ISACA CISM Practice Exams
Last updated on Oct 22,2026- Exam Code: CISM
- Exam Name: Certified Information Security Manager
- Certification Provider: ISACA
- Latest update: Oct 22,2026
The PRIMARY goal of the eradication phase in an incident response process is to:
- A . maintain a strict chain of custody.
- B . provide effective triage and containment of the incident.
- C . remove the threat and restore affected systems
- D . obtain forensic evidence from the affected system.
Which of the following has the GREATEST influence on an organization’s information security strategy?
- A . The organization’s risk tolerance
- B . The organizational structure
- C . Industry security standards
- D . Information security awareness
In order to understand an organization’s security posture, it is MOST important for an organization’s senior leadership to:
- A . evaluate results of the most recent incident response test.
- B . review the number of reported security incidents.
- C . ensure established security metrics are reported.
- D . assess progress of risk mitigation efforts.
An incident management team is alerted ta a suspected security event.
Before classifying the suspected event as a security incident, it is MOST important for the security manager to:
- A . notify the business process owner.
- B . follow the business continuity plan (BCP).
- C . conduct an incident forensic analysis.
- D . follow the incident response plan.
Which of the following is a PRIMARY responsibility of the information security goxernance function?
- A . Administering information security awareness training
- B . Defining security strategies to support organizational programs
- C . Ensuring adequate support for solutions using emerging technologies
- D . Advising senior management on optimal levels of risk appetite and tolerance
Which of the following is the BEST indication of a mature information security program?
- A . Security incidents are managed properly.
- B . Security spending is below budget.
- C . Security resources are optimized.
- D . Security audit findings are reduced.
Which of the following is the MOST effective way to ensure information security policies are understood?
- A . Implement a whistle-blower program.
- B . Provide regular security awareness training.
- C . Include security responsibilities in job descriptions.
- D . Document security procedures.
Which of the following is the MOST important security consideration when developing an incident response strategy with a cloud provider?
- A . Escalation processes
- B . Recovery time objective (RTO)
- C . Security audit reports
- D . Technological capabilities
Which of the following is the BEST reason for an organization to use Disaster Recovery as a Service (DRaaS)?
- A . It transfers the risk associated with recovery to a third party.
- B . It lowers the annual cost to the business.
- C . It eliminates the need to maintain offsite facilities.
- D . It eliminates the need for the business to perform testing.
Predetermined containment methods to be used in a cybersecurity incident response should be based PRIMARILY on the:
- A . number of impacted users.
- B . capability of incident handlers.
- C . type of confirmed incident.
- D . predicted incident duration.