Free CISM Practice Exam (2026)

Your score by topic

Get a free CISM study plan on WhatsApp See CISM Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Information Security Governance⚑ Flag

Business units at Oakridge Group often launch new digital services and involve security only days before go-live. Which approach would BEST address this?

ABuild a security checkpoint into the project approval and initiation stage BPerform a penetration test on each new service in the week before it goes live CSend monthly reminders to all project managers about the security policy DBlock any service from going live until the security team signs it off

Correct answer: A. Build a security checkpoint into the project approval and initiation stage
Building security into project governance from the start means requirements are known early, when changes are cheaper. A late penetration test finds problems but does not fix the underlying process.

Question 2Information Security Program⚑ Flag

What is the PRIMARY benefit of establishing an enterprise information security architecture?

ASecurity tools are standardized on a single preferred vendor BThe need for periodic risk assessments is largely eliminated CControls are integrated consistently to support business goals DTechnical staff can deploy new controls without any approval

Correct answer: C. Controls are integrated consistently to support business goals
A security architecture gives a structured blueprint so controls work together and support business objectives instead of being added piecemeal. Standardizing on one vendor may be a side effect, but it is not the purpose of an architecture.

Question 3Information Security Program⚑ Flag

When defining roles for the information security program, which approach BEST prevents gaps in accountability?

ALet each business unit define its own security responsibilities BMake the security team responsible for every program activity CShare accountability equally among all affected department heads DAssign a single accountable owner for each program activity

Correct answer: D. Assign a single accountable owner for each program activity
Clear, single-point accountability, often shown in a RACI chart, ensures someone owns each outcome. Shared accountability sounds inclusive but usually means no one acts when problems arise.

Question 4Incident Management⚑ Flag

The security operations team ignores many SIEM alerts because most turn out to be false positives. What is the BEST way to address this?

ARaise the severity threshold so that fewer alerts are created BReduce the number of log sources that feed into the SIEM CHire more analysts so every alert can be reviewed by hand DTune correlation rules using baseline activity and context

Correct answer: D. Tune correlation rules using baseline activity and context
Tuning rules to the organization's normal activity cuts false positives while keeping meaningful alerts visible. Raising thresholds or removing log sources reduces noise but can also hide real attacks.

Question 5Incident Management⚑ Flag

Which of the following BEST indicates that an organization is ready to respond to security incidents?

ANo major security incidents have occurred in the past twelve months BRecent tests show the team meets the plan's response objectives CThe incident response plan document was approved by the board last year DThe security team has purchased advanced threat detection tools

Correct answer: B. Recent tests show the team meets the plan's response objectives
Successful testing against defined objectives shows that people, processes and tools actually work together. An approved plan is necessary, but without testing there is no evidence the team can carry it out.

Question 6Information Security Risk Management⚑ Flag

A KRI that tracks overdue patches on internet-facing servers has exceeded its threshold for two months in a row because of a broken patch process. What should the information security manager do FIRST?

AWait another month to confirm the trend continues BNotify the risk owner through the defined escalation path CRaise the KRI threshold so it matches current conditions DReplace the patching tool with a different vendor's product

Correct answer: B. Notify the risk owner through the defined escalation path
A breached KRI means risk has moved beyond the agreed level, so the risk owner must be told through the defined path and decide on action. Raising the threshold would hide the problem instead of treating it.

Question 7Information Security Risk Management⚑ Flag

A company is launching a new online lending process that involves several departments and third parties. Which approach will BEST identify the information risk associated with this process?

AReview the findings from the most recent external audit of IT controls BCompare the process against the controls used by peer organizations CRun automated vulnerability scans on the systems that will support it DHold facilitated workshops with the process owners and stakeholders

Correct answer: D. Hold facilitated workshops with the process owners and stakeholders
Workshops with process owners and stakeholders capture how the process actually works and where information could be exposed across departments and third parties. Vulnerability scans find technical weaknesses but miss process, people and third-party risk.

Question 8Information Security Governance⚑ Flag

During a board meeting, a director asks the CISO, "Are we secure?" What is the BEST way for the CISO to respond?

AList the security tools and controls deployed over the last financial year BConfirm that all critical systems passed their most recent security audit CDescribe current risk against the agreed appetite in business terms DExplain that no organization can ever be fully secure against all attacks

Correct answer: C. Describe current risk against the agreed appetite in business terms
The board needs to know whether risk is within the level it has accepted, explained in business language. Saying no one is fully secure is true, but it does not help the board make decisions.

Question 9Information Security Program⚑ Flag

Tailspin Ltd is moving several core applications to a public cloud. What should the security manager do FIRST to update the security architecture?

ATrain the operations team on the provider's management console BDefine how responsibilities are shared with the cloud provider CReplicate the on-premises firewall rules in the cloud environment DPurchase the cloud provider's premium security add-on bundle

Correct answer: B. Define how responsibilities are shared with the cloud provider
The shared responsibility model determines which controls the company must provide and which the provider delivers, and that shapes the rest of the architecture. Copying on-premises rules assumes the cloud works the same way and may leave gaps.

Question 10Information Security Program⚑ Flag

A new data privacy regulation will apply to the organization next year. What should the information security manager do FIRST regarding the program's policies?

AAsk legal counsel to draft a separate privacy policy for approval BWait for the regulator's guidance before making any policy changes CPerform a gap analysis of current policies against the regulation DRewrite the information security policy to quote the regulation

Correct answer: C. Perform a gap analysis of current policies against the regulation
A gap analysis shows which policies already meet the new requirements and which need changes, so effort goes where it is needed. Drafting new policies without that step risks duplication and missed requirements. Waiting may leave too little time to comply.

Question 11Incident Management⚑ Flag

An organization plans to let its SOAR platform automatically disable user accounts when certain alerts fire. What is MOST important before enabling this?

ADefining business-approved conditions for automatic action BConfirming that the SOAR vendor offers 24-hour technical support CEnsuring every alert type triggers an automatic lockout DTraining all employees on how the SOAR platform works

Correct answer: A. Defining business-approved conditions for automatic action
Automated containment can disrupt legitimate users and business processes, so the triggering conditions must be agreed with the business first. Applying lockouts to every alert type would greatly raise the risk of disruption from false positives.

Question 12Incident Management⚑ Flag

During a regional power outage, the IT team waits hours for someone to decide whether to activate the recovery site. What should have been defined in advance?

AThe utility vendor responsible for repairing the power supply BThe people authorized to declare a disaster and invoke the plan CThe complete technical procedure for restarting each server DThe insurance coverage limits for business interruption losses

Correct answer: B. The people authorized to declare a disaster and invoke the plan
Plans should name who can declare a disaster, with alternates, so recovery starts without delay. Technical restart steps matter, but they cannot begin until someone with authority makes the call.

Question 13Information Security Risk Management⚑ Flag

A legacy manufacturing control system cannot run the company's standard endpoint protection software, and replacing it is not feasible for three years. What is the BEST risk treatment approach?

AApply compensating controls such as network segmentation BLeave the system out of the risk register until replaced CAccept the risk with no further action until replacement DInstall the software anyway and test it in production

Correct answer: A. Apply compensating controls such as network segmentation
Compensating controls such as segmentation reduce risk when the standard control cannot be used. Accepting the risk with no action may leave it above appetite when affordable alternatives exist.

