ISACA CISM Practice Exams
Last updated on Oct 21,2026- Exam Code: CISM
- Exam Name: Certified Information Security Manager
- Certification Provider: ISACA
- Latest update: Oct 21,2026
Which of the following BEST facilitates the reporting of useful information about the effectiveness of the information security program?
- A . Risk heat map.
- B . Security benchmark report.
- C . Security metrics dashboard.
- D . Key risk indicators (KRIs).
After the occurrence of a major information security incident, which of the following will BEST help an information security manager determine corrective actions?
- A . Calculating cost of the incident
- B . Conducting a postmortem assessment
- C . Performing an impact analysis
- D . Preserving the evidence
The MOST useful technique for maintaining management support for the information security program is:
- A . informing management about the security of business operations.
- B . implementing a comprehensive security awareness and training program.
- C . identifying the risks and consequences of failure to comply with standards.
- D . benchmarking the security programs of comparable organizations.
Which of the following BEST facilitates the development of a comprehensive information security policy?
- A . Alignment with an established information security framework
- B . An established internal audit program
- C . Security key performance indicators (KPIs)
- D . Areview of recent information security incidents
Which of the following is an example of risk mitigation?
- A . Purchasing insurance
- B . Discontinuing the activity associated with the risk
- C . Improving security controls
- D . Performing a cost-benefit analysis
An organization that conducts business globally is planning to utilize a third-party service provider to process payroll information.
Which of the following issues poses the GREATEST risk to the organization?
- A . The third party does not have an independent assessment of controls available for review.
- B . The third party has not provided evidence of compliance with local regulations where data is generated.
- C . The third-party contract does not include an indemnity clause for compensation in the event of a breach.
- D . The third party’s service level agreement (SLA) does not include guarantees of uptime.
A multinational organization is required to follow governmental regulations with different security requirements at each of its operating locations.
The chief information security officer (CISO) should be MOST concerned with:
- A . developing a security program that meets global and regional requirements.
- B . ensuring effective communication with local regulatory bodies.
- C . using industry best practice to meet local legal regulatory requirements.
- D . monitoring compliance with defined security policies and standards.
Which of the following is the PRIMARY benefit achieved when an information security governance framework is aligned with corporate governance?
- A . Protection of business value and assets
- B . Identification of core business strategies
C, Easier entrance into new businesses and technologies - C . Improved regulatory compliance posture
When establishing metrics for an information security program, the BEST approach is to identify indicators that:
- A . reduce information security program spending.
- B . support major information security initiatives.
- C . reflect the corporate risk culture.
- D . demonstrate the effectiveness of the security program.
The effectiveness of an information security governance framework will BEST be enhanced if:
- A . consultants review the information security governance framework.
- B . a culture of legal and regulatory compliance is promoted by management.
- C . risk management is built into operational and strategic activities.
- D . IS auditors are empowered to evaluate governance activities