ISACA CISM Practice Exam

What the ISACA CISM exam covers

• Information Security Governance217 questions
• Information Security Risk Management186 questions
• Information Security Program276 questions
• Incident Management231 questions

Free ISACA CISM sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 910.

1. Question 1Information Security Governance

   What is the primary purpose of an information security governance program?

   • ATo align the security strategy with business objectives and ensure executive accountability/oversightCorrect
   • BTo centralize all firewall configuration under a single administrator for faster changes
   • CTo let the IT department set security priorities independently of business leadership
   • DTo maximize the number of security tools deployed across the environment
   ✓ Correct answer: A

   Information security governance is a subset of enterprise governance that provides strategic direction, ensures objectives are achieved, manages risk appropriately, and verifies that organizational resources are used responsibly. Its primary purpose is to align the security program with the overall mission and objectives of the business so that security investments protect what matters most and enable-rather than impede-business operations. Governance structures such as policies, oversight committees, and defined accountabilities give leadership the mechanisms to steer and verify the security program. Without this alignment, security operates as a technical silo disconnected from business priorities.

   Why the other options are wrong

   • BGovernance is about strategic direction and accountability, not the operational task of centralizing firewall administration.
   • CGovernance requires business leadership involvement, so leaving priorities to IT alone contradicts its core purpose.
   • DThe goal is risk-appropriate protection aligned to the business, not the raw count of tools deployed.
2. Question 2Information Security Program

   The board asks whether the security awareness program is actually reducing risk. Which measure BEST indicates that the program is effective?

   • AFalling click rates on simulated phishing across successive campaignsCorrect
   • BThe number of staff who completed the annual awareness training module
   • CThe total hours of awareness content published on the intranet this year
   • DThe percentage of the awareness budget spent by the end of the year
   ✓ Correct answer: A

   The goal of a security awareness program is to change behavior and reduce the likelihood of human-driven incidents, so effectiveness must be measured by behavioral outcomes rather than by delivery activity. A sustained reduction in click rates on realistic phishing simulations across successive campaigns is direct evidence that staff are recognizing and resisting a common attack. Completion counts, content volume, and budget consumption all measure the effort put into the program, not the result it produces, and can be high even while risky behavior remains unchanged.

   Why the other options are wrong

   • BCompletion counts show that training was delivered, not that behavior or susceptibility to attack actually changed.
   • CHours of content published measures output volume, which says nothing about whether staff behavior improved.
   • DBudget spent is a financial input; full spend does not demonstrate any reduction in human risk.
3. Question 3Incident Management

   What is the security purpose of synchronizing all system clocks to a common time source (e.g., NTP)?

   • ATo enable accurate correlation and ordering of log events across systems during investigationsCorrect
   • BTo provide direct protection that prevents malware from infecting synchronized hosts
   • CTo lower the operating temperature of processors on the time-synchronized servers
   • DTo raise the effective throughput of the network links between the systems
   ✓ Correct answer: A

   Digital forensic investigations and security incident analysis depend on reconstructing the precise sequence of events across multiple systems to determine what happened, in what order, and on which machines. When system clocks are unsynchronized, timestamps from different sources are inconsistent, making it impossible to reliably correlate events, establish timelines, or attribute actions to specific sessions. For example, a login event on a workstation and a file access on a server that occurred seconds apart will appear to be hours apart if their clocks differ, preventing correlation of the attacker's lateral movement path.

   Why the other options are wrong

   • BClock synchronization aids investigation and does not itself prevent malware infection.
   • CTime sync has no effect on processor temperature.
   • DSynchronizing clocks does not change network bandwidth or throughput.
4. Question 4Information Security Governance

   Which BEST describes the principle of least privilege?

   • AUsers and processes receive only the access necessary to perform their functionCorrect
   • BAll users are granted administrator rights so that day-to-day work is more convenient
   • CAccess rights are granted once and never subjected to any subsequent review
   • DPrivileges are distributed to user groups on a random basis rather than by need
   ✓ Correct answer: A

   The principle of least privilege limits the potential damage from compromised accounts, insider threats, and software vulnerabilities by ensuring that each entity in the system can only access what it specifically needs. When a user account is compromised, the attacker can only reach the resources that account could access; if that is a narrow, role-specific set, the blast radius is contained. This principle applies equally to service accounts, applications, and automated processes, which should have only the API permissions, file system access, and network connectivity required for their specific function.

   Why the other options are wrong

   • BGranting everyone administrator rights is the opposite of least privilege and greatly widens the attack surface.
   • CNever reviewing access lets excessive rights accumulate, which least privilege is designed to prevent.
   • DRandom privilege assignment ignores job need entirely and violates the need-to-know basis of least privilege.
5. Question 5Information Security ProgramSelect all that apply

   A security manager is building an exception management process for situations where business units cannot comply with a security standard. Which TWO elements are ESSENTIAL for any approved exception? (Choose TWO)

   • AA documented compensating control that mitigates the risk created by non-complianceCorrect
   • BA defined expiration date after which the exception must be re-evaluated or resolvedCorrect
   • CApproval from the security operations team lead
   • DProof that the exception has no cost implications for the business unit
   ✓ Correct answer: A, B

   An exception without a compensating control simply accepts unmitigated risk, which is irresponsible governance. A compensating control is a substitute measure that reduces exposure to an acceptable level. An expiration date ensures exceptions do not become permanent workarounds; requiring periodic re-evaluation keeps the exception register current and forces owners to either resolve the root issue or justify continued non-compliance.

