Free CISM Practice Test

The primary objective of a Business Impact Analysis (BIA) is to identify critical business processes and determine the operational and financial impacts of their disruption. By quantifying these impacts over time, the BIA allows an organization to establish clear recovery priorities. This ensures that limited resources are directed toward restoring the most critical functions first during a disaster. While defining the Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are key outcomes of the BIA, they are subsets of the overarching goal of prioritizing recovery efforts. The BIA aligns IT disaster recovery strategies directly with business criticality and continuity requirements.

B. Defining the RPO is a specific metric outcome of a BIA, but it is a subset of the broader primary objective of determining overall recovery priorities.
C. Confirming control effectiveness is the objective of security audits, penetration testing, and control assessments, not the BIA.
D. Analyzing vulnerabilities is part of a risk assessment or vulnerability management program, whereas the BIA focuses strictly on business impact and continuity.

1. ISACA CISM Review Manual, 15th Edition. Chapter 4: Information Security Incident Management, Section 4.10 (Business Impact Analysis).

2. NIST Special Publication 800-34 Rev. 1, "Contingency Planning Guide for Federal Information Systems," Section 3.2 (Conducting the BIA).

3. ISO 22301:2019, "Security and resilience — Business continuity management systems," Section 8.2.2 (Business impact analysis).

The most critical reason for an information security manager to participate in the change management committee (often referred to as the Change Advisory Board or CAB) is to advise on change-related security risks. Every modification to an IT environment—whether a system upgrade, network reconfiguration, or new application deployment—has the potential to introduce new vulnerabilities or inadvertently weaken existing security controls. By serving on the committee, the security manager provides expert oversight, evaluating proposed changes against the organization's risk appetite. This proactive involvement ensures that potential security impacts are identified, assessed, and mitigated before the change is implemented into the production environment, thereby maintaining the integrity and security posture of the enterprise.

A. Identifying changes to the security policy is an administrative task driven by business or regulatory shifts, not the primary operational purpose of reviewing IT system changes.
B. Ensuring that changes are tested is the responsibility of quality assurance and IT operations teams, not the primary strategic role of the information security manager.
C. Ensuring changes are properly documented is a general change management administrative function and compliance requirement, not the specific value-add of a security professional.

1. ISACA. (2022). CISM Review Manual, 15th Edition. Chapter 3: Information Security Program Development and Management, Section 3.7 (Integrating Security into Business Processes).

2. AXELOS. (2019). ITIL Foundation: ITIL 4 Edition. TSO (The Stationery Office). Section 5.2.4 (Change Enablement).

In the ISACA CISM framework, information security exists fundamentally to support, enable, and protect the organization's business objectives. Therefore, the overarching business strategy must have the most significant influence on the development of information security policies. Aligning security policies directly with the business strategy ensures that security initiatives facilitate core business operations, comply with relevant organizational goals, and receive appropriate executive support and funding. If security policies are developed in isolation from the business strategy, they risk becoming misaligned with organizational priorities, potentially acting as a barrier to operational success and failing to deliver tangible value to the enterprise.

B. While past and current threats inform specific risk assessments and technical controls, they do not dictate the overarching security policies, which must be business-driven.
C. An IT security framework provides a structural methodology for implementing security, but the framework itself must be selected and tailored based on the business strategy.
D. Industry standards guide best practices and compliance requirements, but they must be applied strictly within the context and boundaries of the organization's specific business strategy.

1. ISACA. (2016). CISM Review Manual, 15th Edition. Chapter 1: Information Security Governance, Section 1.2 (Business Model for Information Security).

2. ISACA. (2016). CISM Review Manual, 15th Edition. Chapter 1: Information Security Governance, Section 1.4 (Information Security Concepts and Technologies).

