CISM Practice Questions & Practice Test

A critical security service is outsourced and executives assume accountability has moved to the provider. Which governance position is MOST appropriate?

• A.The organisation retains accountability while the provider performs contracted activities
• B.The provider assumes full accountability for the outsourced service
• C.The internal audit function becomes accountable for the outsourced activity
• D.The procurement department accepts the cyber‑risk associated with the outsourcing

Why: Outsourcing transfers the performance of a security function, not the ownership of its results. Governance frameworks require the organization to retain accountability for security while the provider fulfills the contracted tasks, ensuring proper oversight and compliance. The organization must keep ultimate accountability for security outcomes even when execution is delegated to a provider.

A proposed security strategy lists specific products but fails to explain how security supports the organization’s goals. What should be improved FIRST?

• A.Identify and prioritize individual security tools based on vendor features and cost
• B.Develop a compliance checklist that enumerates required controls for each regulatory framework
• C.Replace the existing security products with newer solutions that have higher market ratings
• D.Map security outcomes and initiatives to business objectives and material risks

Why: A security strategy must be driven by the organization’s mission, objectives, and risk profile. By mapping security initiatives to business goals and material risks, the strategy becomes a business enabler rather than a disconnected technology list. This alignment guides investment decisions and prioritizes actions that deliver real value. Aligning security outcomes with business objectives and material risks ensures the strategy directly supports enterprise goals.

A new regulation imposes incident reporting duties, but business units disagree on who must notify the regulator. What is the BEST governance action?

• A.Allow the SOC to decide on notification for each incident, then document the outcome.
• B.Wait until a reportable incident occurs before establishing any notification procedures.
• C.Define decision rights, assign accountability, and establish escalation paths, then communicate them.
• D.Assign all regulator notifications to internal audit and have them handle reporting exclusively.

Why: Effective governance requires decision rights, accountability, and escalation paths to be defined and communicated in advance so reporting obligations are met consistently. Without these structures, organizations risk fragmented responses, regulatory breaches, and loss of control over incident handling. It creates clear authority and responsibility for reporting before incidents occur, ensuring consistent compliance.

A transformation initiative introduces cloud services and APIs, but the organization’s security architecture has not been updated. What should the CISO recommend as the first step?

• A.Retain the existing security architecture until a security incident occurs
• B.Purchase a single enterprise security product to protect the new services
• C.Align security architecture with the target enterprise architecture and roadmap
• D.Delegate all security architecture responsibilities to the cloud service providers

Why: Security architecture should evolve in step with business and technology changes. Aligning it with the target enterprise architecture and roadmap ensures that security controls are integrated, consistent, and support the organization’s strategic objectives, especially when adopting cloud services and APIs. Because security architecture must be synchronized with the evolving enterprise architecture to ensure controls are effective across cloud services and APIs.

The board asks how much cyber risk the organization is willing to accept; what should inform the answer?

• A.The CISO’s personal comfort level with cyber threats and controls
• B.The organization’s approved risk appetite and tolerance defined through governance
• C.The vendor’s recommended security settings and configurations for the organization
• D.The average vulnerability count reported across comparable organizations in the sector

Why: Enterprise risk appetite and tolerance are set by governance bodies to align risk acceptance with strategic objectives and regulatory requirements. Management uses these approved parameters, not personal opinions, vendor suggestions, or industry averages, to answer board inquiries about acceptable cyber risk. Risk appetite and tolerance are governance decisions that establish the level of risk the enterprise is prepared to accept.

A business unit routinely bypasses security review to meet sales deadlines, and its leaders reward this behavior. What is MOST likely to improve the security culture?

• A.Issue another policy without leadership involvement or support
• B.Have leaders reinforce expected behaviours and hold owners accountable
• C.Increase annual attestations only for the business unit
• D.Transfer all security-related decisions to the security function

Why: Security culture is shaped by leadership actions, incentives, and accountability. Changing policies or processes without addressing leadership behavior typically yields limited impact. Effective cultural change requires leaders to model and enforce security‑aligned behaviours. Leadership sets the tone; by reinforcing desired behaviours and holding owners accountable, the organization aligns incentives with security objectives.

An acquisition introduces differing security architectures, policies, and risk tolerances. What should the CISO do first?

• A.Assess the business, technology, regulatory and risk differences before integration.
• B.Standardize all security products and controls across both companies immediately.
• C.Suspend the integration effort until senior management approves a new security roadmap.
• D.Adopt the acquired entity’s security policies unchanged and apply them organization‑wide.

Why: Before merging security environments, the CISO must evaluate the distinct business objectives, technological stacks, regulatory obligations, and risk appetites of both entities. This assessment identifies gaps, overlaps, and compliance issues, enabling a tailored integration strategy that balances security effectiveness with business goals. Skipping this step can lead to misaligned controls, increased risk, and regulatory non‑compliance. A fact‑based assessment of business, technology, regulatory and risk differences provides the necessary context to develop a safe, compliant integration plan.

The board receives hundreds of technical alerts but cannot tell whether enterprise risk is changing. What should the CISO change?

• A.Provide raw technical alerts to the board without contextualizing them for business impact
• B.Translate the alerts into business‑relevant risk trends, exceptions, and decisions
• C.Stop reporting security alerts until perfect metrics are available and validated
• D.Report only blocked attacks, ignoring other indicators that could affect the risk profile

Why: Effective governance reporting must translate security metrics into business‑relevant risk information that executives can use for decisions. Providing raw alerts or overly narrow data fails to give the board a clear view of the organization’s risk posture. The CISO should therefore present synthesized risk trends, exceptions, and actionable decisions aligned with enterprise objectives. It converts technical data into information that supports board oversight and risk‑based decision making.