Question 14Information Security Governance⚑ Flag

Crestline Corp wants to describe its desired security state in a way that management can measure and track over time. Which approach is BEST?

AState that the organization will have no security incidents in the future BList all the products the security team plans to buy over the next three years CDefine target capability levels for key processes using a maturity model DCopy the security posture of the leading competitor in the same industry

Correct answer: C. Define target capability levels for key processes using a maturity model
Maturity or capability models give clear, measurable target levels that can be compared with the current state. A product list describes tools, not the level of security capability the business needs.

Question 15Information Security Risk Management⚑ Flag

What is the MAIN limitation of qualitative risk analysis?

AIt takes far longer to complete than a fully quantitative analysis BIt requires large amounts of historical loss data before it can be used CIt cannot be used to rank risks against each other in any useful way DIts results are subjective and may vary between different assessors

Correct answer: D. Its results are subjective and may vary between different assessors
Qualitative ratings depend on the judgment of the people doing the assessment, so different assessors may rate the same risk differently. It can still rank risks, so the claim that it cannot rank them is wrong.

Question 16Information Security Program⚑ Flag

Management wants to reduce the risk of unauthorized wire transfers, where a single fraudulent payment could be very costly. Which control type should be prioritized?

ADetective controls such as monthly reconciliation reviews BCorrective controls such as insurance against payment fraud CDeterrent controls such as warning banners on payment screens DPreventive controls such as dual authorization of transfers

Correct answer: D. Preventive controls such as dual authorization of transfers
When one event can cause a major loss that is hard to reverse, stopping it before it happens is the priority. Monthly reconciliation would only find the fraud after the money is gone.

Question 17Information Security Program⚑ Flag

Over six months, the information security manager has received many exception requests to the same remote access standard from different departments. What is the BEST action?

AReview whether the standard still fits current business needs BTighten the approval criteria so that fewer exceptions are granted CEscalate to senior management to enforce the existing standard DGrant a blanket exception to every department that has asked

Correct answer: A. Review whether the standard still fits current business needs
Frequent exceptions from many areas suggest the standard may be unrealistic or outdated. Reviewing it with stakeholders can produce a standard that is both secure and workable. Tightening approval may only increase hidden noncompliance.

Question 18Incident Management⚑ Flag

A forensic analyst needs to examine a laptop seized during an investigation. What is the BEST practice?

AAnalyze the original drive directly to save time and cost BAnalyze a verified bit-for-bit image of the original drive CCopy only the user's documents folder for later analysis DBoot the laptop and browse through its files to look for evidence

Correct answer: B. Analyze a verified bit-for-bit image of the original drive
Working on a verified forensic image protects the original evidence from change and keeps it admissible. Copying only selected folders misses deleted files, logs and other artifacts that a full bit-for-bit image preserves.

Question 19Incident Management⚑ Flag

A company relies on a managed service provider to host its HR system. What is the MOST important incident readiness requirement to include in the contract?

AA requirement for the provider to run the same software as the company BA discount on monthly fees if the provider suffers a security incident CThe right to choose which provider staff are assigned to the account DDefined incident notification timeframes and cooperation in response

Correct answer: D. Defined incident notification timeframes and cooperation in response
Timely notification and cooperation let the company start its own response and meet duties such as breach reporting. A fee discount offers some compensation but does nothing to limit the impact when an incident happens.

Question 20Information Security Governance⚑ Flag

Under COBIT 2019, which activity is a governance responsibility rather than a management responsibility?

ARunning daily operations and supporting services for end users BPlanning and organizing the delivery of IT and security services CEvaluating options, setting direction and monitoring performance DBuilding and implementing the solutions defined in the IT plan

Correct answer: C. Evaluating options, setting direction and monitoring performance
COBIT separates governance, which evaluates, directs and monitors, from management, which plans, builds, runs and monitors. Planning and organizing service delivery is a management activity carried out under governance direction.

Question 21Information Security Program⚑ Flag

A proposed control would block all USB storage devices, but the design team relies on them to share large files with clients. What should the security manager do?

AWork with the design team on an approach that meets both needs BExempt the design team from the control without further review CEscalate to the CEO to force the design team to comply DImplement the block because security policy takes priority

Correct answer: A. Work with the design team on an approach that meets both needs
Controls should reduce risk without needlessly disrupting the business, so the manager should find an option such as an approved secure file transfer method. Imposing the block regardless ignores a legitimate business need and invites workarounds.

Question 22Information Security Program⚑ Flag

Who should approve the organization's information security policy?

AThe IT operations director BThe information security manager CThe board or senior management DThe internal audit department

Correct answer: C. The board or senior management
Approval by senior management shows that the policy reflects management's intent and gives it authority across the organization. The security manager drafts and maintains the policy but lacks the authority to mandate it company-wide.

Question 23Incident Management⚑ Flag

Why does a forensic investigator calculate a hash value of a disk image at the time it is acquired?

ATo prove later that the image has not been altered BTo compress the image so it uses less storage space CTo encrypt the image so unauthorized staff cannot read it DTo speed up keyword searches across the image's files

Correct answer: A. To prove later that the image has not been altered
A hash taken at acquisition can be recomputed later, and a match shows the evidence is unchanged. Hashing does not encrypt or compress data, so it offers no confidentiality or storage benefit.

Question 24Incident Management⚑ Flag

An organization is forming its incident management team. Besides IT and security staff, which function is MOST important to include for incidents involving personal data?

AInternal audit team BLegal and compliance CFacilities management DProcurement and vendor

Correct answer: B. Legal and compliance
Incidents involving personal data bring legal and regulatory duties, such as breach notification deadlines, so legal and compliance must be ready to advise. Internal audit should remain independent and review the process rather than help run it.

Question 25Information Security Risk Management⚑ Flag

A new control has just been implemented to address a high-rated risk. What should the information security manager do FIRST?

ADetermine whether the residual risk is within appetite BSchedule the next annual risk assessment for this area CReduce monitoring of the risk to free up resources DTell the auditors that the risk has now been eliminated

Correct answer: A. Determine whether the residual risk is within appetite
Treatment is complete only when the remaining risk is at a level the organization accepts. Telling auditors the risk is gone ignores residual risk and assumes the control works as intended.

Question 26Information Security Risk Management⚑ Flag

An information security manager is evaluating several threat intelligence sources. Which characteristic MOST determines the value of a source to the organization?

AThe market reputation and size of the vendor providing the service BIts ability to integrate with every security tool already deployed CIts relevance to the organization's industry, technology and assets DThe total volume of indicators of compromise it delivers each day

Correct answer: C. Its relevance to the organization's industry, technology and assets
Intelligence is useful only when it is relevant and actionable for the organization's own sector, technology and assets. A high volume of indicators is tempting, but irrelevant data creates noise and wastes analyst time.

Question 27Information Security Governance⚑ Flag

Because the security team is understaffed, the CFO suggests that internal audit design and implement the new access control process. What is the MAIN concern?

AInternal audit does not have authority over IT systems and IT staff BInternal audit would lose independence when auditing the same process CInternal audit staff may not have enough technical skills for the task DThe new process would take longer to finish than if security led it

Correct answer: B. Internal audit would lose independence when auditing the same process
Auditors who design a control cannot objectively audit it later, so their independence is impaired. Skill gaps can be addressed with training, but loss of independence undermines the value of assurance.

