Free CISM Practice Test 2026: Full 150-Question Mock Exams

Question 1Information Security Governance

The board of a regional insurer asks the newly hired CISO to explain the PRIMARY purpose of an information security governance program. Which answer is BEST?

Correct answer: C. To ensure security activities support business objectives and stay within the risk appetite
Governance gives security strategic direction so it supports business goals and keeps risk at an acceptable level. Meeting a standard is a useful tool, but compliance with a framework is not the purpose of governance itself.

Question 2Information Security Program

The information security manager at a regional insurer needs additional funding for the security program. Which approach is MOST likely to secure executive approval?

Correct answer: B. Link the requested funds to business risks and strategic objectives
Executives fund what clearly supports business goals and reduces risks they care about. Tying the request to those risks gives them a sound basis for the decision. Peer budget comparisons are tempting but ignore the company's own risk profile.

Question 3Information Security Program

Northwind Corp is creating its first enterprise information security architecture. Which factor should PRIMARILY shape the design?

Correct answer: D. The enterprise architecture and business strategy
Security architecture must support how the business operates and where it is heading, so it should flow from the enterprise architecture and business strategy. Existing tools matter during implementation, but designing around them lets technology dictate security instead of business needs.

Question 4Incident Management

A retail company is drafting its first incident response plan. Which objective should the information security manager emphasize MOST when presenting the plan to executives?

Correct answer: A. Limiting business impact and restoring operations within acceptable timeframes
The core purpose of incident response is to limit damage to the business and restore normal operations within acceptable limits. Logging every event supports detection, but it is a means to that end, not the objective executives are being asked to back.

Question 5Incident Management

A SIEM raises a high-severity alert at 2 a.m. showing possible lateral movement from a finance workstation. What should the incident response team do FIRST?

Correct answer: B. Validate the alert with related logs to confirm an incident
Triage comes first: the alert must be validated to confirm a real incident and its severity before acting. Disconnecting the workstation right away may disrupt business and tip off an attacker based on what could be a false positive.

Question 6Information Security Risk Management

A retail company buys cyber insurance to cover losses from a payment card data breach. Which of the following does the company still retain after buying the policy?

Correct answer: A. Accountability and reputational harm from a breach
Insurance shifts some of the financial impact, but the company stays accountable for protecting card data and still suffers the reputational damage. The other options are financial losses that this type of policy is designed to cover.

Question 7Information Security Risk Management

A newly hired information security manager is asked to lead the first enterprise-wide risk assessment at a regional retail company. What should the manager do FIRST?

Correct answer: D. Identify critical information assets and the processes they support
Risk assessment starts with knowing what matters to the business, so critical assets and the processes they support must be identified first. Vulnerability scanning is useful later, but without knowing asset value the results cannot be prioritized by business impact.

Question 8Information Security Governance

Brightline Retail is drafting its first three-year information security strategy. Which factor is MOST important to the strategy's success?

Correct answer: A. Commitment and support from senior management for the strategy
Without senior management commitment, a strategy lacks funding, authority and business buy-in, so it rarely succeeds. A framework helps structure the work, but it cannot replace executive support.

Question 9Information Security Program

After a reorganization, an information security manager suspects the team lacks the skills to support a new cloud-first business strategy. What should the manager do FIRST?

Correct answer: C. Perform a skills gap analysis against the program's requirements
A gap analysis shows which skills are actually missing and how large the gap is. That information drives sound decisions on hiring, training or outsourcing. Hiring right away may fill the wrong gap and waste budget.

Question 10Information Security Program

A security manager has found three controls that would each bring a risk within appetite. What should MOST influence the final selection?

Correct answer: A. Which control offers the best cost relative to risk reduction
When several controls meet the risk target, the best choice delivers the needed risk reduction at the lowest overall cost. Fast deployment is helpful, but a quick control that costs far more than the alternatives is not the best business decision.

Question 11Incident Management

An information security manager has finished drafting an incident response plan for a regional bank. Who should formally approve the plan?

Correct answer: D. Senior management, who own the business risk the plan addresses
Senior management owns business risk, so its approval gives the plan authority, funding and cross-department support. Internal audit must stay independent, and approving a plan it will later review would weaken that objectivity.

Question 12Incident Management

What is the PRIMARY benefit of using incident response playbooks for common incident types?

Correct answer: B. Responders can act consistently and quickly under pressure
Playbooks give predefined, repeatable steps, so responders act consistently and save decision time during an incident. They support skilled staff but do not replace them, and no playbook can guarantee containment within a fixed time.

Question 13Information Security Risk Management

A proposed data loss prevention tool would cost $250,000 per year. The annualized loss expectancy it would address is $60,000, and the current risk is within the organization's risk appetite. What should the information security manager recommend?

Correct answer: C. Accept the risk, documented and approved by the risk owner
The control costs about four times the expected loss and the risk is already within appetite, so formal acceptance by the risk owner is the sensible response. Buying the tool anyway spends far more than the risk is worth.

Question 14Information Security Governance

A security manager at a logistics company is asked to build a new information security strategy. What should the manager do FIRST?

Correct answer: B. Understand the organization's business objectives and strategic plans
A security strategy must support the business, so it starts with understanding what the business is trying to achieve. Choosing a framework comes later, and without business context it may drive the wrong priorities.

Question 15Information Security Risk Management

A threat intelligence report warns that a ransomware group is actively targeting manufacturers through a flaw in a popular remote access product. The company is a manufacturer. What should the information security manager do FIRST?

Correct answer: D. Determine whether the company uses the product and how it is exposed
Threat intelligence only has value once it is related to the organization's own environment, so the manager must first confirm whether the product is in use and exposed. Blocking indicators is tempting, but doing it blindly may miss the real exposure, and indicators change quickly.

Question 16Information Security Program

A security analyst asks the information security manager to buy a data analytics tool that was demonstrated at a conference. What is the MOST important consideration before approving the purchase?

Correct answer: B. Whether the tool addresses a defined risk or program requirement
Program resources should go to needs that the strategy and risk assessment have identified. A tool that does not address a defined requirement adds cost without reducing risk. Staff skills matter, but only after the need is established.

Question 17Information Security Program

A legacy payroll system cannot support the multifactor authentication required by the security standard. Replacement is two years away. What should the security manager do FIRST?

Correct answer: C. Identify compensating controls that address the same risk
Compensating controls reduce the risk the requirement was meant to address when the primary control is not feasible. A permanent exception leaves the risk unmanaged and ignores that the system will be replaced, so it should not come first.

Question 18Incident Management

What is the PRIMARY output of a business impact analysis that the information security manager uses for incident management planning?

Correct answer: A. Recovery priorities and time requirements for critical business processes
A BIA identifies critical processes, how disruption hurts the business over time, and the recovery priorities and timeframes that drive planning. Ranking vulnerabilities by likelihood belongs to a risk assessment, not a BIA.

