العربية

CISM – Certified Information Security Manager (ISACA): free practice test

Start with 10 free questions to see what needs more practice. Finish to see your score, weakest units and every option explained.

450 on the 200–800 scale This is your practice accuracy. It cannot be converted to the exam’s scaled score or used to determine whether you pass.

Back to CISM – Certified Information Security Manager (ISACA)

Practice test questions with answers and explanations

Try the questions in the test above first, then open each one here to see the correct answer and why every other option is wrong.

01Which factor MOST influences the success of an information security governance program?

Practice question Unit: Information Security Governance

  1. AThe number of security tools deployed across the enterprise

    Tool counts do not establish authority, priorities or accountability.

  2. BVisible commitment from senior management ✓ Correct answer

    Senior management supplies mandate, resources and accountability for governance.

  3. CAnnual penetration testing by an external firm

    A penetration test gives technical findings but not sustained governance direction.

  4. DA detailed technical security architecture

    Architecture supports implementation but cannot replace executive commitment.

Reference: CISM – Certified Information Security Manager (ISACA), Information Security Governance – 1A Enterprise governance: culture, legal/regulatory, roles

02After a merger, two security teams follow different policies. What should the information security manager do FIRST?

Practice question Unit: Information Security Governance

  1. AKeep both sets unchanged permanently

    Keeping conflicting policies indefinitely leaves inconsistent obligations.

  2. BReview both policy sets against the new business objectives and risks ✓ Correct answer

    Compare both policies with the merged objectives and risk profile before harmonizing.

  3. CAdopt the policies of the larger company because they cover more employees

    Company size does not establish which requirements match the merged business.

  4. DReplace all policies with a vendor template

    A vendor template cannot determine organization-specific obligations and priorities.

Reference: CISM – Certified Information Security Manager (ISACA), Information Security Governance – 1A Enterprise governance: culture, legal/regulatory, roles

03Which source is MOST useful for understanding current threats to the organization's sector?

Practice question Unit: Information Security Risk Management

  1. ASector threat intelligence sharing groups ✓ Correct answer

    Sector sharing groups provide relevant threat patterns and indicators from peers.

  2. BThe organization's annual report to shareholders

    An annual report gives business results rather than timely attack intelligence.

  3. CThe HR handbook

    An HR handbook describes employment policies, not current sector attacks.

  4. DProduct brochures

    Product brochures describe capabilities and may omit current sector threats.

Reference: CISM – Certified Information Security Manager (ISACA), Information Security Risk Management – 2A Risk identification: threat landscape, vulnerabilities, assessment

04A company stops offering a risky online service because the risk cannot be reduced. This is an example of:

Practice question Unit: Information Security Risk Management

  1. ARisk mitigation

    Mitigation keeps the activity while reducing likelihood or impact.

  2. BRisk acceptance after review by the risk owner

    Acceptance keeps the activity and consciously retains its residual risk.

  3. CRisk avoidance ✓ Correct answer

    Ending the risk-producing service removes that activity’s exposure: avoidance.

  4. DRisk transfer

    Transfer shifts specified consequences, for example through insurance.

Reference: CISM – Certified Information Security Manager (ISACA), Information Security Risk Management – 2B Risk response: treatment options, ownership, monitoring

05What is the FIRST step in developing an information security program?

Practice question Unit: Information Security Program

  1. ABuy security tools

    Tool choices should follow defined requirements and priorities.

  2. BDefine the program's scope and objectives based on strategy ✓ Correct answer

    Scope and objectives translate approved strategy into a coherent program.

  3. CHire a penetration tester

    Testing specialists are resources selected after program requirements are understood.

  4. DWrite technical procedures for each platform used by the organization

    Platform procedures implement a program; they do not establish its direction.

Reference: CISM – Certified Information Security Manager (ISACA), Information Security Program – 3A Program development: architecture, resources, policies, classification, controls, metrics

06Which document specifies mandatory requirements, such as minimum password length?

Practice question Unit: Information Security Program

  1. AGuideline

    Guidelines offer recommended ways to meet requirements.

  2. BPolicy

    Policy states direction; a standard supplies specific mandatory criteria.

  3. CVision statement

    A vision describes a desired future, not enforceable password criteria.

  4. DStandard ✓ Correct answer

    A standard makes detailed requirements, such as minimum length, mandatory.

Reference: CISM – Certified Information Security Manager (ISACA), Information Security Program – 3A Program development: architecture, resources, policies, classification, controls, metrics

07Which is the BEST way to verify that a newly implemented control operates effectively?

Practice question Unit: Information Security Program

  1. ATest it against its defined objectives ✓ Correct answer

    Test actual operation against the control objectives and retain evidence.

  2. BWait for audit

    Waiting for audit delays discovering an ineffective control.

  3. CReview its design documentation for alignment with the standard

    Design conformity does not prove that the control operates effectively.

  4. DAsk the implementer to confirm by email that the control has been configured as requested

    The implementer’s statement is weaker evidence than an operating test.

Reference: CISM – Certified Information Security Manager (ISACA), Information Security Program – 3B Program management: control implementation/testing, awareness, third parties, reporting

08What is the PRIMARY purpose of an incident response plan?

Practice question Unit: Incident Management

  1. ASatisfy the cyber insurance provider so that the premium can be reduced at renewal

    Insurance requirements may be relevant, but coordinated harm reduction is the primary purpose.

  2. BPrevent all incidents

    Prevention reduces likelihood but no response plan guarantees zero incidents.

  3. CAssign blame after incidents

    Assigning blame is not the operational objective of incident response.

  4. DEnable a timely, coordinated response that limits impact ✓ Correct answer

    An IRP coordinates responsibilities, decisions and actions to limit incident impact.

Reference: CISM – Certified Information Security Manager (ISACA), Incident Management – 4A Readiness: IRP, BIA, BCP, DRP, classification, testing

09A business impact analysis shows a payment system can be down for at most 4 hours. What does this value represent?

Practice question Unit: Incident Management

  1. AService level target for help desk tickets raised by users of the payment system

    A help desk target concerns ticket handling, not maximum business disruption.

  2. BRecovery point objective

    RPO measures acceptable data loss in time, not outage duration.

  3. CMaximum tolerable downtime ✓ Correct answer

    MTD is the longest business interruption tolerable before unacceptable impact.

  4. DMean time between failures

    MTBF measures average operating time between failures.

Reference: CISM – Certified Information Security Manager (ISACA), Incident Management – 4A Readiness: IRP, BIA, BCP, DRP, classification, testing

10Which is the BEST tool for correlating security events from many sources?

Practice question Unit: Incident Management

  1. AVulnerability scanner

    A vulnerability scanner identifies weaknesses rather than correlating live events.

  2. BBackup software that copies logs to a central server every night

    Copying logs preserves them but does not provide event correlation.

  3. CPassword manager

    A password manager stores credentials, not enterprise security events.

  4. DSIEM ✓ Correct answer

    SIEM collects and correlates events from different systems for detection.

Reference: CISM – Certified Information Security Manager (ISACA), Incident Management – 4B Operations: tools, investigation, containment, communications, recovery, post-incident review

Keep preparing for CISM – Certified Information Security Manager (ISACA)

See also: Engineering Exams

All Engineering Exams (15)