An information security program is best positioned for success when it is closely aligned with the overarching information security strategy. The security strategy serves as the critical bridge between high-level business objectives and the tactical execution of security initiatives. By aligning the program with the strategy, security leaders ensure that all operational activities, resource allocations, and control implementations directly support the organization's broader goals and risk appetite. This alignment guarantees that the program delivers tangible business value rather than operating in a silo. Ultimately, the strategy dictates the program's direction, ensuring that security efforts are prioritized based on business criticality.

A. Best practices are generic and may not address the specific risk appetite, operational context, or strategic goals of the individual organization.
B. Industry frameworks provide a structural guide but must be tailored; alignment with a framework does not guarantee alignment with the organization's specific business needs.
C. Information security policies are tactical directives derived from the strategy; aligning only with policies misses the broader strategic business context.

1. ISACA. (2016). CISM Review Manual, 15th Edition. Chapter 3: Information Security Program Development and Management, Section 3.2 (Alignment with Strategy).

2. Von Solms, B., & Von Solms, R. (2004). The 10 deadly sins of information security management. Computers & Security, 23(5), 371-376. https://doi.org/10.1016/j.cose.2004.05.002

A red team exercise provides the most accurate and comprehensive indication of an organization's ability to respond to a cyber attack. Unlike standard penetration tests that primarily focus on identifying technical vulnerabilities, red teaming simulates real-world, multi-vector adversarial tactics, techniques, and procedures (TTPs) over an extended period. This holistic approach rigorously tests the organization's entire defensive posture, including the effectiveness of its detection mechanisms, the readiness of the incident response team (Blue Team), and the robustness of established security procedures. By mimicking a genuine threat actor, it reveals practical gaps in the organization's detection and response capabilities under realistic operational conditions.

A. A walk-through is a theoretical tabletop exercise that discusses procedures but does not test actual operational detection and response capabilities under pressure.
B. A black box penetration test focuses on identifying and exploiting technical vulnerabilities rather than comprehensively evaluating the organization's incident response processes.
C. A simulated phishing exercise only tests end-user awareness and email security controls, not the comprehensive incident response capabilities of the security team.

1. ISACA CISM Review Manual, 15th Edition, Chapter 4 (Information Security Incident Management).

2. NIST Special Publication 800-115, Technical Guide to Information Security Testing and Assessment, Section 2.4 (Red Team Exercises).

The primary objective of incident triage is the rapid categorization, prioritization, and initial assessment of incoming security events. During the triage phase, security analysts evaluate alerts to determine their validity, scope, severity, and potential business impact. By accurately categorizing and prioritizing these events, the incident response team can efficiently allocate appropriate personnel and technical resources, determine the necessary urgency of the response, and assign the correct operational workflows. This ensures that critical, high-impact incidents are immediately addressed to minimize organizational damage, while lower-priority anomalies or false positives are filtered out, optimizing the overall efficiency of the incident management lifecycle.

A. This is a function of the broader incident management process and occurs after triage dictates the severity and identifies the required stakeholders.
B. Vulnerability mitigation is a proactive security measure or a post-incident remediation activity, not the immediate goal of the initial incident triage phase.
D. Containment is the subsequent phase of the incident response lifecycle, which is executed only after triage has successfully categorized and prioritized the incident.

1. ISACA CISM Review Manual, 16th Edition. Chapter 4: Information Security Incident Management, Section 4.5 (Incident Response Phases - Triage).

2. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (SP 800-61 Rev. 2). Section 3.2.4 (Incident Prioritization). https://doi.org/10.6028/NIST.SP.800-61r2

A successful information security culture is characterized by the collective behaviors, attitudes, and shared values of an organization's workforce regarding the protection of information assets. The best indicator of this culture is when end users actively demonstrate security-conscious behavior, such as correctly identifying and promptly reporting potential security incidents or suspicious activities. This proactive engagement proves that security awareness training has been effectively internalized and that employees understand their personal responsibility in safeguarding the organization. While technical assessments, access controls, and adequate funding are critical components of a broader security program, they reflect administrative or operational achievements rather than the actual cultural mindset and daily habits of the human workforce.

