ISACA CISM Practice Exam

What the ISACA CISM exam covers

• Information Security Governance187 questions
• Information Security Risk Management191 questions
• Information Security Program323 questions
• Incident Management282 questions

Free ISACA CISM practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 983.

1. Question 1Information Security Governance

   What is the primary purpose of an information security governance program?

   • ATo align the security strategy with business objectives and ensure executive accountability/oversightCorrect
   • BTo centralize all firewall configuration under a single administrator for faster changes
   • CTo let the IT department set security priorities independently of business leadership
   • DTo maximize the number of security tools deployed across the environment
   ✓ Correct answer: A

   Information security governance is a subset of enterprise governance that provides strategic direction, ensures objectives are achieved, manages risk appropriately, and verifies that organizational resources are used responsibly. Its primary purpose is to align the security program with the overall mission and objectives of the business so that security investments protect what matters most and enable-rather than impede-business operations. Governance structures such as policies, oversight committees, and defined accountabilities give leadership the mechanisms to steer and verify the security program. Without this alignment, security operates as a technical silo disconnected from business priorities.

   Why the other options are wrong

   • BGovernance is about strategic direction and accountability, not the operational task of centralizing firewall administration.
   • CGovernance requires business leadership involvement, so leaving priorities to IT alone contradicts its core purpose.
   • DThe goal is risk-appropriate protection aligned to the business, not the raw count of tools deployed.
2. Question 2Information Security Program

   During a program review, the security manager finds that several key controls have no assigned owner. What should the manager do FIRST to address this?

   • AAssign each control an accountable owner in the relevant business functionCorrect
   • BPurchase an automated tool to run and monitor the controls on their behalf
   • CTake personal ownership of every control to close the gap immediately
   • DRemove the unowned controls from the framework until owners volunteer
   ✓ Correct answer: A

   Control ownership is a foundational governance requirement; a control with no owner will drift, degrade, and fail without anyone being answerable. The correct first step is to assign each control an accountable owner within the business function best placed to operate it, which restores accountability and ensures the control is maintained and reported on. Buying tooling does not create accountability, the security manager personally owning everything is neither scalable nor appropriate, and removing controls simply because no one has been assigned to them increases risk rather than managing it.

   Why the other options are wrong

   • BA tool can support a control but cannot be accountable for it; ownership must rest with a person or role.
   • CThe security manager owning every control centralizes accountability inappropriately and is not sustainable across the program.
   • DRemoving needed controls to resolve an ownership gap raises risk instead of assigning the accountability that is missing.
3. Question 3Incident Management

   What is the value of distributed tracing telemetry when investigating a security incident in a microservices environment?

   • DIt reconstructs the path of a request across services, helping locate where anomalous or malicious activity occurredCorrect
   • AIt aggregates numeric time-series metrics into dashboards showing overall service throughput, but cannot show the path an individual request took through dependent services
   • BIt stores full-text application logs from each service for keyword searching
   • CIt enforces mutual TLS between services so requests cannot be intercepted
   ✓ Correct answer: D

   In microservices architectures, a single user-facing transaction may invoke dozens of individual services, each of which may be owned by different teams and run on different infrastructure. Distributed tracing instruments each service to emit a trace record when it handles a request, and these records share a common trace identifier that allows investigators to reconstruct the complete call path. During a security incident, this enables analysts to see exactly which services processed a suspicious request, what data was accessed at each hop, and where in the chain anomalous behavior first appeared.

   Why the other options are wrong

   • AMetrics dashboards summarize aggregate throughput and health, but they do not reconstruct the path of an individual request across services the way distributed tracing does.
   • BCentralized log storage supports keyword search per service, yet without correlated trace IDs it cannot follow a single request end to end across many hops.
   • CMutual TLS is a transport security control that protects requests in transit; it does not provide the cross-service request timeline that tracing gives an investigator.
4. Question 4Incident Management

   Which classification step prioritizes incident response effort effectively?