Question 28Information Security Program⚑ Flag

Which situation MOST justifies continuous automated monitoring of a control instead of periodic testing?

AThe control was recently reviewed and passed by the internal audit team BThe control is manual and is performed only once each year CThe control owner has asked for less audit involvement overall DThe control protects a high-risk process with frequent transactions

Correct answer: D. The control protects a high-risk process with frequent transactions
Continuous monitoring is most valuable where risk is high and activity is frequent, so failures must be caught quickly. An annual manual control does not generate enough activity to benefit from continuous automated checks.

Question 29Information Security Program⚑ Flag

An information security policy was approved four years ago and has not been reviewed since, although the company has moved most services to the cloud. What is the MOST significant risk?

AThe policy may not address the current risk environment BEmployees may not remember the exact wording of the policy CThe policy may not follow the current corporate document template DAuditors may note that the approval signatures are out of date

Correct answer: A. The policy may not address the current risk environment
Policies must be reviewed periodically and after major changes so they keep matching business operations and risks. An outdated policy may leave new risks, such as cloud use, without direction. An audit note on old signatures is a symptom, not the main risk.

Question 30Incident Management⚑ Flag

An incident handler realizes an incident involves possible theft of regulated data, which exceeds the authority defined for their role. What should the handler do?

AContact the regulator directly to report the data theft BEscalate it according to the defined escalation procedure CContinue handling the incident to avoid slowing the response DClose the ticket and open a new one at a higher priority

Correct answer: B. Escalate it according to the defined escalation procedure
Escalation procedures make sure incidents reach people with the right authority and resources when severity rises. Contacting the regulator directly bypasses the legal and management review that notification decisions require.

Question 31Incident Management⚑ Flag

A small company with limited security staff wants to be able to handle a serious breach. What is the MOST effective readiness measure?

ASet up a retainer with a qualified incident response firm in advance BTrain the help desk team to perform full digital forensic investigations CSearch for a suitable incident response firm once a breach occurs DRely on the cyber insurance provider to manage any breach response

Correct answer: A. Set up a retainer with a qualified incident response firm in advance
A pre-arranged retainer gives fast access to skilled responders on agreed terms, avoiding delays during a crisis. Searching for a firm after a breach wastes critical time on contracts and onboarding.

Question 32Information Security Governance⚑ Flag

Westfield Retail plans to move customer records from its home country to a cloud provider's data center in another region. What should the security manager consider FIRST?

AThe cloud provider's uptime record over the past twelve months of service BThe encryption strength the cloud provider uses for data stored at rest CThe cost savings the move will deliver compared with on-premises hosting DLegal and regulatory limits on transferring personal data across borders

Correct answer: D. Legal and regulatory limits on transferring personal data across borders
Cross-border transfer laws may restrict or forbid the move, so they must be checked before anything else. Encryption is an important control, but it does not by itself make an unlawful transfer legal.

Question 33Information Security Program⚑ Flag

Control testing shows that one team regularly bypasses the change approval control. What should the security manager do FIRST?

ADetermine why the team is bypassing the control BRemove the team's access to production systems CReport the team to human resources for discipline DReplace the control with an automated technical block

Correct answer: A. Determine why the team is bypassing the control
Understanding the root cause, such as a slow process or unclear requirements, allows a fix that will last. Removing access or disciplining staff may be needed later, but it treats symptoms without knowing why the bypass happens.

Question 34Information Security Program⚑ Flag

A global policy requires keeping access logs for two years, but a subsidiary operates in a country whose law limits retention of such data to six months. What should the information security manager do?

AApply the global policy since senior management has approved it BMove the subsidiary's logs to a country without retention limits CDocument an approved local variation so the subsidiary obeys its law DAsk the subsidiary to stop collecting access logs altogether

Correct answer: C. Document an approved local variation so the subsidiary obeys its law
Legal requirements take precedence, so the policy should allow a documented, approved local variation. This keeps the subsidiary lawful while the rest of the policy stays intact. Moving logs abroad to avoid the law can create further legal exposure.

Question 35Information Security Risk Management⚑ Flag

A development team requests an exception to the password policy for a customer-facing application so it can meet a launch date. What is the MOST important condition for approving the exception?

AThe business owner accepts the risk for a set time period BThe development manager confirms in writing the risk is low CThe help desk logs the exception for future tracking DA penetration test is scheduled after the launch date

Correct answer: A. The business owner accepts the risk for a set time period
An exception is a form of risk acceptance, so the business owner must accept the risk, and the exception should expire. The development manager's view alone does not carry proper acceptance authority.

Question 36Information Security Risk Management⚑ Flag

A newly disclosed vulnerability with a CVSS base score of 9.8 affects a server that sits on an isolated segment with no inbound network access. How should the information security manager rate the risk from this vulnerability?

AAs critical, because the base score is the industry measure of risk BAs low, because no isolated system can ever be exploited by attackers CBased on the vendor's patch release date and the age of the server DBased on exploitability in this setting and the asset's importance

Correct answer: D. Based on exploitability in this setting and the asset's importance
Risk depends on the organization's context, including whether an attacker can reach the system and how important it is to the business. Rating it as critical purely from the base score ignores the isolation that sharply reduces likelihood.

Question 37Incident Management⚑ Flag

Analysts confirm that an attacker is using a stolen domain administrator account. What is the BEST containment action?

AMonitor the account for a week to learn the attacker's goals BReset the account credentials and end all active sessions CDelete the account and create a new one with the same rights DEmail all staff and ask them to change their own passwords

Correct answer: B. Reset the account credentials and end all active sessions
Resetting credentials and ending active sessions removes the attacker's current access with the least disruption. Deleting the account destroys useful evidence and audit history without being more effective than a reset.

Question 38Information Security Governance⚑ Flag

The sales team at Ironbridge Software signed a customer contract that commits the company to security controls it does not currently have. What is the BEST long-term solution?

AAsk the customer to remove the security clauses from the signed contract BTrain the sales team on the main security standards the company follows CRequire security review of security clauses before contracts are signed DImplement the missing controls quickly to meet the new contract terms

Correct answer: C. Require security review of security clauses before contracts are signed
A pre-signing review makes sure the company only promises what it can deliver, which fixes the root cause. Rushing to add controls deals with this one contract but leaves the process gap open.

Question 39Incident Management⚑ Flag

A hospital has introduced a new patient monitoring platform that is critical to care. Which part of the incident management program should be updated?

AThe firewall rule base at the network perimeter BThe incident severity and classification criteria CThe yearly security awareness slide presentation DThe fixed asset depreciation schedule for finance

Correct answer: B. The incident severity and classification criteria
Severity criteria must reflect the systems that matter most, so a new critical platform should be built into classification and escalation rules. Firewall changes may help protect it, but they do not ensure incidents affecting it are rated correctly.

Question 40Information Security Program⚑ Flag

Before an external penetration test of customer-facing systems begins, what is MOST important?

AConfirmation that the testers hold an industry certification BNotification to all employees that testing is about to begin CA complete inventory of every open port on the network DManagement approval of the scope and rules of engagement

Correct answer: D. Management approval of the scope and rules of engagement
Formal approval of scope and rules of engagement protects both the organization and the testers and keeps business impact under control. Tester certifications are useful, but testing without authorized scope could disrupt services or even be unlawful.