A. Regular penetration testing and remediation indicate good technical vulnerability management, but do not reflect the daily security behaviors or mindset of the general workforce.
C. Assigning roles based on job functions is an administrative implementation of the principle of least privilege, not a measure of organizational culture.
D. A sufficient budget indicates executive management's financial commitment to security, but it does not guarantee that employees exhibit secure behaviors.

1. ISACA CISM Review Manual, 15th Edition, Chapter 3: Information Security Program Development and Management, Section 3.8.

2. ENISA, "Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity," 2017, pp. 12-15.

When an organization anticipates civil litigation following a security incident, ensuring the admissibility of evidence in a court of law is paramount. The primary step to achieve this is maintaining and documenting a strict chain of custody. The chain of custody provides a chronological, verifiable paper trail that records the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. Without a documented chain of custody, opposing legal counsel can easily challenge the integrity, authenticity, and reliability of the evidence, rendering it inadmissible in court. Proper forensic procedures must prioritize this documentation from the very moment evidence is identified and collected.

A: Contacting law enforcement is typically associated with criminal investigations, whereas civil litigation is a private legal dispute between organizations or individuals. C: Standard server-backup utilities modify file metadata (such as access times) and do not create the forensically sound bit-by-bit images required for legal evidence. D: Rebooting affected machines destroys highly valuable volatile data stored in RAM and alters the system state, violating core digital forensic principles.

- ISACA CISM Review Manual, 15th Edition, Chapter 4: Information Security Incident Management, Section 4.8 Incident Response Phases, pp. 245-247.

- NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, Section 3.1.2 Chain of Custody.

In the context of information security and risk management, the primary basis for determining the value of an asset is the business impact or cost incurred when the asset is compromised or unavailable. Asset valuation extends beyond mere financial acquisition or replacement costs; it must account for the asset's criticality to business operations, revenue generation, and strategic objectives. If an asset's unavailability causes significant operational downtime, regulatory fines, or reputational damage, its intrinsic value to the organization is exceptionally high, regardless of its initial purchase price. Therefore, evaluating the potential business cost of asset unavailability provides the most accurate and comprehensive measure of its true value, ensuring that security investments are prioritized appropriately based on business impact.

A. Replacement cost only accounts for the physical or software replacement expense, ignoring the potentially massive operational losses incurred during downtime.
C. Original cost minus depreciation is a strict accounting measure that fails to reflect the asset's current operational criticality or the value of the data it holds.
D. Total cost of ownership (TCO) measures the financial cost to acquire, deploy, and maintain an asset, not its intrinsic value or criticality to business operations.

1. ISACA. (2016). CISM Review Manual, 15th Edition. Chapter 2: Information Risk Management, Section 2.4 (Asset Classification and Valuation).

2. NIST Special Publication 800-30 Rev. 1. (2012). Guide for Conducting Risk Assessments. Section 2.3.1 (Asset Valuation and Impact). https://doi.org/10.6028/NIST.SP.800-30r1

The most critical factor in ensuring staff acceptance of information security policies is strong senior management support. In information security governance, the "tone at the top" dictates the organizational culture and demonstrates that security is a critical business priority rather than just an IT issue. When executive leadership actively endorses and models compliance with security policies, it cascades down through the organization, fostering a culture of security awareness and accountability. While training and funding are necessary components of a security program, they are secondary to the foundational mandate and visible commitment provided by senior management, which ultimately drives user buy-in and behavioral change across all departments.

B. Computer-based training is a delivery mechanism for awareness but is largely ineffective without the mandate and cultural drive from senior management.
C. An incident response program is a reactive operational capability and does not proactively drive staff acceptance of security policies.
D. Adequate funding enables the purchase of tools and resources but does not inherently influence employee behavior or policy acceptance.

1. ISACA. (2016). CISM Review Manual, 15th Edition. Chapter 1: Information Security Governance, Section 1.3 (Effective Information Security Governance), pp. 18-20.

2. International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection. Clause 5.1 (Leadership and commitment).