Question bank
ISACA CISM
42 ISACA CISM questions with the correct answer and a written explanation, organised across 4 exam domains.
- 42 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Incident Management
12 questions in this domain
- Question 1Single Choice
In the CISM Incident Management domain, what is an incident response plan best described as?
- AA strategic governance artifactCorrect answer
- BA firewall configuration document
- CA backup retention schedule
- DA network architecture diagram
Why this is the answer
An IR plan translates management directives into actionable steps and is a strategic governance artifact, not merely a technical playbook.
- Question 2Multiple Select
Which groups should be involved in developing an incident response plan? (Select all that apply.)
- ALegalCorrect answer
- BHuman ResourcesCorrect answer
- CIT operationsCorrect answer
- DExternal marketing agency
Why this is the answer
Legal, HR, communications, IT, and business units all provide input to the IR plan, ensuring breadth across compliance, people, and operations.
- Question 3Interactive
Based on the logic in the code block, what severity is assigned when a business-critical system is affected?
- ASEV1Correct answer
- BSEV2
- CSEV3
- DNo escalation
Why this is the answer
The code sets severity to SEV1 when business_critical is true, meaning the most urgent classification is used for critical business impact.
- Question 4Single Choice
According to CISM, where does ultimate accountability for incident response rest?
- ASenior management or boardCorrect answer
- BCISO
- CTechnical lead
- DIncident commander
Why this is the answer
Ultimate accountability for incident response rests with senior management or the board, not with the CISO or technical lead.
- Question 5Multiple Select
Which activities ensure that an incident response plan remains current? (Select all that apply.)
- AReview lessons learnedCorrect answer
- BConduct annual reviewsCorrect answer
- CUpdate after architecture changesCorrect answer
- DDelete superseded versions immediately
Why this is the answer
The plan is reviewed after incidents, at least annually, and when IT architecture or business changes; version control is also essential.
- Question 6Interactive
Using the RACI information in the code block, which role is accountable for incident response?
- ASenior ManagementCorrect answer
- BIncident Response Team
- CLegal
- DCommunications
Why this is the answer
The code explicitly assigns accountability to Senior Management, reinforcing the CISM principle that final ownership sits at the executive level.
- Question 7Single Choice
What is the primary purpose of an incident response policy in an organization?
- ASenior management statement of intentCorrect answer
- BDetailed step-by-step procedures
- CForensic tool list
- DBackup recovery steps
Why this is the answer
The IR policy states management intent, objectives, scope, and authorities; the IR plan operationalises the policy with detailed procedures.
- Question 8Multiple Select
Which criteria should influence incident severity classification? (Select all that apply.)
- ABusiness impactCorrect answer
- BData sensitivityCorrect answer
- CRegulatory obligationsCorrect answer
- DTotal number of alerts
Why this is the answer
Classification is based on business impact, data sensitivity, and regulatory obligations; alert count alone should not decide severity.
- Question 9Interactive
According to the code block, when should an incident be escalated to the CISO?
- ASEV1 or regulatory requirementCorrect answer
- BAny SEV2 incident
- CAll user reports
- DNo escalation
Why this is the answer
The code escalates when severity is SEV1 or when regulatory notification is required, matching CISM escalation threshold principles.
- Question 10Single Choice
What is the main purpose of an incident escalation procedure?
- ANotification thresholds and pathwaysCorrect answer
- BAntivirus update schedule
- CPassword policy
- DHardware inventory
Why this is the answer
Escalation defines thresholds, pathways, and timelines for notifying higher management or engaging specialized teams as severity grows.
- Question 11Multiple Select
Which events are common escalation triggers in incident management? (Select all that apply.)
- AInvolvement of regulated dataCorrect answer
- BComplete loss of a critical systemCorrect answer
- CUncontained spread after defined timeCorrect answer
- DLow disk space on a file server
Why this is the answer
Common triggers include regulated data, critical system loss, unknown propagation, or failure to contain within a specified timeframe.
- Question 12Interactive
Which alerts in the code block satisfy the escalation criteria? (Select all that apply.)
- AA1Correct answer
- BA3Correct answer
- CA2
- DNone
Why this is the answer
The code escalates alerts where critical_system or lateral_movement is true; A1 and A3 meet these conditions.
Information Security Governance
8 questions in this domain
- Question 13Single Choice
What is the information security strategy within the CISM framework?
- AA high-level governance plan aligned with business objectivesCorrect answer
- BA detailed technical control implementation guide
- CA standalone security tool deployment roadmap
- DA list of compliance checklists for audit
Why this is the answer
The strategy is an authoritative high-level plan that enables business goals while managing risk, not a technical control collection.
- Question 14Multiple Select
Which two inputs are essential when developing the information security strategy?