Question 41Information Security Program⚑ Flag

An internal review finds that staff in the finance department routinely ignore the clean desk standard. What should the information security manager do FIRST?

ARecommend disciplinary action for the employees involved BDetermine why staff are not following the standard CAsk facilities to install locked cabinets at every desk DSchedule mandatory refresher sessions for the department

Correct answer: B. Determine why staff are not following the standard
Understanding the root cause, such as lack of storage or unclear rules, points to the right fix. Discipline or refresher sessions may not help if the standard is impractical. Acting before knowing the cause can waste resources.

Question 42Incident Management⚑ Flag

Legal counsel asks the security team to leave a compromised server running so investigators can gather more evidence about the attacker. What should the information security manager do FIRST?

ARefuse the request and contain the server immediately BAgree, since legal counsel has final authority over all evidence CPresent the risks of delay to senior management for a decision DDelay containment but disable logging to protect data

Correct answer: C. Present the risks of delay to senior management for a decision
Leaving an attacker active increases the risk of further damage, so senior management should decide whether to accept that risk for the business. Refusing outright ignores a valid legal need, while agreeing without escalation accepts risk the security team cannot own.

Question 43Information Security Governance⚑ Flag

A global conglomerate with highly autonomous business units is choosing between a centralized and a decentralized security organization. What is the MAIN advantage of the decentralized model?

ABetter responsiveness to the specific needs of each business unit BStronger central control over security budgets and investment choices CMore consistent application of policies and standards across all units DLower overall cost because security tools and staff are shared by all

Correct answer: A. Better responsiveness to the specific needs of each business unit
Decentralized security staff sit closer to each business unit and can respond to its specific needs. Consistency and economies of scale are typical advantages of a centralized model, not a decentralized one.

Question 44Incident Management⚑ Flag

How does a simulation test differ from a tabletop exercise?

AA simulation shuts down production systems to prove full recovery BA simulation is cheaper and far less disruptive than a tabletop exercise CA simulation is run only by external auditors with no staff involved DParticipants carry out response actions instead of only discussing them

Correct answer: D. Participants carry out response actions instead of only discussing them
In a simulation, participants perform response actions in a realistic scenario, while a tabletop is a discussion of what they would do. Neither shuts down production, which is what a full interruption test does.

Question 45Information Security Risk Management⚑ Flag

The information security manager is reviewing a risk treatment plan for several high risks. Which element is MOST important to make sure the plan is carried out?

ANamed owners and target dates for each treatment action BDetailed technical specifications for each planned control CA summary of industry breach statistics for each risk DReferences to the frameworks each control maps to

Correct answer: A. Named owners and target dates for each treatment action
Accountable owners and deadlines make progress trackable and give management someone to hold responsible. Technical specifications help with design but do not ensure the actions get done.

Question 46Information Security Program⚑ Flag

A review finds that new employees receive system access weeks before completing security awareness training. What is the BEST solution?

AAsk line managers to explain the security rules informally BDelay all system access until the next annual training cycle CMake awareness training part of the onboarding process DEmail new hires a copy of the security policy on their first day

Correct answer: C. Make awareness training part of the onboarding process
Building awareness training into onboarding ensures new staff learn key rules before or as they receive access. Emailing the policy alone does not ensure it is read or understood.

Question 47Information Security Risk Management⚑ Flag

During a risk assessment, who is BEST positioned to determine the value and criticality of a sales information system?

AThe internal auditor who most recently reviewed the system controls BThe IT manager who operates and maintains the system infrastructure CThe information security manager who leads the risk assessment DThe business owner who relies on the system to meet sales goals

Correct answer: D. The business owner who relies on the system to meet sales goals
The business owner understands how the system supports objectives and what its loss would cost, so they are best placed to value it. The IT manager knows the technology well but not the full business consequence of its compromise.

Question 48Information Security Program⚑ Flag

Business units resist a new information security policy, saying it was written without their input and disrupts operations. What would MOST likely have prevented this?

AHaving the policy approved directly by the chief executive BPublishing the policy with a longer implementation timeline CIncluding stronger penalties for noncompliance in the policy DInvolving key business stakeholders while drafting the policy

Correct answer: D. Involving key business stakeholders while drafting the policy
Involving stakeholders early builds support and surfaces operational concerns before the policy is final. Executive approval is necessary, but on its own it does not make the policy practical or accepted.

Question 49Incident Management⚑ Flag

A compromised web server hosts the company's main online store, and taking it offline would stop all sales. What should the information security manager do FIRST?

AMove the store to a backup server without telling anyone BReview containment options and impact with the business owner CTake the server offline immediately to stop the attack spreading DLeave the server running until the end of the sales quarter

Correct answer: B. Review containment options and impact with the business owner
Containment that stops revenue must weigh business impact, so the business owner should help choose among options such as partial isolation or traffic filtering. Taking the server offline without that input may cause more harm than the attack itself.

Question 50Information Security Governance⚑ Flag

Staff at Lakeshore Systems often ignore security rules, saying leadership does not follow them either. Which action would MOST effectively improve the security culture?

AIncrease the number of mandatory awareness sessions for all employees BIntroduce stricter technical controls that block policy violations CHave senior leaders visibly follow and promote the security policies DPublish the names of employees who repeatedly break security rules

Correct answer: C. Have senior leaders visibly follow and promote the security policies
Culture is shaped by the tone at the top, so leaders who visibly follow the rules change behavior across the organization. More training will have little effect while employees see leaders ignoring the same rules.

Question 51Information Security Program⚑ Flag

When planning next year's security awareness program, what should MOST influence the topics selected?

AThe same topics as last year to keep the program content consistent BThe topics offered in a popular training vendor's catalog CThe subjects employees rated as most interesting last year DCurrent threats and incident trends affecting the organization

Correct answer: D. Current threats and incident trends affecting the organization
Awareness content should target the behaviors and threats that pose real risk to the organization now. Vendor catalogs are convenient, but generic topics may miss the issues most likely to cause harm.

Question 52Incident Management⚑ Flag

A bank wants to verify that its recovery site can process real transactions without interrupting production. Which test BEST meets this goal?

AFull interruption test BStructured walkthrough CParallel recovery test DTabletop exercise

Correct answer: C. Parallel recovery test
A parallel test brings the recovery site online and processes data alongside production, proving capability without stopping the primary site. A full interruption test would prove the same thing but puts live operations at risk.

Question 53Information Security Program⚑ Flag

Who should accept the risk when an exception to a security standard is granted for a business application?

AThe internal auditor responsible for the area BThe business owner of the application CThe information security manager who reviewed it DThe IT manager who supports the application

Correct answer: B. The business owner of the application
The business owner is accountable for the application and its risks, so the owner should formally accept the residual risk. The security manager advises on the risk but should not accept it on behalf of the business.

Question 54Information Security Risk Management⚑ Flag

The information security manager learns that a regional manager accepted a high risk that, under the company's acceptance policy, requires executive approval. What should the security manager do?

ALower the risk rating to match the manager's authority BTreat the acceptance as valid since it is documented CEscalate the acceptance to the correct approval level DRevoke the acceptance and order the activity stopped

Correct answer: C. Escalate the acceptance to the correct approval level
An acceptance is valid only when made by someone with authority for that level of risk, so it must go to the right executive. Revoking it and stopping the activity goes beyond the security manager's role and ignores the business need.