   • AHandling incidents in the order tickets were typed
   • BTriaging incidents by severity and business impactCorrect
   • CIgnoring impact and treating all incidents identically
   • DAlways addressing the smallest incident first
   ✓ Correct answer: B

   Incident response resources including analyst time, technical tools, and management attention are finite. Triaging incidents by severity and business impact ensures that the most damaging and urgent situations receive immediate, intensive attention while lower-priority incidents are queued for appropriate but less urgent handling. Severity ratings typically incorporate factors such as the number of systems affected, the classification of data involved, whether the incident is ongoing, and the business function being disrupted, enabling consistent prioritization decisions that do not depend on individual analyst judgment.

   Why the other options are wrong

   • AHandling incidents in the order tickets were typed is incorrect because first-in-first-out processing ignores severity entirely; a low-severity help desk miscategorization filed before a major ransomware alert would be handled first under this approach, potentially allowing catastrophic damage while lower-impact work proceeds.
   • CIgnoring impact and treating all incidents identically is incorrect because uniform treatment regardless of severity is operationally wasteful and dangerous; applying the same response resources to a minor policy violation and an active nation-state intrusion is not proportionate and would either over-resource minor events or under-resource major ones.
   • DAlways addressing the smallest incident first is incorrect because handling the easiest or smallest incidents first would systematically deprioritize major events in favor of quickly closing simple tickets, allowing serious incidents to linger unaddressed.
5. Question 5Incident Management

   A CISM candidate is reviewing an organization's IR plan and notices that the plan defines containment actions but does not specify who has the authority to approve them. What is the MOST significant risk this creates?

   • AAnalysts may use the wrong containment tools.
   • BContainment actions may be delayed or inconsistently applied due to unclear decision authority.Correct
   • CThe organization may fail its next ISO 27001 audit.
   • DIncident responders may escalate incidents to law enforcement without reason.
   ✓ Correct answer: B

   Time-critical containment decisions require pre-authorized decision-makers. Without defined authority, responders may hesitate for approval, take unilateral actions of varying scope, or escalate through multiple management layers under time pressure - all of which delay containment and allow the incident to spread. Authority matrices are a foundational element of effective IR plan governance.

   Why the other options are wrong

   • ATool selection is a technical competency issue; the authority question is about governance and decision rights, which is the more significant risk.
   • CAudit findings are a compliance consequence, not the primary operational risk of undefined authority during an active incident.
   • DEscalation to law enforcement follows separate notification criteria; the undefined authority issue primarily affects internal containment decisions.
6. Question 6Information Security Governance

   During a board meeting, a director asks how the organization knows its security spending is proportionate to the risks it faces. Which governance concept MOST directly answers this question?

   • ARisk appetite and risk tolerance thresholds compared against residual riskCorrect
   • BThe number of security incidents closed last quarter
   • CThe percentage of staff who completed phishing training
   • DThe total count of firewalls deployed across the network
   ✓ Correct answer: A

   Governance frames investment decisions around risk appetite. By measuring residual risk against the board-approved appetite and tolerance, the organization can demonstrate whether current spending brings risk within acceptable bounds or whether more or less investment is warranted.

   Why the other options are wrong

   • BIncident closure counts are operational metrics and do not show whether spending is proportionate to risk.
   • CTraining completion is an awareness indicator, not a measure of spend-versus-risk proportionality.
   • DA device count measures activity, not whether investment matches the organization's risk posture.
7. Question 7Information Security ProgramSelect all that apply

   An information security manager is selecting key performance indicators (KPIs) to report to executive leadership. Which TWO indicators BEST demonstrate that the program is reducing risk in business terms? (Choose TWO)

   • AReduction in mean time to detect and respond to incidents over successive quartersCorrect
   • BTotal number of log events collected by the SIEM per day
   • CPercentage of critical and high vulnerabilities remediated within policy timeframes (SLA)Correct
   • DNumber of security tools licensed across the enterprise, regardless of how many are actively deployed and configured.
   ✓ Correct answer: A, C

   Mean time to detect/respond reflects how quickly the organization limits incident impact, while remediation within SLA shows that known weaknesses are closed before exploitation. Both are outcome-oriented and translate to reduced likelihood and impact of loss, which resonates with leadership. They trend over time to demonstrate program effectiveness.