- AEnterprise business objectives and driversCorrect answer
- BRisk appetite and tolerance levelsCorrect answer
- CDefault industry best practices
- DAntivirus software vendor capabilities
Why this is the answer
Strategy starts from business goals and risk appetite; best practices must be tailored and vendor tools are not foundational inputs.
- Question 15Interactive
Review the actions in the code block. Which action demonstrates strategic alignment after a major business objective changes?
- AUpdate firewall rules
- BRevisit the security strategyCorrect answer
- CInstall endpoint protection
- DRun a vulnerability scan
Why this is the answer
A change in business objectives requires reassessing the security strategy, not implementing tactical controls.
- Question 16Single Choice
Who holds ultimate accountability for information security governance in an enterprise?
- ABoard of directorsCorrect answer
- BChief information security officer
- CSecurity manager
- DInternal audit
Why this is the answer
The board of directors holds ultimate accountability; the CISO is responsible for implementation, not final governance ownership.
- Question 17Multiple Select
Which two components are part of an information security governance framework?
- AClear roles and decision rightsCorrect answer
- BPolicy hierarchyCorrect answer
- CSIEM configuration
- DFirewall rule review
Why this is the answer
A governance framework formalizes roles, decision rights, and the policy hierarchy; SIEM and firewall tasks are operational.
- Question 18Interactive
Using the code block, identify the item that belongs to security operations rather than governance.
- APolicy hierarchy
- BSteering committee
- CSIEM alertsCorrect answer
- DRisk reporting
Why this is the answer
SIEM alerts are operational outputs; governance is supported by policies, committees, and risk reporting.
- Question 19Single Choice
Which document in the policy hierarchy is mandatory and specifies measurable security requirements?
- APolicy
- BStandardCorrect answer
- CGuideline
- DProcedure
Why this is the answer
Standards are mandatory, measurable requirements; policies state intent, guidelines are optional, and procedures are step-by-step.
- Question 20Multiple Select
Which two activities ensure a security policy is truly implemented?
- AAwareness communication and trainingCorrect answer
- BCompliance verification and enforcementCorrect answer
- CPosting the policy on the intranet only
- DDeleting outdated standards
Why this is the answer
Implementation includes communication, training, compliance verification, and enforcement; publishing alone is not sufficient.
Information Security Program
14 questions in this domain
- Question 21Single Choice
Which statement best defines an information security program in the CISM context?
- AA collection of standalone security products
- BA governance-driven capability that translates risk appetite into actionable security outcomesCorrect answer
- CA set of technical controls managed only by the IT department
- DA one-time project designed to eliminate all security risk
Why this is the answer
An information security program is a governance-driven capability that aligns people, process, and technology to turn risk appetite into security outcomes.
- Question 22Multiple Select
Which two concepts are key elements of an information security program? (Select all that apply.)
- ABusiness alignment and strategyCorrect answer
- BRisk-based program designCorrect answer
- CMaximum technical perfection
- DComplete elimination of residual risk
Why this is the answer
A program is driven by business alignment and risk-based design; technical perfection and zero residual risk are unrealistic distractors.
- Question 23Interactive
Refer to the code block. Which document type is mandatory and consists of step-by-step actions?
- APolicy
- BStandard
- CProcedureCorrect answer
- DGuideline
Why this is the answer
A procedure is a mandatory document containing step-by-step instructions for implementing standards.
- Question 24Single Choice
Who holds ultimate accountability for the information security program?
- ABoard of directorsCorrect answer
- BCISO
- CSecurity steering committee
- DInternal audit
Why this is the answer
The board and senior management hold ultimate accountability; the CISO is responsible for implementation.
- Question 25Multiple Select
Select the two statements that correctly describe CISM governance roles.
- AThe CISO is responsible for designing and operating the program.Correct answer
- BThe board is accountable for risk oversight.Correct answer
- CThe CISO has ultimate accountability for business risk.
- DBusiness unit managers are accountable for the entire program.
Why this is the answer
The CISO is responsible for execution, while the board is accountable for risk oversight.
- Question 26Interactive
Refer to the code block. Which document type is mandatory and defines rules based on policy?
- APolicy
- BStandardCorrect answer
- CProcedure
- DGuideline
Why this is the answer
Standards are mandatory rules and requirements based on policies.
- Question 27Single Choice
What is a security policy in the CISM document hierarchy?
- AA high-level statement of intent and direction approved by senior managementCorrect answer
- BA step-by-step instruction for configuring a firewall
- CA recommended practice that is not mandatory
- DA technical standard for encryption algorithms
Why this is the answer
Policies are high-level statements of intent and direction, approved by senior management.
- Question 28Multiple Select
Which two actions demonstrate strategic alignment of the security program? (Select all that apply.)
- AParticipating in business planning sessionsCorrect answer
- BFraming security budgets in terms of business valueCorrect answer
- CImplementing controls regardless of business impact
- DAvoiding communication with executives
Why this is the answer
Strategic alignment means security participates in business planning and frames investments as business value.