Question 55Information Security Governance⚑ Flag

Sterling Financial has just acquired a smaller competitor with different systems and practices. What should the security manager do FIRST regarding the security strategy?

AReassess the strategy against the combined business objectives and risk profile BApply the acquirer's existing controls to all of the acquired company's systems CKeep both security programs separate until the next annual planning cycle DCommission a penetration test of the acquired company's internet-facing systems

Correct answer: A. Reassess the strategy against the combined business objectives and risk profile
An acquisition changes business objectives, assets and risk, so the strategy must be reviewed against the new situation. Applying existing controls everywhere may not fit the combined risk profile or the acquired business.

Question 56Information Security Risk Management⚑ Flag

Why should an information security manager assess inherent risk in addition to residual risk?

ATo remove the need to test whether existing controls are effective BTo show how much exposure would exist if key controls were to fail CTo calculate the exact cost of each control within the current budget DTo meet the rule that every risk record must contain two risk values

Correct answer: B. To show how much exposure would exist if key controls were to fail
Comparing inherent and residual risk shows how much protection existing controls provide and where a control failure would cause the biggest exposure. This helps decide which controls need the most assurance, which the other options do not address.

Question 57Incident Management⚑ Flag

During an ongoing investigation into suspected insider fraud, how should information about the incident be shared internally?

AOnly with staff who have a need to know BThrough regular updates on the intranet CCompany-wide, to show full transparency DWith all managers in affected departments

Correct answer: A. Only with staff who have a need to know
Limiting details to those who need them protects the investigation, the evidence and the privacy of the people involved. Sharing with all department managers widens the circle and raises the chance the suspect is alerted or rumors spread.

Question 58Information Security Program⚑ Flag

A small group of employees repeatedly fails phishing simulations. What is the BEST next step?

ASuspend their email access until they pass a simulation BStop running simulations to avoid lowering staff morale CProvide targeted follow-up coaching for those employees DPublish the employees' names to encourage improvement

Correct answer: C. Provide targeted follow-up coaching for those employees
Targeted coaching addresses the specific gaps of the people most at risk while keeping the program supportive. Naming or punishing staff tends to discourage reporting and damage trust in the security team.

Question 59Incident Management⚑ Flag

In ISACA terms, what does maximum tolerable outage (MTO) represent?

AThe time the IT team needs to restore a system from backup BThe amount of data the business can afford to lose in an outage CThe average system downtime experienced over the past year DThe longest time the business can operate in alternate mode

Correct answer: D. The longest time the business can operate in alternate mode
ISACA defines MTO as the maximum time the organization can support processing in alternate mode before facing unacceptable consequences. The time IT needs to restore a system is a capability, not a business tolerance.

Question 60Information Security Program⚑ Flag

A time-limited exception for an unsupported operating system has expired, but the system is still in use. What should the information security manager do FIRST?

AHave the system shut down until it is upgraded BExtend the exception automatically for a year CRecord the issue as an audit finding for follow-up DReassess the risk with the business owner

Correct answer: D. Reassess the risk with the business owner
An expired exception means the earlier risk acceptance no longer applies, so the risk must be reviewed again. The owner can then decide to remediate, add compensating controls or renew the acceptance. Shutting down the system may disrupt critical work without a risk-based decision.

Question 61Information Security Governance⚑ Flag

A company plans to store customer records with a cloud provider whose data centers are in several countries. Which concern should the information security manager raise FIRST with legal and business leaders?

AData sovereignty and the laws that apply where the data is stored BThe provider's uptime figures for the past twelve months CWhether the provider uses the same firewall brand as the company DHow quickly the provider can add new storage capacity

Correct answer: A. Data sovereignty and the laws that apply where the data is stored
Where data is stored decides which laws apply, which can affect compliance, privacy obligations and government access, so it must be settled before the contract. Uptime and capacity matter, but they do not create legal exposure the way data location can.

Question 62Incident Management⚑ Flag

A ransomware group demands payment to unlock critical systems. What is the information security manager's PRIMARY role in the payment decision?

ARefuse to discuss payment because it is never permitted BGive senior management the recovery options and their risks CNegotiate the ransom amount directly with the attackers DApprove or reject payment based on the expected cost of recovery

Correct answer: B. Give senior management the recovery options and their risks
Paying a ransom has legal, ethical and business consequences, so senior management makes that call, informed by the security manager's facts on recovery options, timelines and risks. Approving or rejecting payment alone would exceed the manager's authority.

Question 63Information Security Program⚑ Flag

A development team uses agile methods and releases every two weeks. How can security BEST be integrated into its work?

ARequire a security sign-off meeting before every release BRestrict releases to once per quarter to allow full testing CPerform a full security review of the product once a year DBuild automated security tests and reviews into each sprint

Correct answer: D. Build automated security tests and reviews into each sprint
Automated security checks in each sprint keep pace with fast delivery and catch issues early. A manual sign-off meeting before every release would create a bottleneck and push teams to work around security.

Question 64Information Security Risk Management⚑ Flag

Two years ago, a business owner accepted the risk of storing customer data in a region with weak privacy laws. A new regulation now imposes large fines for this practice. What should the information security manager do?

ALeave the acceptance in place until its next scheduled review BMove the data to a compliant region right away CAsk the business owner to re-evaluate the risk acceptance DReport the business owner to the compliance department

Correct answer: C. Ask the business owner to re-evaluate the risk acceptance
A major change in impact means the earlier acceptance may no longer fit within appetite, so the owner should review it now. Waiting for the scheduled review leaves the company exposed to fines in the meantime.

Question 65Incident Management⚑ Flag

When setting the RTO for a key system, the information security manager compares downtime costs with recovery costs. Where is the optimal RTO usually found?

AAt the shortest possible recovery time, regardless of cost BWhere the combined downtime and recovery costs are lowest CAt the point where recovery costs reach their highest level DAt the longest recovery time that industry regulators allow

Correct answer: B. Where the combined downtime and recovery costs are lowest
Downtime costs rise the longer a system is down, while recovery costs rise as the RTO gets shorter, so the best RTO balances the two. Choosing the shortest possible time regardless of cost overspends on recovery capability.

Question 66Information Security Risk Management⚑ Flag

A draft list of risk scenarios contains the entry 'Cyberattacks could harm the company.' Why is this scenario of limited value for risk analysis?

AIt does not name the specific control that would prevent the attack BIt has not yet been approved by the board's audit and risk committee CIt lacks a defined threat actor, event, affected asset and consequence DIt focuses on external threats and leaves out accidental internal errors

Correct answer: C. It lacks a defined threat actor, event, affected asset and consequence
A useful scenario describes who or what causes an event, which asset is affected and what the business impact would be, so that likelihood and impact can be estimated. Naming a control is a response matter and does not make the scenario analyzable.

Question 67Information Security Program⚑ Flag

A standard requires that user access to the payroll system be reviewed every quarter. Which document should describe, step by step, how administrators perform the review?

AA procedure BA baseline CA guideline DA policy

Correct answer: A. A procedure
Procedures give the detailed, step-by-step instructions used to carry out a standard. Guidelines offer optional advice, and policies state high-level intent. A baseline sets a minimum configuration, not the steps of a process.

