ISACA CISM Practice Exam

• A. The findings of the most recent vulnerability assessment
• B. The control objectives of the framework the organization has adopted
• C. The security roadmap published by the main platform vendor
• D. The organization's business goals and risk appetite Correct answer

Option D is correct because the security strategy must be driven by the business goals and the risk appetite that leadership has set. Vulnerability findings, framework control objectives and vendor roadmaps are useful inputs, but none of them define what the security program must protect or how much risk is acceptable.

• A. Meet sales leadership to find out why targets push staff to share Correct answer
• B. Repeat the awareness training using sales-specific examples
• C. Roll out multifactor authentication for the division's applications
• D. Add credential sharing to the disciplinary code through HR

Option A is correct because training completion is high yet sharing persists, so the root cause is likely target pressure. Understanding it with sales leadership comes first. Retraining, MFA or discipline would treat symptoms before the cause is known.

• A. Encrypt all customer data held in the home data center
• B. Confirm with legal counsel which transfer rules apply Correct answer
• C. Draft a data processing agreement template for the cloud provider
• D. Revise the website privacy notice to cover every market served

Option B is correct because cross-border transfer and data residency obligations differ by country, so the legal requirements must be established first. Encryption, a processing agreement and a privacy notice all depend on what those rules require.

• A. The finance data owner, who is accountable for the dataset Correct answer
• B. The internal audit lead, who reviews access controls
• C. The information security manager, who sets the access policy
• D. The IT operations manager, who administers the platform

Option A is correct because the data owner is accountable for the dataset and decides who may access it. Audit reviews controls, the security manager sets policy, and IT operations administers the platform, but none of them owns the business decision to grant access.

• A. COBIT 2019 governance objectives
• B. NIST CSF implementation tiers
• C. ISO/IEC 27002 control guidance
• D. ISO/IEC 27001 requirements Correct answer

Option D is correct because ISO/IEC 27001 specifies the requirements for an information security management system and is the standard against which independent certification is performed. ISO/IEC 27002 is guidance only and is not certifiable, and COBIT and NIST CSF are not certification standards.

• A. Report how a control performed during the last cycle
• B. Record what each completed risk treatment cost
• C. Confirm that policies were approved by management
• D. Signal that exposure is approaching risk tolerance Correct answer

Option D is correct because a key risk indicator is a forward-looking metric that warns management when exposure is moving toward the defined risk tolerance, so action can be taken before a threshold is breached. Options A and B describe control performance and treatment cost reporting, and option C is a governance check; none provide early warning of rising exposure.

• A. Add the group's published indicators to the perimeter blocklist
• B. Have the vendor apply the latest available patch to the appliance
• C. Brief the board on the ransomware threat to the sector
• D. Determine whether our appliance is exposed to this attack path Correct answer

Option D is correct because the first step is to determine whether the organization's own appliance is actually exposed to the described attack path; response actions should be driven by that relevance and risk assessment. Blocking indicators, patching and briefing the board are all reasonable follow-ups, but they are premature until applicability is established.

• A. Add generative AI handling rules to the next awareness training cycle
• B. Block the known generative AI sites at the web proxy
• C. Assess the AI use cases with owners and set risk-based conditions Correct answer
• D. Have each unit move to an enterprise AI license with data protection terms

Option C is correct because the manager should assess the actual use cases with the business owners and set risk-based conditions, which addresses the business need and the data exposure together. Training alone (A) is too slow, blocking sites (B) is easily bypassed and ignores the business need, and mandating enterprise licenses (D) pre-empts the risk assessment.

• A. Patch internet-facing systems before internal ones
• B. Work through the findings by CVSS base score, highest to lowest
• C. Start with the systems that carry the most open findings
• D. Combine asset criticality with exploitability and exposure Correct answer

Option D is correct because risk-based prioritization combines asset criticality, exploitability and exposure to focus limited patching capacity where it reduces the most risk. Exposure alone (A), CVSS base score alone (B) or the count of findings per system (C) each ignore part of the picture and can leave critical, exploitable systems unpatched.

• A. Quantitative analysis using annualized loss expectancy Correct answer
• B. Qualitative scoring on a likelihood and impact heat map
• C. Maturity assessment against a control framework
• D. Tabletop workshop walking through each loss scenario

Option A is correct because comparing the annual cost of investments against losses avoided requires monetary values, which quantitative analysis using annualized loss expectancy provides. Heat-map scoring (B), maturity assessments (C) and tabletop workshops (D) do not produce the financial figures needed for a cost-versus-loss comparison.

• A. Map each tool to the control objective it supports, exposing gaps Correct answer
• B. Convert the open requisitions into tooling funds to automate
• C. Standardize on the broadest platform to cut consoles and contracts
• D. Rank the tools by licence cost to pick retirement candidates for renewal

Option A is correct because the first step in allocating limited resources is understanding what each tool actually contributes to control objectives, which exposes overlaps and gaps. Converting headcount to tooling, standardizing on one platform, or ranking by licence cost all decide before the value of each tool is known.