Question 19Incident Management

Two incidents are reported at the same time: malware on a marketing laptop and unauthorized access to the customer billing database. How should the incident manager prioritize them?

Correct answer: D. Address the billing database incident first due to business impact
Triage ranks incidents by business impact and the criticality of the affected assets, and a breach of customer billing data carries far greater impact. Malware spread is a valid concern, but a single laptop infection is lower impact and can be contained in parallel.

Question 20Information Security Governance

Redwood Software's security manager plans a gap analysis to support a new strategy. What must be established BEFORE the gap analysis can be performed?

Correct answer: A. The desired state of security agreed with business stakeholders
A gap analysis compares the current state with a desired state, so the target must be defined and agreed first. A penetration test can help describe the current state, but it cannot show a gap without a defined goal.

Question 21Information Security Program

Midyear, the CFO cuts the information security program budget by 20%. What should the information security manager do FIRST?

Correct answer: C. Reprioritize program activities based on the risks they address
With fewer resources, the manager should keep funding the activities that address the highest business risks and tell senior management which risks will go unaddressed. An equal cut across all activities ignores that some risks matter far more than others.

Question 22Information Security Program

A business unit asks the security team to deploy a data loss prevention tool its staff saw at a conference. What should the security manager do FIRST?

Correct answer: D. Determine the risk and control objective the tool would address
Controls should be chosen to meet defined control objectives tied to business risk. A proof of concept is premature if no one has confirmed what problem the tool is meant to solve.

Question 23Incident Management

A manufacturing firm is starting a business impact analysis. Whose input is MOST important to determine how long each process can be unavailable?

Correct answer: D. Business process owners who understand the operational and financial impact
Process owners know what happens to revenue, customers and obligations when their process stops, so they set realistic downtime tolerances. IT can explain how systems support a process, but it cannot judge the business impact of losing it.

Question 24Incident Management

A help desk technician finds malware on one employee's workstation and plans to reimage it right away. What should the information security manager require FIRST?

Correct answer: B. Determine whether the malware has reached other systems
Determining the scope of the compromise comes before eradication, because reimaging one machine will not help if others are infected. Backing up user files matters to the user, but it says nothing about how far the attack has gone.

Question 25Information Security Risk Management

A marketing team wants to collect customers' fingerprints for a loyalty app. Legal review finds the regulatory exposure exceeds the organization's risk appetite, and no affordable controls would bring it within appetite. Which risk response is MOST appropriate?

Correct answer: C. Avoid the risk by not collecting the fingerprint data
When a risk exceeds appetite and cannot be reduced at acceptable cost, the best response is to not carry out the activity. Having a vendor store the data does not remove the organization's legal accountability for it.

Question 26Information Security Risk Management

Senior management asks the information security manager to present risk results in a way that allows direct comparison with the cost of proposed controls. Which approach BEST meets this request?

Correct answer: D. A quantitative analysis that expresses expected losses in money
Quantitative analysis expresses risk in monetary values, such as annualized loss expectancy, which can be compared directly with control costs. A qualitative heat map is easier to produce, but its ratings cannot be weighed against dollar amounts.

Question 27Information Security Governance

A sales manager requests read access to the customer database for a newly hired analyst. Who should approve this request?

Correct answer: C. The business data owner responsible for the customer data
The data owner decides who may access the data, because the owner is accountable for its use and protection. The database administrator is a custodian who grants access only after the owner approves it.

Question 28Information Security Program

When planning the resources needed for the information security program over the next three years, which input is MOST important?

Correct answer: B. The information security strategy aligned to business objectives
The strategy defines where the program must go to support the business, so it determines what people, tools and funds are needed. Benchmarks can help check that plans are reasonable, but they do not reflect the organization's own goals and risks.

Question 29Information Security Program

An internal review finds that a well-designed quarterly access review control has not been performed for the last two quarters. What does this finding indicate?

Correct answer: C. The control is not operating effectively despite a sound design
A control can be properly designed yet fail when it is not performed as intended, which is an operating effectiveness gap. Redesigning it would not fix the real problem, which is that the existing process is not being carried out.

Question 30Incident Management

During a BIA review, the information security manager sees that the RTO for an order-processing system is 72 hours, while the business says the maximum tolerable outage is 48 hours. What should the manager do FIRST?

Correct answer: A. Raise the gap with the process owner so the RTO is set within the MTO
An RTO must fall within the maximum tolerable outage, or the business suffers unacceptable harm before recovery finishes. A hot site may be part of the fix later, but buying one before the owner confirms requirements and options are costed is premature.

Question 31Incident Management

A database server is suspected of being compromised and is still running. Investigators may need evidence for legal action. What should be done FIRST?

Correct answer: B. Capture volatile memory and running process data
Volatile data such as memory, network connections and running processes is lost when power is removed, so it must be captured first. Shutting down the server would stop activity but destroy that evidence, and a live antivirus scan can alter the system.

Question 32Information Security Governance

Policy requires daily backups of the finance system, with restore tests each quarter. Which role is normally responsible for carrying out these tasks?

Correct answer: A. The data custodian in IT operations
Custodians handle the day-to-day protection of data, such as backups and restores, as directed by the owner. The data owner sets the requirements but does not usually perform the technical work.

Question 33Information Security Program

Only one engineer at a logistics company knows how to administer the encryption key management system. What should the information security manager do FIRST?

Correct answer: C. Document the key procedures and cross-train a backup administrator
Documentation and a trained backup remove the single point of failure at a reasonable cost. A retention bonus may delay the problem, but the risk returns if the engineer is ill, on leave or resigns anyway.

Question 34Information Security Program

Which approach provides the MOST reliable evidence that key security controls are operating effectively?

Correct answer: D. Testing performed by a party independent of the control owners
Independent testing removes the conflict of interest that exists when owners assess their own controls. A period with no reported incidents does not prove controls work, because incidents may simply have gone undetected.

Question 35Information Security Risk Management

Two controls are proposed for the same risk. Control X brings the risk within appetite at moderate cost. Control Y nearly eliminates the risk but costs three times as much. What should the information security manager recommend?

Correct answer: D. Control X, because it meets appetite at a lower cost
Controls should bring risk to an acceptable level at a reasonable cost, not push it to zero regardless of price. Control Y spends much more for risk reduction the business does not need.

Question 36Information Security Risk Management

In a risk workshop, a finance process owner rates the likelihood of fraudulent payments as low because every payment requires dual approval. What does this rating MOST likely represent?

Correct answer: A. Residual risk, because it reflects the effect of an existing control
A rating that already takes the dual-approval control into account describes the risk remaining after controls, which is residual risk. Inherent risk is the tempting choice, but it would be assessed as if no controls were in place.