Question 68Information Security Governance⚑ Flag

Which event should MOST likely trigger an out-of-cycle review of the information security policy?

AThe arrival of a new team member in the information security department BA major change in business strategy or the regulatory environment CThe release of a new version of the main firewall operating system DA minor incident that was contained by existing procedures and tools

Correct answer: B. A major change in business strategy or the regulatory environment
Policies reflect business direction and obligations, so major business or regulatory changes call for a review. A new firewall version affects standards or procedures, not high-level policy.

Question 69Incident Management⚑ Flag

An employee posts on social media that the company has been hacked, and the post spreads quickly while the incident is still being investigated. What is the BEST response?

AIssue a brief approved holding statement while facts are checked BIgnore the post until the investigation has been completed CHave the security team reply to all comments with technical facts DPublish a statement denying that any incident has occurred

Correct answer: A. Issue a brief approved holding statement while facts are checked
A short, approved holding statement keeps the message accurate and consistent while the facts are confirmed. Ignoring the post lets rumors shape public opinion, and a denial could badly hurt credibility later.

Question 70Information Security Program⚑ Flag

A new customer portal passed functional testing, but no security testing was done. The business wants to go live tomorrow. What should the security manager do?

AApprove the go-live because functional testing was passed BRun a quick vulnerability scan and approve if it looks clean CInform the business owner of the risk so they can decide DBlock the go-live until a full security test is completed

Correct answer: C. Inform the business owner of the risk so they can decide
The business owner is accountable for the risk and needs clear information about launching without security testing. Blocking the launch on its own authority oversteps the security manager's role, which is to advise and enable an informed risk decision.

Question 71Incident Management⚑ Flag

A retailer's BIA states that during an outage, its online store must still handle at least 60 percent of normal order volume. What is this requirement called?

AMaximum tolerable outage BService delivery objective CAllowable interruption window DRecovery point objective

Correct answer: B. Service delivery objective
The service delivery objective is the level of service that must be provided in alternate mode until normal operations resume. RPO concerns how much data can be lost, not the level of service the business must keep up.

Question 72Information Security Program⚑ Flag

When developing a new set of security standards, the information security manager should ensure that the standards PRIMARILY:

Aare identical to those of a leading industry framework. Bcan be enforced through automated technical controls. Cmatch the default settings of the technologies in use. Dsupport the intent of the approved security policy.

Correct answer: D. support the intent of the approved security policy.
Standards turn policy into specific, measurable requirements, so they must be consistent with policy intent. Vendor defaults or framework text may not reflect the organization's policy or risk. Automation helps enforcement but is not the main test of a standard.

Question 73Information Security Governance⚑ Flag

Which type of security document provides recommended practices that staff are encouraged, but not required, to follow?

AGuidelines BPolicies CStandards DProcedures

Correct answer: A. Guidelines
Guidelines give advice and recommended practices that are not mandatory. Procedures are step-by-step instructions that staff must follow to carry out a task.

Question 74Information Security Risk Management⚑ Flag

A business owner is deciding how to treat a significant risk to a key application. What is the information security manager's PRIMARY role in this decision?

AApprove the owner's decision before it is documented BProvide risk analysis and options so the owner can decide CMake the final treatment decision on the business owner's behalf DPick the lowest-cost control and implement it directly

Correct answer: B. Provide risk analysis and options so the owner can decide
The business owner is accountable for the risk, so the security manager supports the decision with analysis and recommendations. Making the decision for the owner moves accountability to the wrong person.

Question 75Information Security Risk Management⚑ Flag

Five business units each rate their risk from running an unsupported operating system as low. The information security manager notices that all five rely on the same unsupported version. What should the manager do?

AKeep the ratings, because each unit understands its own environment best BAsk each unit to raise its rating to high to make the issue more visible CUpgrade the operating system for all units before reassessing the risk DAssess the combined risk, since the shared weakness may be significant

Correct answer: D. Assess the combined risk, since the shared weakness may be significant
Risks that look minor in isolation can add up to a significant exposure when they share a common weakness, so the manager should assess them in aggregate. Keeping the individual ratings ignores the chance that one exploit could hit all five units at once.

Question 76Information Security Program⚑ Flag

Why should the information security function be represented on the change advisory board?

ATo approve every change before IT operations may proceed BTo ensure security tools are updated as part of each change CTo take over ownership of all high-risk change requests DTo assess whether proposed changes affect the security posture

Correct answer: D. To assess whether proposed changes affect the security posture
Security representation helps identify changes that could weaken controls or add new risk before they are approved. Requiring security approval for every change would slow operations and is not the purpose of taking part.

Question 77Incident Management⚑ Flag

During eradication, analysts discover a kernel-level rootkit on a critical server. What is the MOST reliable way to remove the threat?

ARebuild the server from trusted, known-good media BDelete the rootkit files that analysts have identified CApply the latest operating system patches to the server DRun several different antivirus tools to remove it

Correct answer: A. Rebuild the server from trusted, known-good media
Rootkits hide deeply and can survive cleaning attempts, so rebuilding from trusted media is the only way to be confident the system is clean. Antivirus tools may miss components that a compromised kernel hides from them.

Question 78Information Security Governance⚑ Flag

Horizon Media wants to adopt a governance framework for its security program. Which approach is BEST?

AChoose the framework that most of the company's competitors are already using BChoose the framework that needs the least effort to implement and maintain CTailor the framework to the organization's business needs, risks and culture DAdopt every control in the framework exactly as written to ensure completeness

Correct answer: C. Tailor the framework to the organization's business needs, risks and culture
Frameworks are most useful when adapted to the organization's goals, risk profile and culture. Adopting every control as written can waste resources on controls that do not address real risks.

Question 79Information Security Program⚑ Flag

A company must comply with three regulations and one industry standard, and business units complain about repeated, overlapping security assessments. What is the BEST approach?

AMap all requirements to a single set of common controls BAssign a separate compliance team to each requirement CFocus only on the regulation with the highest penalties DLimit assessments to once every two years for all units

Correct answer: A. Map all requirements to a single set of common controls
A common control set lets one control satisfy several requirements, which cuts duplicate testing and cost. Separate teams per requirement increase the overlap the business is complaining about. Focusing on one regulation leaves the others unmet.

Question 80Incident Management⚑ Flag

Which concept describes how long an organization can wait between a failure and the restoration of critical services before losses become unacceptable?

ARecovery point objective BAllowable interruption window CService delivery objective DMean time between system failures

Correct answer: B. Allowable interruption window
The allowable interruption window is the maximum time from failure to restoration of critical services before losses become unaffordable. RPO measures how much data can be lost, not how long services can be down.

Question 81Information Security Program⚑ Flag

Servers are often found with settings that differ from the approved security baseline. What is the BEST long-term solution?

ARebuild every server from scratch on a yearly basis BTie baseline enforcement to configuration and change management CIncrease penalties for administrators who change approved settings DConduct a manual audit of all servers every six months

Correct answer: B. Tie baseline enforcement to configuration and change management
Linking baselines to configuration and change management keeps approved settings in place and flags unauthorized drift. Periodic manual audits only find deviations long after they occur.

Question 82Incident Management⚑ Flag

Systems have been restored after a breach and returned to production. What should the security team do NEXT?