   Why the other options are wrong

   • BRaw log volume measures activity, not risk reduction, and can grow without improving security.
   • DTool counts, regardless of active deployment, measure spending and complexity, not protective outcomes.
8. Question 8Information Security Governance

   An information security manager wants to ensure no single role both defines security requirements and independently certifies compliance with them. This governance principle is BEST described as what?

   • ASegregation of duties to prevent conflicts of interest in oversightCorrect
   • BDefense in depth across multiple control layers
   • CLeast privilege limiting access to the minimum needed
   • DJob rotation to broaden staff experience
   ✓ Correct answer: A

   A manager applies segregation of duties not only to transactions but to oversight: those who define and operate controls should not be the ones who independently attest that the controls work. This separation preserves objective assurance and prevents self-review conflicts. Audit independence is a governance-level expression of this principle.

   Why the other options are wrong

   • BDefense in depth concerns layered technical controls, not separation of oversight roles.
   • CLeast privilege limits access rights; it does not address who certifies compliance.
   • DJob rotation is a detective personnel control and is not about separating definition from assurance.
9. Question 9Information Security Program

   An information security manager is governing the vulnerability management process. What should PRIMARILY determine the order in which identified vulnerabilities are remediated?

   • AThe risk each vulnerability poses to the business, considering likelihood and impact in contextCorrect
   • BThe chronological order in which the vulnerabilities were discovered
   • CThe raw vendor severity score without regard to the affected asset
   • DThe ease with which the security team can apply each available patch, regardless of how severe the underlying vulnerability actually is
   ✓ Correct answer: A

   Governing vulnerability management means allocating limited remediation effort where it reduces the most risk. Risk-based prioritization weighs exploitability, exposure, asset criticality, and compensating controls. Scores and ease of patching are inputs, but a high vendor score on an isolated, low-value asset may rank below a moderate one on a critical, exposed system.

   Why the other options are wrong

   • BDiscovery order ignores risk and wastes effort on low-impact items.
   • CA raw severity score divorced from asset context can badly misrank real exposure.
   • DPatching ease optimizes convenience, not risk reduction.
10. Question 10Incident ManagementSelect all that apply

    During a major incident, the incident manager is coordinating with external parties. Which TWO are appropriate reasons to engage law enforcement during incident response? (Choose two.)

    • AA legal or regulatory obligation requires reporting the criminal activity to authoritiesCorrect
    • BThe organization seeks assistance pursuing or attributing a serious criminal attack beyond its own capabilityCorrect
    • CThe team wants to transfer responsibility for internal documentation and evidence handling to the police so no one internally has to maintain it
    • DThe organization hopes law enforcement will manage its customer notifications
    ✓ Correct answer: A, B

    Mandatory reporting duties and the need for investigative authority or attribution against a serious adversary are legitimate reasons for engagement. The manager weighs these against the loss of control involved, but they are valid grounds, unlike offloading the organization's own responsibilities.

    Why the other options are wrong

    • CInternal documentation remains the organization's responsibility and cannot be transferred to police.
    • DCustomer breach notifications are the organization's legal duty, not law enforcement's role.

Who this ISACA CISM practice exam is for

This practice set is for anyone preparing for the ISACA CISM exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this ISACA CISM practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real ISACA CISM exam.

Related Security resources

• ISACA CISM study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• ISACA CRISC (Certified in Risk and Information Systems Control) practice examRelated
• (ISC)² CCSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated

ISACA CISM practice exam FAQ