   Why the other options are wrong

   • CExceptions that deviate from security standards should be approved by a risk owner or business executive with appropriate authority, not the security operations team lead, who typically lacks the authority to accept business risk on behalf of the organization.
   • DCost implications are a business consideration but are not an essential element of exception governance; an exception may be warranted even when it has cost implications.
6. Question 6Information Security GovernanceSelect all that apply

   A security manager is establishing governance reporting to the board. Which TWO outcomes should board-level security reporting PRIMARILY enable? (Choose TWO)

   • AInformed oversight of whether risk is being managed within the approved appetiteCorrect
   • BDetailed configuration troubleshooting of individual firewalls
   • CStrategic decisions on resource allocation and risk acceptanceCorrect
   • DDay-to-day assignment of analyst shift schedules
   ✓ Correct answer: A, C

   Governance reporting gives the board what it needs to direct and control: confidence that risk is being managed within appetite, and the basis for high-level decisions about funding and which risks to accept. These are board responsibilities, distinct from operational execution.

   Why the other options are wrong

   • BFirewall troubleshooting is an operational task, not a board outcome.
   • DShift scheduling is operational management, not a governance decision.
7. Question 7Information Security Program

   A security manager must reduce the attack surface of a fleet of servers efficiently. Which approach is MOST effective and scalable?

   • BApply a hardened, automated configuration baseline (e.g., golden image or policy as code) to all serversCorrect
   • ADeploy host-based intrusion detection agents on every server and review their alerts centrally
   • CSchedule recurring vulnerability scans of the fleet and remediate findings as they are reported
   • DPlace all servers behind a single load balancer to standardize how traffic reaches them
   ✓ Correct answer: B

   A standardized golden image or policy-as-code baseline enforces consistent hardening, removes unneeded services, and prevents configuration drift across the fleet. Automation makes the control repeatable and auditable at scale. It is far more reliable than ad hoc manual work.

   Why the other options are wrong

   • AHost-based intrusion detection helps detect attacks after they occur; it monitors rather than reduces the attack surface, which hardening the configuration directly addresses.
   • CRecurring scanning finds weaknesses but does not itself reduce attack surface; without an enforced hardened baseline, drift and unneeded services persist across the fleet.
   • DA single load balancer standardizes traffic distribution and availability; it does not harden the operating systems or reduce the services each server exposes.
8. Question 8Incident Management

   An incident commander needs a single authoritative record of all decisions, actions, and timestamps taken during a major incident. Which artifact serves this purpose?

   • AAn incident timeline / activity logCorrect
   • BA vulnerability scan report
   • CA network architecture diagram
   • DA service-level agreement
   ✓ Correct answer: A

   A contemporaneous, timestamped log supports coordination during the incident, evidence integrity, regulatory reporting, and the post-incident review. It captures who did what and when, which is essential for accountability and lessons learned.

   Why the other options are wrong

   • BA vulnerability scan report shows weaknesses, not the chronology of response actions.
   • CA network diagram aids understanding of topology but does not record response decisions.
   • DAn SLA defines service commitments, not the record of incident handling.
9. Question 9Information Security Risk Management

   A business unit wants to accept a risk whose potential loss exceeds the organization's documented risk appetite. The information security manager's BEST course of action is to:

   • AEscalate the acceptance decision to the appropriate level of senior management or governance body for an explicit decisionCorrect
   • BAllow the business unit to accept it, since they own the process and the risk
   • COverride the business unit and mandate additional controls to force the risk below appetite
   • DRecord the acceptance in the risk register and proceed without further action
   ✓ Correct answer: A

   Risk appetite sets the threshold below which lower-level owners may accept risk. When exposure exceeds appetite, the decision belongs to senior management or a risk governance body, not to a single business unit. The manager facilitates and informs that escalation rather than unilaterally accepting or overriding.

   Why the other options are wrong

   • BA business unit owner cannot accept risk that breaches the enterprise appetite; that authority sits higher.
   • CForcing controls unilaterally ignores governance and may not be cost-justified; the decision rights belong to management.
   • DMerely logging an out-of-appetite acceptance without escalation leaves the organization exposed beyond its stated tolerance.
10. Question 10Information Security Program

    Which factor should MOST influence how frequently the information security manager reassesses a given third-party provider?

    • AThe level of risk the provider poses to the organizationCorrect
    • BThe length of the relationship with the provider
    • CThe annual fee paid to the provider
    • DThe geographic distance to the provider's offices
    ✓ Correct answer: A

    A tiered, risk-driven approach concentrates assurance effort where the potential impact is greatest. Providers handling sensitive data or critical services warrant more frequent and deeper review than low-risk vendors, regardless of tenure or cost.

    Why the other options are wrong

    • BRelationship length does not indicate current risk and can foster complacency.
    • CFee size is not a reliable proxy for the security risk a provider introduces.
    • DGeographic distance is largely irrelevant to how often controls should be reassessed.

Related Security resources

• ISACA CISM study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA Security+ SY0-701 practice examRelated

ISACA CISM practice exam FAQ