ARemove the temporary firewall rules added for containment BDelete the forensic images to free up storage space CIncrease monitoring for signs the attacker has returned DClose the incident ticket and return to normal duties

Correct answer: C. Increase monitoring for signs the attacker has returned
Attackers often try to regain access, so heightened monitoring after recovery confirms that eradication worked. Closing the incident right away removes that check, and deleting evidence may break legal or retention requirements.

Question 83Information Security Governance⚑ Flag

During an ISO/IEC 27001 certification audit, the auditor asks for the document that lists the necessary controls and justifies any exclusions. Which document is this?

AThe risk register BThe Statement of Applicability CThe information security policy DThe risk treatment plan

Correct answer: B. The Statement of Applicability
The Statement of Applicability lists the necessary controls, whether they are implemented, and why any Annex A controls are excluded. The risk treatment plan describes how risks will be treated, but it is not the record of control inclusions and exclusions.

Question 84Information Security Program⚑ Flag

After selecting a security framework for the program, what should the information security manager do NEXT?

APurchase tools that cover each control family in the framework BRewrite all existing policies using the framework's terminology CSchedule a certification audit against the chosen framework DAssess the program's current state against the framework

Correct answer: D. Assess the program's current state against the framework
A current-state assessment shows where the program meets the framework and where gaps exist, which forms the basis for a prioritized roadmap. Buying tools or rewriting policies first may spend effort on areas that are already adequate.

Question 85Information Security Risk Management⚑ Flag

When is it MOST appropriate to remove a risk from the active risk register?

AWhen the related business activity or asset is retired BWhen a control is implemented that reduces the risk CWhen the assigned risk owner leaves the organization DWhen the risk has not caused an incident for a year

Correct answer: A. When the related business activity or asset is retired
A risk no longer applies once the activity or asset that creates it is gone. A new control lowers the risk but leaves residual risk that still needs tracking.

Question 86Incident Management⚑ Flag

How often should incident response and recovery plans be tested?

AOnce at initial approval, with no further tests unless an incident occurs BEvery week, using full interruption tests on live production systems CAt least annually and after significant business or technology changes DOnly when an external auditor asks for evidence that testing took place

Correct answer: C. At least annually and after significant business or technology changes
Regular testing, at least yearly and after major changes, keeps the plans accurate and staff ready. Testing only when auditors ask treats testing as a compliance task rather than a way to confirm readiness.

Question 87Information Security Risk Management⚑ Flag

What is the PRIMARY purpose of a control gap analysis performed during a risk assessment?

ATo identify where current controls fall short of the required state BTo produce a list of security products the organization should buy CTo compare the security budget with that of similar organizations DTo confirm that every control is described in a written procedure

Correct answer: A. To identify where current controls fall short of the required state
A gap analysis compares existing controls against the desired or required state so that deficiencies, and the risk they leave, can be identified. Producing a purchase list is tempting, but many gaps are closed through process changes rather than new products.

Question 88Information Security Program⚑ Flag

A business unit bought a SaaS tool that stores customer data using a corporate credit card, bypassing procurement. What should the security manager do FIRST?

AOrder the business unit to cancel the subscription at once BReport the purchase to internal audit as a policy violation CAdd the tool to the approved software list retroactively DAssess the risk of the tool and the data it now holds

Correct answer: D. Assess the risk of the tool and the data it now holds
The immediate concern is the risk to customer data, so the tool must be assessed to decide on the right treatment. Cancelling at once may be the end result, but doing it without assessment could disrupt the business and lose track of where the data went.

Question 89Incident Management⚑ Flag

After a widespread malware outage, many systems need to be restored. How should the order of recovery be decided?

ABy the business priorities set for critical services BBy the order in which the systems originally failed CBy restoring the quickest systems to rebuild first DBy letting each department choose its own restore timing

Correct answer: A. By the business priorities set for critical services
Recovery should follow agreed business priorities so the most critical services return first. Restoring the easiest systems first may look like progress while critical business functions stay down.

Question 90Information Security Governance⚑ Flag

A security manager using the NIST Cybersecurity Framework wants to document where the organization is today and where it wants to be. Which CSF component is designed for this?

AInformative References BCore Functions and Categories CCurrent and Target Profiles DImplementation Tiers

Correct answer: C. Current and Target Profiles
CSF Profiles describe current and target outcomes, and comparing them shows the gaps to address. Implementation Tiers describe how rigorous risk management practices are, not the specific gap between today and the goal.

Question 91Information Security Program⚑ Flag

What is the PRIMARY benefit of building an information security program on a recognized framework?

AIt means senior management no longer needs to be involved BIt ensures compliance with all applicable laws and regulations CIt removes the need for organization-specific risk assessments DIt gives a proven structure that helps cover all key areas

Correct answer: D. It gives a proven structure that helps cover all key areas
A recognized framework offers a tested structure that helps ensure no major area is overlooked. It does not guarantee legal compliance, and it still needs to be tailored through the organization's own risk assessment.

Question 92Incident Management⚑ Flag

While planning a recovery test, the information security manager learns the test could affect month-end financial processing. What is the BEST course of action?

AProceed as planned because recovery testing is required by policy BCancel all recovery testing for the remainder of the financial year CRun the test without telling finance so the results stay realistic DAgree a new date or scope with business owners to limit the impact

Correct answer: D. Agree a new date or scope with business owners to limit the impact
Testing should confirm readiness without causing the very disruption the plans exist to prevent, so timing and scope should be agreed with the business. Cancelling all testing removes the assurance that the plans will work.

Question 93Information Security Program⚑ Flag

The company has more than 400 vendors but limited staff to review them. What is the BEST approach to vendor security reviews?

AReview every vendor with the same detailed questionnaire BTier vendors by risk and review the highest tiers in depth CReview only the vendors with the largest annual spend DRely on vendors to report any security issues themselves

Correct answer: B. Tier vendors by risk and review the highest tiers in depth
Risk-based tiering focuses limited effort on vendors that handle sensitive data or support critical services. Spend is not a reliable risk indicator, since a low-cost vendor may still hold highly sensitive data.

Question 94Incident Management⚑ Flag

IT has restored a compromised payroll application after eradication. Before it returns to full production use, what should happen?

AAll payroll staff complete new awareness training first BThe security team publishes a report on the root cause CThe business owner confirms that it works as expected DThe vendor certifies the application has no weaknesses

Correct answer: C. The business owner confirms that it works as expected
The business owner should confirm that functions and data are correct before the system goes back into normal use. A vendor cannot certify that software has no weaknesses, and the incident report can follow after recovery.

Question 95Information Security Risk Management⚑ Flag

A company's risk appetite statement says it has low appetite for service disruption. Operations then sets a limit of no more than four hours of unplanned outage per quarter. This limit is BEST described as a:

AMaximum risk capacity level BRisk tolerance threshold CResidual risk rating DInherent risk score

Correct answer: B. Risk tolerance threshold
Tolerance turns the broad appetite statement into a measurable limit on acceptable variation for a specific objective. Risk capacity is the most loss the organization could absorb before failing, which depends on its resources rather than an operating limit.

Question 96Information Security Governance⚑ Flag

The approved roadmap at Brightwater Beverages depends on cloud security skills the current team does not have. What should the security manager do FIRST?