Question 37Incident Management

A payments company sets an RPO of 15 minutes for its transaction database. What does this requirement MOST directly determine?

Correct answer: B. How often data must be backed up or replicated to another location
RPO is the maximum acceptable data loss measured in time, so it drives backup or replication frequency. How quickly the database must be back online is the RTO, which is a separate requirement.

Question 38Information Security Governance

Pinecrest Manufacturing is forming an information security steering committee. Which membership would make the committee MOST effective?

Correct answer: D. Senior representatives from the major business units and support functions
A steering committee aligns security with business needs, so it needs senior people from across the business who can make decisions. A purely technical group cannot set business priorities or resolve cross-functional conflicts.

Question 39Incident Management

What is the PRIMARY purpose of maintaining chain of custody for evidence collected during an incident?

Correct answer: C. To show who handled the evidence and that it was not altered
Chain of custody documents every person who handled the evidence and when, which shows its integrity and supports admissibility in court. It does not make analysis faster; it adds steps to protect the evidence's legal value.

Question 40Information Security Program

A newly hired information security manager finds that business units often ignore program requirements, claiming the security program has no mandate. What would BEST address this?

Correct answer: B. Obtain a senior management charter that defines the program's authority
A charter approved by senior management gives the program formal authority and shows executive support. Without that mandate, other measures look like the security team acting alone. Technical blocking may enforce some rules but does not fix the governance gap and can disrupt operations.

Question 41Information Security Program

Fabrikam launched a security awareness program a year ago. Which evidence BEST shows the program is achieving its purpose?

Correct answer: C. A lasting drop in phishing clicks and a rise in user reports
The purpose of awareness is changed behavior, so fewer risky actions and more reporting are the best evidence. High completion rates show people attended, not that they learned anything or changed how they act.

Question 42Incident Management

Why should an organization define incident categories and severity levels before any incidents occur?

Correct answer: A. To match response resources and urgency to the potential business impact
Predefined categories and severity levels let the team judge impact quickly and apply the right people, urgency and escalation. Handling every incident the same way wastes effort on minor events and can delay serious ones.

Question 43Information Security Governance

After a data breach, a regulator asks who is ultimately accountable for protecting the company's information assets. What is the BEST answer?

Correct answer: B. The board of directors and senior management
Ultimate accountability rests with the board and senior management, who can delegate tasks but not accountability. The CISO manages the program and advises leadership, but does not carry final accountability.

Question 44Incident Management

Analysts confirm that a file containing customer personal data was copied to an external server. What should the information security manager do FIRST?

Correct answer: A. Inform legal counsel to assess notification obligations
Legal counsel determines which laws, regulators and deadlines apply before anyone is notified. Contacting customers right away could break legal requirements or share inaccurate facts, while waiting for full forensics may miss a mandatory deadline.

Question 45Information Security Risk Management

A sales director asks the CISO to sign a risk acceptance form for an outdated server that supports the director's sales operations. What is the CISO's BEST response?

Correct answer: C. Have the director sign as risk owner after the CISO advises
The business owner of the process owns the risk and should accept it, with security advising on the possible impact. If the CISO signs, accountability moves away from the person who relies on the server and controls its budget.

Question 46Information Security Program

A healthcare company wants to start an information classification program. What should be done FIRST?

Correct answer: B. Identify and inventory the information assets to be classified
Assets cannot be classified or protected until the organization knows what it has and who owns it, so the inventory is the base for every later step. Defining levels is also needed, but the levels should reflect the types of assets actually found.

Question 47Information Security Risk Management

An information security manager is reviewing draft risk scenarios prepared by the security team. Which characteristic is MOST important for the scenarios to be useful to the business?

Correct answer: D. They are realistic and tied to the company's assets and objectives
Risk scenarios support decisions only when they are plausible and linked to the assets and objectives the business cares about. Covering every theoretical threat sounds thorough, but it produces unrealistic scenarios that pull attention away from the risks that matter.

Question 48Information Security Program

Developers keep introducing the same injection flaws even though they completed the company-wide awareness course. What is the BEST response?

Correct answer: A. Provide role-based secure coding training for the developers
General awareness content does not teach the specific skills developers need, so targeted secure coding training addresses the root cause. Repeating the same general course would likely produce the same results.

Question 49Incident Management

An information security manager is designing severity levels for the incident response plan. Severity should PRIMARILY be based on:

Correct answer: B. the impact on critical business processes and sensitive information
Severity should reflect business impact, such as harm to critical processes, regulated data or customers. Alert counts can be high for trivial events and low for serious ones, so they are a poor basis for rating severity.

Question 50Information Security Governance

The board of a logistics company asks for a single view that shows how the information security program supports financial, customer, internal process and learning goals. Which tool BEST meets this request?

Correct answer: D. An information security balanced scorecard
A security balanced scorecard maps security measures to the four business perspectives the board asked about, which links security to strategy. A vulnerability summary or risk register is useful operationally but does not show alignment with business goals.

Question 51Information Security Program

Who should be responsible for determining the classification level of customer data held in a bank's lending system?

Correct answer: D. The business owner accountable for the lending data
The data owner understands the business value and sensitivity of the information and is accountable for it. The security manager defines the scheme and supports the owner but does not decide the level for business data.

Question 52Incident Management

Ransomware is actively encrypting file shares in one office and spreading across the network. What is the BEST immediate action?

Correct answer: A. Isolate the affected network segments from the rest
Containment is the priority while ransomware is spreading, and isolating the affected segments limits the damage. Restoring from backup before containment would simply let the malware encrypt the restored files again.

Question 53Information Security Program

At which phase of the system development life cycle is it MOST cost-effective to address security requirements?

Correct answer: C. Requirements definition, alongside the functional needs
Defining security requirements early lets them be built in rather than added later, which is far cheaper. Finding issues during testing is useful, but fixing design-level flaws at that stage requires costly rework.

Question 54Information Security Risk Management

When documenting a formal risk acceptance, which element is MOST important to include so that the decision stays valid over time?

Correct answer: A. A defined expiry or review date for the acceptance
Risk conditions change, so an acceptance should expire or be reviewed on a set date to confirm it still fits within appetite. The security manager's signature does not keep the decision current and is not the owner's approval.

Question 55Information Security Governance

Which of the following is the BEST example of a key goal indicator (KGI) for an information security program?

Correct answer: B. Zero regulatory fines for data protection failures during the year
A KGI shows whether a business goal was achieved, such as avoiding regulatory fines. Patch and training figures are KPIs that measure how well processes perform, not whether the end goal was met.

Question 56Information Security Risk Management

A company is valuing its customer database as part of a risk assessment. Which basis provides the MOST meaningful value for risk analysis?

