Questions & answers (free, no sign-in needed)
- View
10 beginner questions on the CISM domains: aligning security strategy with the mission and leadership accountability (governance), residual risk and risk responses (risk management), asset classification and awareness training (program), and containment, business impact analysis, recovery plans and lessons learned (incident management).
Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.
A newly hired security manager is asked to draft the organization's information security strategy. What should the strategy be built around first?
- A. The newest security products available on the market
- B. The organization's mission and business objectives ✔ correct
- C. The personal preferences of the IT operations team
- D. The set of controls used by the largest competitor
Answer: B. Governance starts from the organizational context: NIST CSF 2.0 (GV.OC-01) says the organizational mission is understood and informs cybersecurity risk management. Products, team preferences or a competitor's controls do not define what the business needs.
Source: nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf · Domain: Information Security Governance
Who is ultimately accountable for cybersecurity risk in an organization?
- A. The service desk supervisor
- B. The external auditor who reviews the controls
- C. Organizational leadership, such as the board and executives ✔ correct
- D. The network administrator who manages the firewalls
Answer: C. NIST CSF 2.0 (GV.RR-01) states that organizational leadership is responsible and accountable for cybersecurity risk. Staff and auditors carry out or review the work, but accountability stays with senior leadership.
Source: nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf · Domain: Information Security Governance
What is residual risk?
- A. The risk that remains after security controls have been applied ✔ correct
- B. The risk that exists before any controls are considered
- C. The risk that has been fully transferred to an insurance company
- D. The risk that falls outside the scope of the risk assessment
Answer: A. Residual risk is the portion of risk remaining after security measures have been applied. Management compares it with the risk appetite to decide whether more treatment is needed. Risk before controls is inherent risk.
Source: csrc.nist.gov/glossary/term/residual_risk · Domain: Information Security Risk Management
Which two are recognized risk response options? (Select TWO)
- A. Transferring or sharing the risk, for example through cyber insurance ✔ correct
- B. Avoiding the risk by stopping the activity that causes it ✔ correct
- C. Removing the risk from the risk register before an audit
- D. Lowering the risk rating so the risk needs no owner
- E. Waiting for an incident before choosing any response
Answer: A, B. Risk responses are accepting, avoiding, mitigating, sharing or transferring risk. Hiding a risk, changing its rating without treatment or waiting for an incident are not responses; they leave the risk unmanaged.
Source: csrc.nist.gov/glossary/term/risk_response · Domain: Information Security Risk Management
A company wants to spend its security budget where it matters most and apply stronger controls to its most sensitive information. Which activity should support this decision?
- A. Buying the same control for every system
- B. Encrypting only the systems that run in the cloud
- C. Running a penetration test once a year
- D. Identifying and classifying information assets ✔ correct
Answer: D. Asset identification and classification let the program prioritize protection. NIST CSF 2.0 (ID.AM-05) says assets are prioritized based on classification, criticality, resources and impact on the mission. Uniform controls waste budget on low-value assets.
Source: nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf · Domain: Information Security Program
Many employees at a company click links in suspicious emails. Which program activity addresses this most directly?
- A. Upgrading the office internet connection to a faster plan
- B. Security awareness training with phishing exercises ✔ correct
- C. Extending the password expiry period to one year
- D. Adding more storage to the mail server
Answer: B. Awareness and training build the right behavior, and phishing exercises let the organization measure and improve how users react to social engineering emails, as described in NIST SP 800-50r1.
Source: csrc.nist.gov/pubs/sp/800/50/r1/final · Domain: Information Security Program
A business impact analysis (BIA) examines business functions and the effect that a disruption might have on them.
- A. True ✔ correct
- B. False
Answer: A. True. A BIA analyzes operational functions and the impact of their disruption. Its results set recovery priorities and objectives that feed the incident response, business continuity and disaster recovery plans.
Source: csrc.nist.gov/glossary/term/business_impact_analysis · Domain: Incident Management
An analyst confirms that malware on one workstation is trying to spread to other hosts. What should the incident response team do next?
- A. Isolate the infected workstation from the network to contain the spread ✔ correct
- B. Wait for the next scheduled antivirus scan to finish overnight
- C. Hold the lessons-learned meeting before taking any other action
- D. Reimage the workstation at once without preserving any evidence
Answer: A. Containment prevents an incident from spreading and causing more damage, so isolating the host comes first. Lessons learned come after recovery, and wiping the host without preserving evidence can hinder the investigation.
Source: csrc.nist.gov/pubs/sp/800/61/r3/final · Domain: Incident Management
How does a disaster recovery plan (DRP) differ from a business continuity plan (BCP)?
- A. A DRP covers only fire, while a BCP covers every other type of event
- B. A DRP is written by auditors, while a BCP is written by the IT team
- C. A DRP restores IT systems after a major disruption, while a BCP sustains business processes ✔ correct
- D. A DRP is needed only for cloud services, while a BCP is for on-premises systems
Answer: C. NIST SP 800-34 describes the DRP as an information-system-focused plan to restore systems, often at an alternate site, after a major disruption, and the BCP as sustaining the organization's mission and business processes during and after a disruption.
Source: csrc.nist.gov/pubs/sp/800/34/r1/upd1/final · Domain: Incident Management
What is the main purpose of a post-incident review?
- A. To decide which employee should be disciplined for the incident
- B. To close the ticket as quickly as possible
- C. To delete logs that are no longer needed
- D. To identify improvements to plans, controls and processes ✔ correct
Answer: D. A post-incident review captures lessons learned so the organization can improve its incident response plans, controls and processes and reduce future incidents. A blame-focused review discourages honest reporting.
Source: csrc.nist.gov/pubs/sp/800/61/r3/final · Domain: Incident Management
Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public ISACA exam objectives (CISM Exam Content Outline 2026, exam from 2026-11-03 (ISACA press release 2026-09-10; replaces the 2022 outline 17/20/33/30)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by ISACA; exam names are trademarks of their owners. Official exam page: www.isaca.org/credentialing/cism/cism-exam-content-outline.