Is the CISM practice exam free?

Yes. ExamCademy offers all 1245 CISM practice questions for free with a registered account. No payment needed. Optional supporter features add AI explanations and spaced repetition study tools.

How accurate are the CISM practice questions?

All CISM questions are community-created and reviewed by moderators to align with Isaca's published exam objectives. The community continuously reports and fixes issues to keep content accurate and up to date.

How should I study for the CISM exam?

Start by browsing practice questions to identify weak areas. Use spaced repetition (Learn Mode) to focus study time on topics you struggle with. Combine practice questions with official Isaca documentation and hands-on experience for best results.

CISM Practice Exam — Free 1245+ Questions

1245Practice Questions

3Study Modes

FreeTo Get Started

Topic:Sort:

Question 1

Information Security Governance

Question 2

Incident Management

Question 3

Information Security Governance

Question 4

Incident Management

Question 5

Incident Management

Question 6

Information Security Program

Question 7

Information Security Risk Management

Question 8

Information Security Program

Question 9

Information Security Risk Management

Question 10

Information Security Risk Management

Question 11

Information Security Governance

Question 12

Incident Management

Question 13

Information Security Governance

Question 14

Information Security Program

Question 15

Information Security Governance

Question 16

Information Security Risk Management

Question 17

Information Security Risk Management

Question 18

Information Security Risk Management

Question 19

Information Security Risk Management

Question 20

Information Security Risk Management

Question 21

Information Security Risk Management

Question 22

Information Security Governance

Question 23

Incident Management

Question 24

Information Security Program

Question 25

Information Security Program

Page 1 of 50 • Questions 1-25 of 1245

1 2 3 4 5

→

Know a question that should be here? Contribute to this exam

Which of the following BEST indicates that information security governance and corporate governance are integrated?

A The information security team is aware of business goals.
B A cost-benefit analysis is conducted on all information security initiatives.
C The board is regularly informed of information security key performance indicators (KPIs).
D The information security steering committee is composed of business leaders.

Which of the following is ESSENTIAL to ensuring effective incident response?

A Business continuity plan (BCP)
B Cost-benefit analysis
C Classification scheme
D Senior management support

Which of the following is the BEST method for managing information security compliance of third-party suppliers?

A Develop specific information security policies for third parties.
B Conduct a vulnerability assessment of the third-party supplier.
C Include third-party supplier details in the risk register.
D Ensure information security requirements are addressed in the contract.

A forensic examination of a PC is required, but the PC has been switched off. Which of the following should be done FIRST?

A Perform a backup of the computer using the network.
B Perform a bit-by-bit backup of the hard disk using a write-blocking device.
C Reboot the system using third-party forensic software in the CD-ROM drive.
D Perform a backup of the hard drive using backup utilities.

Which of the following is the FIRST step when conducting a post-incident review?

A Identify mitigating controls.
B Assess the costs of the incident.
C Perform root cause analysis.
D Assign responsibility for corrective actions.

Which of the following is the MOST important reason to consider organizational culture when developing an information security program?

A It helps expedite approval for the information security budget.
B It helps the organization meet compliance requirements.
C Everyone in the organization is responsible for information security.
D Security incidents have an adverse impact on the entire organization.

Following a significant change to the underlying code of an application, it is MOST important for the information security manager to:

A inform senior management.
B update the risk assessment.
C validate the user acceptance testing (UAT).
D modify key risk indicators (KRIs).

Which of the following should be an information security managers PRIMARY focus during the development of a critical system storing highly confidential data?

A Ensuring the amount of residual risk is acceptable
B Reducing the number of vulnerabilities detected
C Avoiding identified system threats
D Complying with regulatory requirements

Management of a financial institution accepted an operational risk that consequently led to the temporary deactivation of a critical monitoring process. Which of the following should be the information security manager's GREATEST concern with this situation?

A Deviation from risk management best practices
B Impact on the risk culture
C Inability to determine short-term impact
D Impact on compliance risk

Which of the following should an information security manager do FIRST after discovering that a business unit has implemented a newly purchased application and bypassed the change management process?

A Update the change management process.
B Revise the procurement process.
C Discuss the issue with senior leadership.
D Remove the application from production.

Which of the following should be established FIRST when implementing an Information security governance framework?

A Security incident management learn
B Security policies
C Security architecture
D Security awareness training program

Which of the following is MOST important to maintain integration among the incident response plan, business continuity plan (BCP), and disaster recovery plan (DRP)?

A Asset classification
B Recovery time objectives (RTOs)
C Chain of custody
D Escalation procedures

Which of the following BEST indicates effective information security governance?

A Availability of information security policies
B Regular steering committee meetings
C Organization-wide attendance at annual security training
D Regular testing of the security incident response plan

Which of the following BEST enables an organization to measure the total time that operations can be sustained at an alternative site designated in the business continuity plan (BCP)?

A Recovery point objective (RPO)
B Allowable interruption window (AIW)
C Maximum tolerable outage (MTO)
D Recovery time objective (RTO)

Which of the following has the GREATEST influence on the successful integration of information security within the business?

A Organizational structure and culture
B Risk tolerance and organizational objectives
C Information security personnel
D The desired state of the organization

Which of the following BEST mitigates the risk or information loss caused by a cloud service provider becoming insolvent?

A Contractual provisions for the right to audit
B Effective data loss prevention (DLP) controls
C Contractual provisions for data repatriation
D The purchasing of cybersecurity insurance

Which of the following is the BEST way to protect against unauthorized access to an encrypted file sent via email?

A Validating the recipient's identity
B Using a digital signature in the email
C Utilizing a separate distribution channel for the password
D Ensuring a policy exists for encrypting files in transit

A business impact analysis (BIA) should be periodically executed PRIMARILY to:

A verify the effectiveness of controls.
B check compliance with regulations.
C validate vulnerabilities on environmental changes.
D analyze the importance of assets.

Which of the following would BEST justify spending for a compensating control?

A Root cause analysis
B Emerging risk trends
C Vulnerability assessment
D Risk analysis

Which of the following is the MOST important consideration for reporting risk assessment results to senior management?

A The reports should include comparisons to industry benchmarks.
B The reports should be presented in business terms.
C The reports should use formal methodologies.
D The reports should include recommended controls.

An information security manager has completed a risk assessment and has determined the residual risk. Which of the following should be the NEXT step?

A Implement countermeasures to mitigate risk.
B Classify all identified risks.
C Conduct an evaluation of controls.
D Determine if the risk is within the risk appetite.

Which of the following BEST enables an organization to maintain an appropriate security control environment?

A Periodic employee security training
B Budgetary support for security
C Alignment to an industry security framework
D Monitoring of the threat landscape

Which of the following is MOST important for responding effectively to security breaches?

A Chain of custody
B Incident classification
C Log monitoring
D Communication plan

Senior management has expressed concern that the organization's intrusion prevention system (IPS) may repeatedly disrupt business operations. Which of the following BEST indicates that the information security manager has tuned the system to address this concern?

A Decreasing false positives
B Decreasing false negatives
C Increasing false negatives
D Increasing false positives

Which of the following is MOST important for an information security manager to consider when developing a business continuity plan (BCP) for ransomware attacks?

A Backups are maintained on multiple sites and regularly reviewed.
B Impacted networks can be detached at the network switch level.
C Backups are maintained offline and regularly tested.
D Production data is continuously replicated between primary and secondary sites.

CISMPreview

About the CISM Exam

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

CISMPreview

About the CISM Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25