Correct answer: B. The business impact if the data were disclosed, altered or lost
For risk purposes, an asset is worth what its compromise would cost the business, including lost revenue, fines and reputational damage. Record count is tempting because it relates to exposure, but on its own it does not reflect the business consequences of a loss.

Question 57Incident Management

Several high-impact incidents reached executives hours late because analysts were unsure when to involve management. What is the BEST way to address this?

Correct answer: C. Define escalation thresholds and timeframes linked to each severity level
Clear escalation criteria tied to severity tell analysts exactly when and to whom an incident must be raised. Notifying executives of every event causes alert fatigue and buries the incidents that truly need their decisions.

Question 58Information Security Program

Classification levels in an information classification scheme should PRIMARILY reflect:

Correct answer: B. the business impact if the information is compromised.
Classification is based on how much harm the organization would suffer if the information lost its confidentiality, integrity or availability. That impact then drives the level of protection. Existing controls do not show how valuable the data is and may themselves be inadequate.

Question 59Incident Management

When choosing a containment strategy for an incident affecting a customer-facing application, what should be the PRIMARY consideration?

Correct answer: D. The business impact weighed against the risk of further harm
Containment must balance the harm of disrupting the business against the risk of letting the attack continue, so business impact drives the choice. Evidence needs are a factor, but they do not outweigh the business consequences of the approach chosen.

Question 60Information Security Program

A critical security patch caused an outage because it was applied to production without testing. Which process improvement would BEST prevent a recurrence?

Correct answer: A. Route security patches through formal change management
Change management ensures patches are assessed, tested and approved with rollback plans, while still offering an emergency path for urgent fixes. Holding every patch for a quarterly window would leave known vulnerabilities open far too long.

Question 61Information Security Governance

The CISO of a hospital group is preparing a quarterly report for the board. Which metric would be MOST useful to include?

Correct answer: C. Trend of high risks to critical services against the risk appetite
Boards need to know whether risk to the business is within appetite and moving in the right direction. Counts of blocked attacks are operational data that do not tell the board whether the organization is adequately protected.

Question 62Incident Management

Only one engineer on the incident management team knows how to restore the company's core billing database. What is the BEST way to address this readiness gap?

Correct answer: A. Document the restore procedure and train an alternate team member
A documented procedure and a trained alternate remove dependence on one person, who may be unavailable during an incident. Keeping the engineer permanently on call is not sustainable and still fails if that person is sick or leaves.

Question 63Information Security Program

In an information classification program, what is the PRIMARY responsibility of a data custodian?

Correct answer: D. Maintaining the protections defined by the data owner
Custodians, often IT staff, carry out the day-to-day protection the owner requires, such as backups and access settings. Classifying, approving access and accepting risk are owner duties, and mixing these roles weakens accountability.

Question 64Information Security Risk Management

Residual risk for a customer portal exceeds the approved risk appetite. The business owner declines to fund the recommended controls, citing budget limits. What should the information security manager do NEXT?

Correct answer: A. Escalate the matter to senior management for a decision
Risk above appetite cannot be accepted at the business owner's level, so senior management must decide whether to fund treatment or formally accept it. Recording it as accepted would hide a breach of appetite from the people who set it.

Question 65Incident Management

A reporter calls a help desk employee asking about rumors of a data breach at the company. What should the employee do?

Correct answer: C. Refer the reporter to the designated company spokesperson
Only an authorized spokesperson should speak to the media, so messages stay accurate, consistent and approved. Sharing even known facts can create legal exposure and conflicting stories, and a denial damages trust if the breach is later confirmed.

Question 66Information Security Risk Management

How does a business impact analysis (BIA) PRIMARILY contribute to an information security risk assessment?

Correct answer: D. It shows the consequences over time of disrupting critical processes
A BIA measures how the loss of critical processes and resources affects the business over time, which feeds the impact side of risk analysis. Selecting recovery strategies comes after the BIA and is a response decision, not an input to assessing risk.

Question 67Information Security Program

An engineer made an emergency firewall change at night to stop an active attack, bypassing the normal approval step. What should happen NEXT?

Correct answer: D. Document the change and submit it for retrospective approval
Emergency changes are acceptable when justified, but they must be documented and reviewed afterward so the change record stays complete. Reversing the change would reopen the organization to the active attack.

Question 68Information Security Governance

A new data protection regulation has been published in a country where Clearview Health operates. What should the information security manager do FIRST?

Correct answer: B. Determine with legal counsel how the regulation applies to the business
The first step is to understand whether and how the regulation applies, which needs input from legal counsel. Updating policies before the impact is known may waste effort or miss the real requirements.

Question 69Incident Management

An organization has run several successful tabletop exercises of its incident response plan. What is the MAIN limitation of relying only on this type of test?

Correct answer: C. It cannot confirm that systems can actually be recovered in time
A tabletop exercise tests understanding and decisions through discussion, but no systems are actually restored, so recovery times remain unproven. Tabletops are cheap and never touch production, which is why they are a common first step.

Question 70Information Security Program

A manufacturing company's classification scheme has seven levels, and employees regularly mislabel documents. What is the BEST course of action?

Correct answer: B. Simplify the scheme to fewer levels that users can apply consistently
A scheme that is too complex will not be applied correctly, so the protection it promises is not delivered. Fewer, clearly defined levels improve consistency. Automated labeling can help, but it still depends on a scheme that maps clearly to business needs.

Question 71Incident Management

During a major incident, the information security manager briefs the executive committee. What should the briefing MAINLY focus on?

Correct answer: C. Business impact, response status and decisions needed
Executives need to understand business impact, current status and any decisions or resources required of them. Technical detail about the malware helps responders but does not help senior management make business decisions.

Question 72Information Security Program

Contoso plans to buy a new HR software-as-a-service platform. When should the security manager's requirements be introduced?

Correct answer: B. While preparing the request for proposal sent to vendors
Putting security requirements in the request for proposal lets vendors be evaluated against them before a choice is made. Raising them at contract signature weakens bargaining power and may reveal that the chosen vendor cannot comply.

Question 73Information Security Governance

Meridian Group's corporate policy requires monitoring of employee email, but such monitoring is restricted by law in one country where it operates. What is the BEST course of action?

Correct answer: C. Adjust the local practice to comply with the law and document the variance
Local law takes precedence, so the local practice must be adapted and the variance documented and approved. Applying the global policy anyway would expose the company to legal penalties.

Question 74Information Security Risk Management

A company's online ordering platform produces most of its revenue. Who is the MOST appropriate owner of the risks tied to this platform?

Correct answer: A. The head of e-commerce, who is accountable for sales
Risk should be owned by the business leader who is accountable for the process and has authority to fund treatment. The CIO runs the technology but does not own the business results the platform supports.

