Systems affected by a serious intrusion have been rebuilt and returned to production. What should the security manager ensure happens NEXT?
- A widespread attack has disrupted dozens of systems, and the recovery team cannot restore them all at once. How should the security manager guide the order of restoration?
- After an incident, the IT team declares that the order management system has been recovered and wants to close the recovery phase. What should happen before the system returns to normal operation?
- Investigators confirm that an attacker obtained administrative access to the organization's central directory service, which authenticates all users and services. What is the BEST approach to credential remediation?
- Systems have been restored after an intrusion, and a team member asks why a root cause analysis is still needed, since everything is working again. What is the PRIMARY reason?
- A major incident has just been closed. The incident manager suggests holding the lessons-learned meeting at the next quarterly security review, in about three months, with only the security team present. What should the security manager recommend?
- During a post-incident review, participants begin blaming the engineer who misconfigured the firewall rule that the attacker exploited. What should the security manager do?
- While preparing a post-incident review, the security manager finds that most corrective actions agreed after the previous two incidents were never completed. What is the BEST way to address this?
- A post-incident review finds that the attacker exploited a weakness that the risk register rated as low likelihood and low impact. What should the security manager do as a result?
- Post-incident reviews for three separate incidents identified the same gaps in escalation and evidence handling, and each time responders followed the incident response plan as written. What should the security manager do?
- Senior management wants to know whether the organization's ability to handle incidents is improving over time. Which metrics would BEST support this?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by ISACA.