Free CISM Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the CISM Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A company delegates security operations to a service provider. Under CSF 2.0, who retains organizational accountability for cybersecurity risk?

   1. A. The service provider's technical lead
   2. B. The company's organizational leadership
   3. C. The company's independent control assessor
   4. D. The service provider's contract administrator

   Answer: B

   Explanation: CSF 2.0 states, "Organizational leadership is responsible and accountable for cybersecurity risk". Outsourcing operations does not transfer this leadership accountability to the provider or assessor.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Appendix A, GV.RR-01, p. 17

2. 2Two security scenarios have the same potential business impact but substantially different probabilities of occurring. What explains why their risk levels can differ?

   1. A. Risk depends on impact severity without considering probability
   2. B. Risk depends on the number of controls without considering impact
   3. C. Risk depends on both likelihood and potential adverse impact
   4. D. Risk depends on assessment frequency without considering probability

   Answer: C

   Explanation: SP 800-30 states, "risk is a function of the likelihood of a threat event’s occurrence and potential adverse impact should the event occur". Equal impacts do not imply equal risk when likelihood differs.

   Reference: Guide for Conducting Risk Assessments — Section 2.3.1, Risk, p. 12

3. 3When classifying information, a manager considers the harm from disclosure to an unauthorized person. Which security objective is being evaluated?

   1. A. Availability
   2. B. Integrity
   3. C. Authenticity
   4. D. Confidentiality

   Answer: D

   Explanation: FIPS 199 states, "A loss of confidentiality is the unauthorized disclosure of information". Integrity concerns improper modification or destruction; availability concerns access. Authenticity does not identify the disclosure objective.

   Reference: Standards for Security Categorization of Federal Information and Information Systems — Section 3, Security Objectives, p. 2

4. 4Which plan primarily addresses sustaining organizational business processes during and after a disruption?

   1. A. A disaster recovery plan
   2. B. An information system contingency plan
   3. C. A cyber incident response plan
   4. D. A business continuity plan

   Answer: D

   Explanation: SP 800-34 states, "The BCP focuses on sustaining an organization’s mission/business processes during and after a disruption". The other plans focus on alternate-site system recovery, individual system recovery, or cyber incident handling.

   Reference: Contingency Planning Guide for Federal Information Systems — Section 2.2.1, Business Continuity Plan, p. 8

5. 5Business units interpret their security responsibilities differently despite having an approved responsibility matrix. Which governance action addresses this problem most directly?

   1. A. Obtain fresh signatures acknowledging receipt of the responsibility matrix
   2. B. Transfer interpretation of all assigned duties to the internal audit team
   3. C. Communicate responsibilities and verify that staff understand them
   4. D. Treat publication of the matrix as evidence that duties are understood

   Answer: C

   Explanation: GV.RR-02 requires responsibilities to be "established, communicated, understood, and enforced". Receipt signatures and publication demonstrate distribution, not understanding. Internal audit should not replace management's communication and enforcement of assigned duties.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Appendix A, GV.RR-02, p. 17

6. 6A review finds that the procedure for approving privileged access omits any verification of the requester's authority. How should this exploitable procedural weakness be classified?

   1. A. A vulnerability
   2. B. A threat source
   3. C. An adverse impact
   4. D. A risk tolerance

   Answer: A

   Explanation: A vulnerability is "a weakness in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source". The deficient approval procedure is a weakness, not the actor, resulting harm, or acceptable risk level.

   Reference: Guide for Conducting Risk Assessments — Section 2.3.1, Vulnerabilities, p. 9

7. 7A classification analysis examines the consequences of unauthorized changes to financial records. Which security objective is directly involved?

   1. A. Confidentiality
   2. B. Integrity
   3. C. Availability
   4. D. Privacy

   Answer: B

   Explanation: FIPS 199 states, "A loss of integrity is the unauthorized modification or destruction of information". Unauthorized changes affect integrity even if access and confidentiality remain intact.

   Reference: Standards for Security Categorization of Federal Information and Information Systems — Section 3, Security Objectives, p. 2

8. 8Under SP 800-34 terminology, which plan focuses on restoring systems or computing facility infrastructure at an alternate site when the primary facility is unusable?

   1. A. A business continuity plan
   2. B. A disaster recovery plan
   3. C. A crisis communications plan
   4. D. A cyber incident response plan

   Answer: B

   Explanation: SP 800-34 describes the DRP as restoring "operability of the target system, application, or computer facility infrastructure at an alternate site". The question concerns relocation-based system recovery rather than business continuity, communications, or attack handling.

   Reference: Contingency Planning Guide for Federal Information Systems — Section 2.2.6, Disaster Recovery Plan, p. 10

9. 9When documenting the organization's cybersecurity obligations, which set of requirements matches the organizational-context outcome in CSF 2.0?

   1. A. Legal and regulatory requirements, excluding private agreements
   2. B. Contractual requirements, excluding privacy-related obligations
   3. C. Internal security preferences, excluding civil liberties obligations
   4. D. Legal, regulatory, and contractual requirements, including privacy obligations

   Answer: D

   Explanation: GV.OC-03 includes "Legal, regulatory, and contractual requirements regarding cybersecurity" and expressly includes "privacy and civil liberties obligations". Each alternative omits an applicable class of obligations.

   Reference: The NIST Cybersecurity Framework (CSF) 2.0 — Appendix A, GV.OC-03, p. 16

10. 10A facility's location in a flood-prone area increases its exposure to flooding. Which risk concept describes this contextual influence?

    1. A. A risk response option
    2. B. A control assessment result
    3. C. An adversarial targeting decision
    4. D. A predisposing condition

    Answer: D

    Explanation: SP 800-30 lists "the location of a facility in a hurricane- or flood-prone region" as a predisposing condition. It affects exposure rather than constituting a selected response, an assessment result, or an adversary's decision.

    Reference: Guide for Conducting Risk Assessments — Section 2.3.1, Predisposing Conditions, p. 10