Question 75Information Security Risk Management

A quarterly vulnerability scan reports more than 400 high-severity findings, and the IT team can remediate only a fraction of them this month. What should the information security manager do FIRST?

Correct answer: D. Rank the findings by asset criticality, exposure and exploitability
Limited resources should go to the vulnerabilities that create the most business risk, which depends on asset criticality, exposure and exploitability. Fixing strictly by CVSS score is tempting, but the base score ignores the organization's own context and asset value.

Question 76Information Security Program

An analytics team combines several datasets, each classified as internal use, into one report that reveals customer buying patterns and pricing strategy. What should the information security manager recommend?

Correct answer: A. Have the data owner reassess the classification of the combined report
Combining data can create information that is more sensitive than any single source, so the result should be classified on its own impact. The owner is best placed to judge that. Keeping the source label ignores the new risk created by aggregation.

Question 77Incident Management

Leadership wants to run a full interruption test of the disaster recovery plan. Which condition is MOST important before approving this test?

Correct answer: C. The plan has already passed walkthrough, simulation and parallel tests
A full interruption test shuts down production, so it should only follow successful lower-risk tests showing the plan is likely to work. Having auditors observe adds assurance but does nothing to reduce the risk of a failed recovery.

Question 78Information Security Governance

Which observation is the BEST indicator that an organization has a strong information security culture?

Correct answer: D. Employees report suspicious emails and incidents without being prompted
A strong culture shows in everyday behavior, such as staff reporting issues on their own. Training completion shows that a requirement was met, but it does not prove that people act securely.

Question 79Information Security Program

Before signing with a new payment processing provider, what should the security manager do FIRST?

Correct answer: D. Assess the provider's security posture against requirements
Due diligence on the provider's security posture should come before commitment so risks are known and can be addressed in the contract. Penetration testing a provider's systems needs its consent and is not the first step in evaluating it.

Question 80Incident Management

Responders have contained a breach on a web server and the business wants it back online quickly. What must be confirmed BEFORE recovery begins?

Correct answer: B. The root cause has been found and removed from the server
Eradication must remove the root cause, such as the exploited flaw or an attacker backdoor, before recovery. Otherwise the server can be compromised again as soon as it returns to service. The review and final report come after recovery, not before it.

Question 81Information Security Program

Product launch plans at a consumer electronics firm are classified as confidential. After the product is publicly announced, what should happen to the classification?

Correct answer: B. The owner should review it and lower the level to match current value
Sensitivity changes over time, so owners should review classifications to keep protection in line with current value. Keeping the plans confidential spends resources on information that no longer needs it. A custodian should not change the level without owner approval.

Question 82Incident Management

A newly written incident response plan has just been approved. Which type of test should be performed FIRST?

Correct answer: D. Structured walkthrough
New plans should start with a low-cost, low-risk test such as a walkthrough to catch gaps in content and roles. Jumping to a full interruption test risks real disruption before basic errors have been found.

Question 83Information Security Governance

Harborview Logistics wants a framework to help its board and executives govern and manage enterprise information and technology in line with business goals. Which framework is MOST suitable?

Correct answer: C. COBIT
COBIT is designed for the governance and management of enterprise information and technology and links IT goals to business goals. ITIL focuses on IT service management practices rather than enterprise governance.

Question 84Information Security Program

A vendor will process customer personal data for the company. Which contract clause BEST allows the company to verify ongoing compliance with security requirements?

Correct answer: B. A right-to-audit clause covering the vendor's relevant controls
A right-to-audit clause gives the company a contractual basis to obtain evidence that agreed controls are in place. Indemnification helps recover losses after a breach but does nothing to verify controls beforehand.

Question 85Information Security Risk Management

A network team member has been named owner of the firewall rule review control. What is this control owner PRIMARILY responsible for?

Correct answer: C. Ensuring the control works as designed and reporting on it
A control owner makes sure the control operates as intended and reports on how well it performs. Deciding whether the risk is acceptable belongs to the risk owner, not the person running the control.

Question 86Incident Management

An organization plans to restore servers from backups after a ransomware attack. What should be verified FIRST?

Correct answer: A. The backups are clean and were taken before the compromise
Restoring from infected or post-compromise backups would bring the malware back into the environment. Software version and storage location matter for general resilience, but neither confirms that the data being restored is clean.

Question 87Information Security Risk Management

Internal audit reports that quarterly user access reviews for a critical financial application have not been performed for the last two quarters. What should the information security manager do FIRST?

Correct answer: B. Assess the risk exposure created by the missed access reviews
Before acting, the manager needs to understand what the deficiency means in risk terms, such as whether inappropriate access may exist on a critical system. Completing the reviews right away is tempting, but it skips the impact analysis and does not explain why the control failed.

Question 88Information Security Program

When valuing information assets for the security program, which approach is MOST appropriate?

Correct answer: A. Base each value on the business impact of losing the asset
The value of information comes from what the business would lose if it were disclosed, altered or unavailable. Hardware and license costs are easy to measure but often bear little relation to that impact.

Question 89Incident Management

How should the incident response plan relate to the business continuity plan?

Correct answer: C. The IRP should define when an incident triggers activation of the BCP
Incident response handles the event, and when impact reaches agreed thresholds it hands off to business continuity through defined triggers. Keeping the plans fully separate leaves gaps where nobody knows when to invoke continuity procedures.

Question 90Information Security Governance

A software company's largest customers want independent proof that it runs a formal information security management system (ISMS). Which standard should it seek certification against?

Correct answer: D. ISO/IEC 27001
ISO/IEC 27001 sets the requirements for an ISMS and is the standard organizations are certified against. ISO/IEC 27002 gives guidance on controls, but it is not a certification standard.

Question 91Information Security Program

A cloud vendor refuses on-site audits but offers an independent assurance report. Which report gives the BEST evidence of control effectiveness over time?

Correct answer: D. A SOC 2 Type II report covering a twelve-month period
A Type II report tests whether controls operated effectively across a period, not just whether they were designed properly. A Type I report only describes control design at a single point in time.

Question 92Incident Management

What is the PRIMARY objective of a post-incident review?

Correct answer: A. To improve the organization's response and its controls
A post-incident review finds what worked, what failed and what to change, so future incidents are handled better. Assigning blame discourages honest input and works against that aim, and checking plan compliance is only one part of the review.

Question 93Information Security Program

An information security manager notices that most documents at a law firm are labeled highly confidential, even routine memos. What is the MOST significant concern?

Correct answer: B. Protection costs rise and truly sensitive data becomes harder to spot
Over-classification spreads costly controls across low-value data and dilutes attention on the information that really matters. It can also lead users to work around handling rules. Storage limits are a minor operational issue by comparison.

Question 94Incident Management

What is the MAIN difference between a disaster recovery plan and a business continuity plan?