- Question 29Interactive
Refer to the code block. Which role approves the security strategy?
- ABoard of directorsCorrect answer
- BCISO
- CSecurity steering committee
- DInternal audit
Why this is the answer
The board approves strategy and risk appetite; the CISO implements the program.
- Question 30Single Choice
What is risk appetite in the CISM context?
- AThe amount of risk the organization is willing to acceptCorrect answer
- BThe amount of risk that can be completely eliminated
- CThe maximum security budget approved by the board
- DThe number of controls implemented by the security team
Why this is the answer
Risk appetite is the amount of risk the organization is willing to accept in pursuit of objectives.
- Question 31Multiple Select
Which two activities are part of the strategic planning cycle? (Select all that apply.)
- AConducting environmental scansCorrect answer
- BPerforming gap analysis against strategic objectivesCorrect answer
- CFreezing the strategy for five years
- DWaiting for incidents before reviewing strategy
Why this is the answer
The planning cycle uses environmental scans and gap analysis, and it must be reviewed dynamically.
- Question 32Interactive
Refer to the code block. Which duty belongs to the CISO?
- AApprove risk appetite
- BDesign and implement the programCorrect answer
- CHold board accountability
- DPerform independent audit
Why this is the answer
The CISO designs, implements, and operates the program and reports to executives.
- Question 33Single Choice
How should frameworks such as ISO/IEC 27001 be used in program design?
- ATailor the framework to the organization's threat environment and business contextCorrect answer
- BApply the framework exactly without any customization
- CUse the framework only after a security incident
- DReplace risk assessment with framework compliance
Why this is the answer
Frameworks are valuable references but must be tailored to the organization's culture and requirements.
- Question 34Multiple Select
Which two statements correctly describe design and operating effectiveness? (Select all that apply.)
- AWalkthroughs evaluate design effectivenessCorrect answer
- BSubstantive testing evaluates operating effectivenessCorrect answer
- CDocument review proves operating effectiveness
- DA certified audit guarantees future control operation
Why this is the answer
Design effectiveness is checked through walkthroughs; operating effectiveness requires substantive testing and observation.
Information Security Risk Management
8 questions in this domain
- Question 35Single Choice
What is the primary purpose of a risk management methodology in an organization?
- AA structured process to manage risksCorrect answer
- BA guarantee that no risks occur
- CA replacement for business continuity
- DA set of marketing guidelines
Why this is the answer
A risk management methodology provides a structured, repeatable process to identify, assess, analyze, evaluate, and treat risks.
- Question 36Multiple Select
Which statements about risk appetite and risk tolerance are correct? (Select two.)
- ARisk appetite is the broad level of risk an organization is willing to accept.Correct answer
- BRisk tolerance is the acceptable deviation from risk appetite.Correct answer
- CRisk appetite and risk tolerance are synonyms.
- DRisk tolerance is defined only by technical teams.
Why this is the answer
Risk appetite is broad willingness; tolerance is the measurable acceptable deviation from that appetite.
- Question 37Interactive
Refer to the risk register extract. What is the residual risk rating for the payment system?
- AHigh
- BMedium
- CLowCorrect answer
- DUnacceptable
Why this is the answer
Residual risk is the risk remaining after controls; the exhibit shows it as Low.
- Question 38Single Choice
Which framework is a recognized foundation for information security risk management?
- AISO/IEC 27005Correct answer
- BTCP/IP
- CHTML5
- DWaterfall SDLC
Why this is the answer
ISO/IEC 27005 is a recognized risk management framework.
- Question 39Multiple Select
Which activities are part of the risk management lifecycle? (Select three.)
- AEstablish contextCorrect answer
- BIdentify risksCorrect answer
- CMonitor and communicateCorrect answer
- DDevelop marketing plans
Why this is the answer
Key lifecycle phases include establishing context, identifying risks, and monitoring/communicating.
- Question 40Interactive
Refer to the analysis method shown. What type of risk analysis is this?
- AQuantitative analysis
- BQualitative analysisCorrect answer
- CMarket analysis
- DRoot cause analysis
Why this is the answer
Qualitative analysis uses descriptive scales such as high, medium, and low.
- Question 41Single Choice
What is produced during the risk analysis phase?
- AA list of all potential risks
- BA risk rating based on likelihood and impactCorrect answer
- CA vendor contract
- DA final risk acceptance decision
Why this is the answer
Risk analysis estimates likelihood and impact to produce a risk rating.
- Question 42Multiple Select
Which statements about qualitative risk analysis are true? (Select two.)
- AIt uses descriptive scales such as high, medium, and low.Correct answer
- BIt relies on expert judgment.Correct answer
- CIt requires exact historical loss data.
- DIt always produces monetary values.
Why this is the answer
Qualitative analysis uses descriptive scales and expert judgment, not precise monetary data.
Frequently asked questions
Everything about the ISACA CISM question bank and how to use it.