CISM Certification Practice Test

1. What is the primary focus of the CISM certification?

Technical network security implementation

Information security governance and management

Software development security practices

Physical security control design

2. Which framework is most commonly referenced for information security governance?

ITIL

COBIT

PRINCE2

Six Sigma

Submit

5. Which of the following is a key component of an effective security program?

Absence of any security incidents

Regular risk assessments and mitigation

Maximum spending on technology

Minimal employee training

6. True or False: Information security governance requires involvement from executive leadership.

True

False

Submit

8. Which phase of incident management involves stopping an ongoing attack?

Detection and analysis

Containment

Eradication

Recovery

9. True or False: A security incident response plan should be updated only after a major breach.

True

False

Submit

11. Which of the following best describes defense-in-depth?

A single robust firewall protecting all systems

Multiple layered security controls throughout an organization

Reliance on encryption alone

Physical security barriers only

Submit

13. True or False: Security awareness training should be mandatory for all employees.

True

False

14. Which control type is designed to prevent a security incident from occurring?

Detective control

Preventive control

Corrective control

Compensating control

Submit

CISM Certification Practice Test

1. What is the primary focus of the CISM certification?

2.

What first name or nickname would you like us to use?

2. Which framework is most commonly referenced for information security governance?

3. An information security manager must align security objectives with ____.

4. Risk appetite refers to the amount of risk an organization is willing to ____.

5. Which of the following is a key component of an effective security program?

6. True or False: Information security governance requires involvement from executive leadership.

7. The process of identifying, analyzing, and prioritizing risks is called risk ____.

8. Which phase of incident management involves stopping an ongoing attack?

9. True or False: A security incident response plan should be updated only after a major breach.

10. Information security metrics should be aligned with ____.

11. Which of the following best describes defense-in-depth?

12. The confidentiality, integrity, and availability triad is known as the CIA ____.

13. True or False: Security awareness training should be mandatory for all employees.

14. Which control type is designed to prevent a security incident from occurring?

15. Business continuity planning ensures an organization can maintain ____ operations during disruptions.