Correct answer: D. DRP restores IT systems and data, while BCP keeps business functions going
A DRP recovers technology and data, while a BCP covers how the business keeps critical functions running, often with manual workarounds. Business units normally own the BCP, so the option giving it to IT reverses the usual arrangement.

Question 95Information Security Risk Management

The information security manager finds that the risk register has not been updated since before the company moved its core systems to the cloud. What is the GREATEST concern?

Correct answer: C. Risk decisions may be based on an outdated risk profile
A register that misses a major change means management is setting priorities and budgets on a risk picture that no longer exists. A format problem matters far less than content that is no longer accurate.

Question 96Information Security Governance

Under the NIST Cybersecurity Framework (CSF) 2.0, which function covers establishing and monitoring the organization's cybersecurity risk management strategy, expectations and policy?

Correct answer: A. Govern
CSF 2.0 added the Govern function to cover cybersecurity strategy, roles, policy and oversight. Identify focuses on understanding assets and risks, not on setting strategy and expectations.

Question 97Information Security Risk Management

Several business units want to start using public generative AI tools to draft customer communications and analyze internal reports. What should the information security manager do FIRST?

Correct answer: C. Assess the risk of the intended use cases, including the data involved
An emerging technology should be assessed against how the business actually plans to use it, including what data would be exposed. Publishing a policy is a reasonable later step, but writing it before the risk is understood may block valuable uses or miss the real exposures.

Question 98Information Security Program

A managed security service provider has missed its incident notification SLA three times this quarter. What should the security manager do FIRST?

Correct answer: A. Review the impact with the provider and enforce the contract
The contract and SLA give the basis to raise the issue, understand its impact and require corrective action or apply penalties. Terminating at once may be disproportionate and could leave the organization without monitoring during the transition.

Question 99Incident Management

Monitoring shows that a system administrator has been copying sensitive design files to a personal cloud account over several weeks. What should the information security manager do FIRST?

Correct answer: B. Coordinate with human resources and legal before acting
Insider cases carry employment and legal risks, so HR and legal should guide the response to protect evidence and the organization. Confronting the administrator could lead to evidence being destroyed and alerts them before the facts are secured.

Question 100Information Security Program

During a review, the information security manager finds several cloud file-sharing accounts that a marketing team set up without IT's knowledge. What should the manager do FIRST?

Correct answer: A. Identify the data stored there and assign ownership in the inventory
The manager needs to know what information is involved and who is accountable before deciding how to treat the risk. Bringing the accounts into the inventory makes that possible. Disabling them at once may disrupt business work and lose data before the risk is understood.

Question 101Information Security Governance

A security manager needs a document that states the minimum password length and complexity required on all corporate systems. Which type of document is MOST appropriate?

Correct answer: C. A security standard
Standards set specific, mandatory requirements, such as minimum password settings, that support a policy. A policy states high-level management intent and should not change every time technical settings change.

Question 102Incident Management

A company has just migrated its customer portal to a cloud provider. What should the information security manager do about the incident response plan?

Correct answer: B. Update procedures, contacts and escalation paths for the new setup
Significant changes to systems or providers should trigger a plan update so procedures, contacts and responsibilities match the new environment. The provider shares responsibility, but the company still owns the business impact and must plan its own response.

Question 103Information Security Program

A contract with a marketing analytics vendor that held customer data is ending. Which action is MOST important from a security perspective?

Correct answer: D. Revoke vendor access and confirm data is returned or destroyed
Offboarding must remove the vendor's ability to reach company systems and ensure no company data remains in its hands. A final questionnaire adds paperwork but does not remove the exposure created by leftover access and data.

Question 104Information Security Risk Management

A company is formalizing its risk management program. Who should define how much information risk the organization is willing to take in pursuit of its goals?

Correct answer: A. The board and senior management
Risk appetite reflects how much risk the organization will take to reach its objectives, so the board and senior management set it. A security steering team helps apply the appetite but does not define it for the enterprise.

Question 105Information Security Risk Management

An organization lacks reliable loss data but wants risk results that can be ranked more consistently than simple high, medium and low ratings. Which approach is MOST appropriate?

Correct answer: B. Semi-quantitative analysis using defined numeric scales for each rating
Semi-quantitative analysis assigns numbers to defined likelihood and impact scales, allowing consistent ranking without precise financial data. Full quantitative analysis is tempting, but it depends on reliable loss and frequency data that the organization does not have.

Question 106Information Security Program

Which activity BEST determines the criticality of information assets for the security program?

Correct answer: A. A business impact analysis of the processes that use the assets
Criticality reflects how much the business depends on an asset over time, which a BIA measures directly. Scans and tests reveal weaknesses, but they do not show how important an asset is to the business.

Question 107Incident Management

An attack has caused significant financial loss, and the security team believes a crime has occurred. Who should decide whether to involve law enforcement?

Correct answer: D. Senior management, with advice from legal counsel
Involving law enforcement can affect publicity, operations and control of evidence, so senior management should decide with advice from legal counsel. The security manager gives input, but the decision carries business consequences beyond their authority.

Question 108Information Security Governance

The security manager at Summit Bank has drafted a revised information security policy. Who should give final approval for the policy?

Correct answer: A. Senior management or the board
Policies express management's intent and direction, so senior management or the board should approve them. Internal audit should review the policy independently, not approve it, to protect its objectivity.

Question 109Incident Management

Employees at an insurance firm often fail to report suspicious emails and lost devices. What is the BEST way to improve incident reporting?

Correct answer: C. Provide awareness training with a simple, well-known reporting channel
Staff report more when they know what to look for and have an easy, familiar way to report it. Discipline tends to make people hide mistakes, which reduces reporting instead of improving it.

Question 110Information Security Program

The security manager must brief the board on the results of a major control assessment. How should the findings be presented?

Correct answer: A. In terms of business risk, impact and decisions needed
Boards make decisions about risk and investment, so findings should be framed by business impact and the actions required. A technical vulnerability list helps IT teams but does not help directors decide what to do.

Question 111Information Security Program

A fast-growing fintech company plans to base its information security program on an industry framework. What should MOST influence the choice of framework?

Correct answer: D. Its fit with the company's business, regulatory and risk needs
A framework is only useful if it suits the organization's objectives, legal obligations and risk profile. A popular or highly detailed framework may add cost without addressing the company's real needs. Team familiarity eases adoption but should not drive the choice.

Question 112Incident Management

A SaaS provider informs an organization that its tenant data may have been accessed by an attacker. What should the information security manager do FIRST?

Correct answer: B. Use contract terms to get incident details from the provider
The organization still owns the risk, so it should use its contractual rights to get logs and facts about scope and impact. Terminating the contract right away does not answer what data was exposed and may cut off access to evidence that is needed.

