PrepFree CISM practice test
20 original questions written by our editors against the official ISACA exam domains. They are not real exam questions. Pick an answer to see why it is right or wrong.
-
Question 1 of 20Information Security Governance
A newly hired information security manager finds that past security projects stalled because business units ignored them. Which factor matters most for the new security program to succeed?
Show answer
Answer: A. Without senior management backing, security work lacks authority, funding and business buy-in, which is why earlier projects stalled. Tools, staff and longer policies all depend on that support to be effective.
-
Question 2 of 20Information Security Governance
A new CISO is asked to produce an information security strategy within three months. What should come first?
Show answer
Answer: C. A strategy exists to support business goals, so the CISO must first know those goals and the gap between current and desired security. Tools, tests and policy rewrites are tactics that should follow from the strategy, not drive it.
-
Question 3 of 20Information Security Governance
A company document says: 'All administrator passwords must be at least 16 characters and stored in the approved password vault.' Which type of governance document is this most likely to be?
Show answer
Answer: C. A standard sets specific, mandatory requirements that support a policy, such as a minimum length and an approved tool. A policy states high-level intent, a guideline is optional advice, and a procedure gives step-by-step instructions.
-
Question 4 of 20Information Security Governance
The board asks the information security manager for a quarterly security report. Which content will be most useful to the board?
Show answer
Answer: B. Boards govern risk to the business, so they need metrics that link security to business objectives and risk trends. Firewall changes, raw vulnerability lists and ticket counts are operational data that do not tell directors whether risk is within appetite.
-
Question 5 of 20Information Security Risk Management
Who should set the organization's risk appetite?
Show answer
Answer: D. Risk appetite is a business decision about how much risk the organization will take to reach its goals, so it belongs with senior management and the board. The security manager advises on risk, and auditors and operations teams do not own that decision.
-
Question 6 of 20Information Security Risk Management
A business unit wants to launch a new customer app quickly. The security assessment shows residual risk above the agreed risk appetite, and the unit's director wants to go ahead anyway. What should the information security manager do?
Show answer
Answer: B. The security manager's role is to make sure the risk is understood and decided by someone with authority, through the agreed process. Security does not own the business decision, approving it alone exceeds the manager's authority, and hidden fixes undermine governance.
-
Question 7 of 20Information Security Risk Management
A risk register lists 60 security risks and the team can address only a few this year. What should be the main basis for deciding which to treat first?
Show answer
Answer: D. Risks should be prioritised by their likely effect on the business relative to appetite, so the biggest exposures are handled first. Date order, cost alone or audit mentions can leave the most serious risks untreated.
-
Question 8 of 20Information Security Risk Management
A department plans to use a new software-as-a-service vendor to process customer personal data. At what point should information security risk be assessed?
Show answer
Answer: B. Assessing the vendor before signing lets the organization choose a suitable vendor and write security requirements and audit rights into the contract. After go-live or at renewal the leverage is gone, and waiting for a breach is far too late.
-
Question 9 of 20Information Security Program
Which measure best shows that a security awareness program is changing staff behaviour?
Show answer
Answer: C. Simulation results measure what people actually do when faced with a realistic threat, so trends show behaviour change. Completion counts, posters and spend measure activity, not outcomes.
-
Question 10 of 20Information Security Program
The information security manager wants funding for a privileged access management tool. Which argument is most likely to win approval from executives?
Show answer
Answer: A. Executives fund investments that clearly reduce business risk at a justified cost. Analyst ratings, competitor behaviour and team convenience do not show value to this organization.
-
Question 11 of 20Information Security Program
Development teams create new cloud resources many times a day, and security reviews cannot keep up. What is the best way to keep security consistent?
Show answer
Answer: D. Automated baselines in the pipeline apply the same controls to every deployment without slowing the business. Manual sign-off cannot scale, a ban blocks the business, and an annual review leaves misconfigurations in place for months.
-
Question 12 of 20Information Security Program
An application team says it cannot meet the encryption standard for six months because of a legacy component. What is the best response from the security program?
Show answer
Answer: D. A formal exception keeps the risk visible, limited in time and owned by someone with authority. Shutting the application down is disproportionate, informal approval hides the risk, and weakening the standard for one system lowers protection everywhere.
-
Question 13 of 20Information Security Program
The security program has budget for only two of six proposed initiatives next year. How should the information security manager choose?
Show answer
Answer: D. Limited resources should go where they reduce the most business risk, and the risk assessment provides that evidence. Novelty, equal splits or team interest do not tie spending to risk and may leave major gaps.
-
Question 14 of 20Information Security Program
A data owner has decided who may access a payroll database. Who is usually responsible for putting the access controls in place and maintaining them day to day?
Show answer
Answer: C. The custodian implements and runs the controls the owner has decided on. The owner keeps accountability for the decisions, auditors stay independent, and users must follow the controls rather than run them.
-
Question 15 of 20Incident Management
What is the main purpose of an incident response plan?
Show answer
Answer: A. An incident response plan gives a prepared, coordinated way to detect, contain and recover from incidents so damage is limited. It complements, not replaces, business continuity planning, and its value is operational, not about blame or audit.
-
Question 16 of 20Incident Management
The security operations team confirms that ransomware is encrypting files on several file servers. According to a typical incident response plan, what should happen first?
Show answer
Answer: C. Containment stops the spread and limits damage while evidence is kept for investigation. Paying a ransom is a business decision with no guarantee, rebuilding everything at once destroys evidence and may be unnecessary, and public statements come later through the communication plan.
-
Question 17 of 20Incident Management
Which activity determines how quickly each business process must be restored after a disruption?
Show answer
Answer: D. A business impact analysis identifies critical processes and how long the business can tolerate their loss, which sets recovery time objectives. Testing, scanning and training support security but do not set recovery priorities.
-
Question 18 of 20Incident Management
After a serious incident has been resolved, what is the main goal of the post-incident review?
Show answer
Answer: C. The review looks at what happened and how the response went, so controls and the plan can be improved. A blame focus discourages honest reporting, and cost figures are only one input.
-
Question 19 of 20Incident Management
An employee is suspected of stealing customer data and legal action is likely. What should the incident team make sure of before IT cleans up the employee's laptop?
Show answer
Answer: B. Evidence that may be used in court must be collected forensically with a documented chain of custody, before anything changes the device. Reimaging destroys evidence, and involving the suspect or untrained staff can taint it.
-
Question 20 of 20Incident Management
During a major incident, the security team spent three hours arguing about whether to inform executives and the legal team. What would most likely have prevented this delay?
Show answer
Answer: B. Agreed severity levels with clear escalation triggers tell the team who to involve and when, so time is not lost debating. More staff or bandwidth do not fix unclear decision rules, and limiting who may speak does not define when to escalate.
| Exam domain | Correct |
|---|