• A. Label the lake at the highest level among its sources, matching its most sensitive input
• B. Keep each source's label on its records so original owners stay accountable
• C. Have the owner classify the joined data by impact, which may exceed any source label Correct answer
• D. Let the privacy office set the classification so personal-data duties drive it

Option C is correct because the data owner is accountable for classifying information by the business impact of its compromise, and aggregation can create impact greater than any single source, such as enabling customer profiling. Simply inheriting the highest source label or keeping source labels ignores the aggregation effect, and the privacy office advises but does not own the classification.

• A. COBIT, which aligns IT governance objectives with enterprise goals
• B. NIST SP 800-53, which supplies a catalog of selectable safeguards
• C. NIST Cybersecurity Framework, which organizes the program around outcomes
• D. ISO/IEC 27001, whose management system can be certified Correct answer

Option D is correct because ISO/IEC 27001 is the only one of these that is a certifiable management system standard, with an independent certification body issuing a certificate and performing surveillance audits. COBIT, NIST SP 800-53 and the NIST CSF are frameworks or control catalogs that organizations can align to but that have no formal certification.

• A. Write a key-management procedure for operations to follow under the rule
• B. Publish a guideline recommending AES-256 with customer-managed keys
• C. Revise the cryptographic standard to mandate AES-256 with customer-managed keys Correct answer
• D. Amend the board-approved policy to name AES-256 and customer-managed keys at the top level

Option C is correct because the technical standard is where the specific algorithm and key-ownership requirement belongs, and it currently conflicts with the regulation by allowing AES-128. The board-approved policy already mandates approved cryptographic controls at a suitable level, so it should not be amended with technical detail, and a guideline or procedure cannot make a requirement mandatory.

• A. Malware detections blocked each month, showing threats stopped
• B. Training hours delivered per employee, showing investment in people
• C. Vulnerability scans completed each quarter, showing assessment activity is on schedule
• D. Critical-system vulnerabilities fixed within SLA, trended against tolerance Correct answer

Option D is correct because it measures actual risk reduction on the systems that matter most, against the organization's tolerance, and a trend shows direction over time. Malware blocks, training hours and scans completed are activity measures that do not show whether exposure on revenue-critical systems is falling.

• A. An inventory of information assets, so recovery priorities are known in advance
• B. Standard procedures for each security tool, so analysts follow vendor-recommended steps
• C. Roles and decision authority, so each containment call has a named owner Correct answer
• D. A schedule of recurring log reviews, so anomalies are spotted before they escalate

Option C is correct because a plan that names roles and decision authority lets responders make containment calls immediately without ad hoc approvals. An asset inventory, tool procedures and log-review schedules support response but do not remove the approval delay.

• A. Record the gap as accepted in the risk register, so it is formally documented
• B. Revise the RTO to 8 hours, so the objective matches current recovery capability
• C. Report the gap and its impact to senior leaders, so they can fund or accept it Correct answer
• D. Redesign the application for automatic failover, so the 2-hour objective is met

Option C is correct because the gap between the 2-hour RTO and the 8-hour recovery is a business risk that senior leaders must decide to fund or accept. Changing the RTO, logging acceptance or redesigning the application unilaterally bypasses that decision.

• A. Update the plan for the provider's recovery terms, so the exercise tests real dependencies Correct answer
• B. Run the exercise as scheduled on the existing plan, so its gaps are documented for revision
• C. Add recovery-time clauses to the provider contract, so commitments are enforceable at renewal
• D. Commission a new BIA for every process, so recovery priorities reflect the migration

Option A is correct because the plan still assumes a recovery site the company no longer relies on, so it must reflect the provider's recovery terms before the exercise can test real dependencies. Running it as is, contract changes or a full new BIA do not fix the plan in time.

• A. An audit schedule for the DRP, so its readiness is independently confirmed each year
• B. A post-incident reporting template, so the outcome of each event is documented consistently
• C. Training on the DRP's recovery runbooks, so responders can carry out site failover themselves
• D. Escalation thresholds tied to impact and RTO, so a disaster declaration follows set triggers Correct answer

Option D is correct because the delay came from unclear criteria for declaring a disaster, so escalation thresholds tied to impact and RTO make the decision follow set triggers. Audits, report templates and runbook training do not settle who declares or when.

• A. Reclassify it as high severity, so escalation and resources match the potential impact Correct answer
• B. Revise the SOC's classification criteria, so asset value counts alongside technical severity
• C. Confirm through forensic review that data left the laptop, so the rating rests on evidence
• D. Notify legal counsel and the audit committee, so disclosure obligations are assessed early

Option A is correct because the immediate priority is to correct the severity so escalation and resources match the real impact of exposed earnings data and external beaconing. Revising criteria, forensics and notifications are important but follow once the incident is properly escalated.