Question 113Information Security Governance

While reviewing a RACI chart for patch management, the security manager sees that both the IT operations manager and the infrastructure lead are marked Accountable. What is the MAIN concern?

Correct answer: C. Each activity should have exactly one accountable party
In a RACI model, each activity should have one accountable person so ownership is clear and decisions are not split. One person can be both responsible and accountable, so combining those roles is not the issue.

Question 114Incident Management

An information security manager has been asked to set up an incident management program at a company that has none. What should be done FIRST?

Correct answer: B. Obtain senior management commitment and define the program's scope
Senior management support and a clear scope set the authority, budget and boundaries for everything that follows. Buying tools or writing playbooks first risks spending money on a program that lacks direction or backing.

Question 115Information Security Risk Management

The information security manager is choosing a key risk indicator (KRI) for the risk of user account compromise. Which KRI would be MOST useful?

Correct answer: D. Percent of privileged accounts without multifactor sign-in
A good KRI is a leading indicator that shows rising exposure before an incident, giving time to act. Counting confirmed takeovers only reports harm that has already happened.

Question 116Information Security Risk Management

When estimating the likelihood of a threat event during a risk analysis, which factor should the information security manager consider MOST?

Correct answer: B. The threat source's capability and the presence of exploitable flaws
Likelihood depends on whether a capable, motivated threat source can exploit a weakness that is not adequately controlled. Media reports may hint at trends, but they do not show whether the organization itself is exposed.

Question 117Information Security Program

Control testing reveals that a key control protecting a revenue system has failed, creating risk beyond appetite. What should the security manager do FIRST?

Correct answer: C. Report the issue to the risk owner and senior management
Risk beyond appetite must be escalated to those accountable for it so they can decide on treatment. Fixing it quietly may be well meant, but it denies the risk owner the information needed for an informed decision.

Question 118Information Security Program

An organization has adopted a widely recognized security framework, but several controls are not relevant to its small, single-site operations. What is the BEST approach?

Correct answer: A. Tailor the framework and document why each control is excluded
Frameworks are meant to be adapted to the organization's context, with justified and documented exclusions. This keeps the program cost-effective and auditable. Implementing every control wastes resources on risks the company does not face.

Question 119Information Security Governance

Northpeak Tech's security manager has a roadmap with fifteen initiatives but limited resources. What should MOST influence the order in which initiatives are delivered?

Correct answer: D. The business risk each initiative reduces and its link to business goals
A roadmap should deliver the greatest risk reduction and business value first. Choosing the cheapest items first may show quick progress but leave the most significant risks open.

Question 120Incident Management

A regulation requires breach notification within 72 hours. The deadline is near, but the investigation has not yet confirmed how many records were affected. What should the organization do?

Correct answer: A. Submit an initial notification and provide updates later
Regulators generally expect timely notice based on the facts known, followed by updates as the investigation continues. Delaying until every detail is known risks missing the legal deadline and adds penalties to the breach itself.

Question 121Incident Management

After a disaster recovery simulation, how should the information security manager judge whether the test was successful?

Correct answer: C. By comparing results with objectives set before the test
Success should be measured against predefined objectives, such as meeting RTO and RPO targets. A test that finds no issues is not automatically a success, because uncovering gaps is one of the main reasons to test.

Question 122Information Security Program

A security architect proposes relying on a single next-generation firewall to protect a sensitive data environment. What is the PRIMARY concern with this design?

Correct answer: D. One control failure would leave the environment exposed
Layered controls ensure that if one fails or is bypassed, others still provide protection. The claim about encrypted traffic is a technical detail, and the core weakness is relying on one control for a sensitive environment.

Question 123Information Security Program

Which statement is MOST appropriate for inclusion in an information security policy?

Correct answer: D. Information must be protected in line with its classification.
Policies state management's intent at a high level and should stay stable as technology changes. Specific settings such as password length belong in standards, which can be updated more often without reopening the policy.

Question 124Information Security Governance

At Granite Energy, the CISO reports to the CIO and has repeatedly seen security concerns overruled to meet IT delivery deadlines. Which change would BEST address this issue?

Correct answer: B. Have the CISO report to a senior executive independent of IT operations
Reporting to an executive outside IT reduces the conflict between delivery pressure and security, and gives the CISO a direct voice with senior management. Giving the CISO control of IT projects would create a new conflict of interest rather than solve this one.

Question 125Information Security Risk Management

The information security manager must brief the executive committee on a significant new risk to the company's supply chain systems. What should the briefing focus on?

Correct answer: C. Potential impact on business objectives and treatment options
Executives need to understand how the risk affects business goals and what choices they have, so they can make an informed decision. Technical detail does not help them weigh the risk against appetite.

Question 126Information Security Risk Management

A file server holding design documents is valued at USD 500,000. A specific threat would destroy 40 percent of its value per occurrence and is expected once every four years. What is the annualized loss expectancy (ALE)?

Correct answer: D. USD 50,000
Single loss expectancy is USD 500,000 x 0.40 = USD 200,000, and the annual rate of occurrence is 0.25, so ALE is USD 200,000 x 0.25 = USD 50,000. USD 200,000 is the loss from one event, not the expected yearly loss.

Question 127Incident Management

While building an incident timeline, analysts find that firewall, server and application logs show conflicting times for the same events. Which control would have MOST helped?

Correct answer: C. Synchronizing all system clocks to a common time source
Correlating events across systems depends on consistent timestamps, which requires synchronized clocks, for example through NTP. Longer retention keeps more logs but does not fix the time differences that make the sequence of events unreliable.

Question 128Incident Management

A logistics company's BIA shows its dispatch system has an RTO of four hours. Which recovery option is MOST appropriate?

Correct answer: B. A hot site with systems and current data ready for use
A four-hour RTO needs a hot site with equipment and data ready to run. A cold site would take days or weeks to equip, far beyond the required recovery time.

Question 129Information Security Program

A new set of cloud configuration controls has just been deployed. Which step is MOST important to keep the controls effective over time?

Correct answer: C. Assign each control an accountable owner with defined duties
Controls degrade when no one is accountable for operating and maintaining them. Documentation is useful, but a documented control with no owner is likely to drift and fail without anyone noticing.

Question 130Information Security Program

A document gives staff recommended practices for securely reading company email on personal devices, but following it is not required. This document is BEST described as a:

Correct answer: A. guideline.
Guidelines offer advice and recommended practices without being mandatory. Policies, standards and procedures all require compliance. A standard is the tempting choice, but standards set mandatory minimum requirements.

Question 131Information Security Governance

Keystone Payments stores and processes payment card data. Its obligation to comply with PCI DSS is BEST described as which type of requirement?

Correct answer: B. A contractual obligation with card brands and banks
PCI DSS is enforced through contracts with the card brands and acquiring banks, not as a general national law. It is far from voluntary, since failing to comply can lead to fines or loss of the ability to process cards.

Question 132Incident Management

An organization must notify customers about a breach of their personal data. What should the notification include?

Correct answer: A. The data affected and steps customers can take to protect it
Customers need to know what happened to their data and what they can do, such as changing passwords or watching their accounts. Technical exploit details do not help customers and could aid other attackers before the issue is fully fixed.

Question 133Incident Management

Two department heads each insist their system must be restored first after a major outage. On what basis should recovery priority be set?

Correct answer: C. The criticality and timeframes established in the business impact analysis
Recovery priority should follow the BIA, which ranks processes by business impact and agreed recovery times. Restoring whatever is easiest may look productive but can leave the most critical functions down.

Question 134Information Security Program

Security issues are often discovered late in IT projects, causing costly delays. What is the BEST way to address this?

Correct answer: D. Embed security checkpoints in the project methodology
Building security reviews into each project stage catches issues when they are cheaper to fix and avoids late surprises. Testing only before go-live is the very pattern that causes late discoveries.

Question 135Information Security Risk Management

A company is acquiring a smaller firm and will connect the firm's network to its own within 60 days. From a risk monitoring standpoint, what should the information security manager do FIRST?

Correct answer: D. Determine how the risk profile changes and update the register
An acquisition changes the risk profile, so the register must capture the new exposures before decisions about connecting the networks are made. Applying policies will likely follow, but without an updated risk view management cannot set priorities.

Question 136Information Security Program

A business unit requests an exception to the encryption standard because its legacy application cannot support it. What should the information security manager do FIRST?

Correct answer: A. Assess the risk of the exception and any compensating controls
A sound exception process starts with understanding the risk created and whether other controls can reduce it. The business owner can then make an informed decision to accept the risk for a set period. Automatic denial ignores real business constraints and may push users to bypass the standard.

Question 137Information Security Governance

During strategy planning, the security manager is asked to set the organization's risk appetite. What is the BEST response?

Correct answer: B. Explain that senior management must define it, with input from security
Risk appetite is a business decision that belongs to the board and senior management, with the security manager providing advice. Setting it from industry benchmarks ignores the organization's own goals and tolerance for risk.

Question 138Information Security Risk Management

What is the PRIMARY reason an information security manager should regularly update the organization's threat landscape analysis?

Correct answer: D. To reflect new or changing threats that may alter existing risk levels
Threats change constantly, and a shift in threat activity can raise or lower the risk to assets that were already assessed. Supporting budget requests can be a side benefit, but it is not the main reason to keep the threat picture current.

Question 139Incident Management

Investigators suspect the attacker has access to the corporate email system. How should the incident response team communicate during the response?

Correct answer: C. Use an out-of-band channel separate from affected systems
If the attacker can read corporate email, response plans sent through it may alert them, so a separate out-of-band channel is needed. Encryption does not help if the attacker controls the mail accounts or servers themselves.

Question 140Incident Management

During a tabletop exercise, the team finds that several phone numbers in the escalation contact list are out of date. What is the BEST long-term fix?

Correct answer: B. Assign an owner for the list and verify it on a regular schedule
A named owner and scheduled verification keep contact details current as staff change. Printing a corrected list fixes today's problem, but it will go out of date again without a maintenance process.

Question 141Information Security Program

A key SaaS provider plans to move the company's data to a hosting subcontractor. What should the security manager do FIRST?

Correct answer: C. Check the contract's subcontracting terms and assess the risk
The contract should define whether and how subcontracting is allowed, and the change needs a risk assessment before it is accepted. Relying on the provider's accountability ignores that company data would sit with a party no one has assessed.

Question 142Information Security Program

Which metric would be MOST meaningful to the board of directors of a retail company?

Correct answer: A. Trend of key risks relative to the approved risk appetite
Boards oversee risk against appetite and strategy, so a risk trend tied to appetite supports their decisions. Patch rates are useful to IT management but are too operational for the board.

Question 143Information Security Governance

The board asks how the security program demonstrates value delivery, one of the outcomes of information security governance. Which evidence BEST shows value delivery?

Correct answer: B. Security investments support business objectives at an optimized cost
Value delivery means security investments are aligned with business needs and give the best return for the money spent. Implementing every framework control may overspend on low risks and does not prove value.

Question 144Information Security Risk Management

The latest SOC 2 Type II report for a critical cloud payroll provider lists several exceptions in access controls. What should the information security manager do FIRST?

Correct answer: A. Evaluate how the exceptions affect the company's own risk
The manager first needs to know how the exceptions affect the company's risk, including any compensating controls, before choosing a response. Ending the contract right away is premature and could create greater operational risk.

Question 145Information Security Risk Management

A news report states that a software supplier whose product is installed on many of the company's servers has suffered a breach of its build environment. What should the information security manager do FIRST?

Correct answer: C. Determine whether the company's systems received affected software
The first need is to understand the company's own exposure, such as whether compromised updates were installed. Exercising audit rights may help later, but it does not quickly tell the manager whether the company is already affected.

Question 146Incident Management

A post-incident review finds that the escalation contact list in the incident response plan was out of date, which delayed the response. What should the information security manager do NEXT?

Correct answer: B. Update the plan and communicate the changes to stakeholders
Lessons learned only add value when they lead to timely updates to the plan, shared with the people who rely on it. Waiting for the annual cycle leaves the same gap open if another incident happens in the meantime.

Question 147Incident Management

A company is selecting a disaster recovery site. What should be the information security manager's PRIMARY concern?

Correct answer: D. Security controls at the site are comparable to the primary site
Sensitive data processed at the recovery site needs protection equal to the primary site, or a disaster could turn into a security breach. Cost matters to the business, but a cheap site with weak controls simply creates new risk.

Question 148Information Security Program

Senior executives are being targeted by business email compromise attempts. What is the BEST awareness approach for this group?

Correct answer: A. Short briefings on threats aimed at executives and how to verify requests
Executives respond best to short, relevant sessions that cover the threats aimed at them and give practical verification steps. A generic module does not address their particular exposure or fit their limited time.

Question 149Information Security Program

A maturity assessment rates the organization's access management process at level 2 on a five-level model. What should determine the target maturity level?

Correct answer: B. The level needed to meet business objectives cost-effectively
The target should be justified by business needs and risk, balancing benefit against cost. Reaching the highest level everywhere is often too expensive and unnecessary. Peer levels give context but do not reflect the organization's own goals.

Question 150Information Security Governance

Midway through the year, Silverline Foods cuts the security budget by 25%. What should the security manager do FIRST?

Correct answer: D. Reprioritize initiatives by risk and report the resulting risk to management
With less money, the manager should focus on the highest risks and make sure management understands and accepts the remaining exposure. Cancelling the costliest items ignores risk and may drop the controls that matter most.