AHand all cloud security responsibilities to the cloud service provider BAsk the business to pause its cloud adoption plans until next year CAssess the skills gap and plan training, hiring or outsourcing options DDelay the cloud initiatives until the team learns the skills on its own

Correct answer: C. Assess the skills gap and plan training, hiring or outsourcing options
Resource planning starts by understanding the gap and choosing the most cost-effective way to fill it. Handing everything to the provider ignores the shared responsibility model and leaves the company accountable for any gaps.

Question 97Information Security Risk Management⚑ Flag

The board asks how advances in quantum computing could affect the company, which stores customer data that must stay confidential for 20 years. What should the information security manager do FIRST?

AWait until quantum computers can break current algorithms in practice BIdentify long-lived sensitive data and the cryptography protecting it CTell the board the threat is theoretical and does not need attention yet DReplace all current encryption with post-quantum algorithms right away

Correct answer: B. Identify long-lived sensitive data and the cryptography protecting it
Data with long confidentiality needs can be captured now and decrypted later, so the first step is to inventory that data and its cryptographic dependencies to assess exposure. Replacing all encryption at once is premature without knowing where the risk actually sits.

Question 98Information Security Program⚑ Flag

What is the MOST important characteristic of an information security metric?

AIt is reported to stakeholders at least once a month BIt is collected automatically from security tools CIt supports decisions by the people who receive it DIt can be compared directly with industry benchmarks

Correct answer: C. It supports decisions by the people who receive it
A metric is valuable when it helps its audience make or confirm decisions. Automated collection lowers cost, but an easily gathered metric that drives no action is of little use.

Question 99Incident Management⚑ Flag

An incident response plan is stored only on a file server in the primary data center. What is the MAIN risk of this arrangement?

AThe plan may be unreachable during the incident it is meant to address BVersion control of the plan document may become difficult to maintain CEmployees may read the plan and learn about existing security weaknesses DThe file server may run out of storage space as the plan grows over time

Correct answer: A. The plan may be unreachable during the incident it is meant to address
If the data center or network is down, a plan stored only there cannot be reached when it is most needed, so secure copies should be kept in alternate locations. Access to the plan should be controlled, but being unable to reach it in a crisis is the bigger problem.

Question 100Information Security Program⚑ Flag

A vendor passed a thorough security assessment at onboarding two years ago. What is the MOST appropriate ongoing approach?

ARequire the vendor to repeat the full onboarding assessment monthly BRely on the onboarding assessment until the contract renewal CReassess the vendor only if it reports a security incident DMonitor and reassess the vendor periodically based on its risk

Correct answer: D. Monitor and reassess the vendor periodically based on its risk
Vendor risk changes over time, so periodic reassessment scaled to the vendor's risk keeps the picture current. Relying on a two-year-old assessment ignores changes in the vendor's environment and in the threats it faces.

Question 101Information Security Governance⚑ Flag

The CFO of Skyline Airways proposes setting the security budget at a fixed 10% of the IT budget each year. What is the security manager's BEST response?

ARecommend basing the budget on the strategy and risk assessment results BAccept the proposal, since it matches common industry benchmarks CAsk for 15% instead, since threats are growing faster than IT budgets DSuggest tying the budget to the number of incidents in the previous year

Correct answer: A. Recommend basing the budget on the strategy and risk assessment results
A security budget should fund the initiatives needed to manage risk and meet business goals, not follow a fixed ratio. Benchmarks can be a reference point, but they do not reflect the organization's own risks.

Question 102Incident Management⚑ Flag

A post-incident review showed that an intrusion went unnoticed for three weeks. Which metric would BEST show whether detection improves over time?

AMean time to recover systems BNumber of firewall rule changes CMean time to detect incidents DNumber of security staff trained

Correct answer: C. Mean time to detect incidents
Mean time to detect directly measures how quickly incidents are noticed, which is the weakness the review found. Mean time to recover is useful, but it measures restoration speed after detection, not detection itself.

Question 103Information Security Program⚑ Flag

Which metric BEST indicates that the information security program is effective?

AThe number of security tools deployed across the organization BThe percentage of the IT budget allocated to security activities CThe number of attacks blocked by perimeter defenses each month DA reduction in incidents with significant business impact

Correct answer: D. A reduction in incidents with significant business impact
Effectiveness is shown by outcomes that matter to the business, such as fewer damaging incidents. Blocked attack counts mainly reflect attacker activity and tool volume, not whether business risk is falling.

Question 104Information Security Risk Management⚑ Flag

When setting thresholds for key risk indicators, what should the information security manager base them on PRIMARILY?

AHistorical averages from the last reporting period BBenchmark values that industry peers have published CReporting limits built into the monitoring tool in use DThe organization's risk appetite and tolerance levels

Correct answer: D. The organization's risk appetite and tolerance levels
KRI thresholds should trigger action as risk nears the level management is willing to accept. Peer benchmarks can help with calibration but do not reflect this organization's own appetite.

Question 105Information Security Risk Management⚑ Flag

The company has little internal history to estimate how often a newly emerging attack technique might affect it. Which source is MOST appropriate for estimating likelihood?

AThe likelihood ratings used for unrelated risks in last year's review BCredible external threat intelligence combined with expert judgment CThe default likelihood ratings supplied with the risk management tool DThe worst-case assumption that the attack will occur at least yearly

Correct answer: B. Credible external threat intelligence combined with expert judgment
When internal data is lacking, reliable external intelligence and the judgment of experienced staff give the most defensible estimate. Assuming the worst case feels cautious, but it inflates the risk and distorts priorities.

Question 106Information Security Program⚑ Flag

When reviewing a draft contract with a hosting provider, which missing clause should concern the security manager MOST?

AA service credit schedule for performance below agreed levels BA defined timeframe for notifying the company of breaches CA clause allowing price adjustments in line with inflation DA commitment to hold quarterly account review meetings

Correct answer: B. A defined timeframe for notifying the company of breaches
Without a breach notification requirement, the company may learn of an incident too late to respond or to meet its own legal duties. Service credits matter for performance, but they do not help the company manage a breach of its data.

Question 107Incident Management⚑ Flag

An organization is developing incident playbooks for ransomware, phishing and data leakage. What is the PRIMARY benefit of these playbooks?

ANo further need for staff training on incident response duties BA guarantee that no incident will exceed its defined severity CNo further need for an overall, approved incident response plan DFaster and more consistent responses to common incident types

Correct answer: D. Faster and more consistent responses to common incident types
Playbooks give step-by-step guidance for specific scenarios, which speeds up response and reduces errors. They support the overall plan but do not replace it or the training needed to use them well.

Question 108Information Security Governance⚑ Flag

Riverside Health plans to outsource its security monitoring to a managed service provider. Which statement is MOST accurate?

AAccountability is shared equally between the company and the provider BAccountability moves to the provider, but only for the monitored systems CThe company remains accountable, even though the provider does the work DAccountability for security moves to the provider once the contract is signed

Correct answer: C. The company remains accountable, even though the provider does the work
Tasks and responsibility can be outsourced, but accountability for protecting the organization's information stays with the organization. That is why contracts, service levels and oversight of the provider are still needed.

Question 109Incident Management⚑ Flag

What is the MAIN goal of performing root cause analysis after an incident?

ATo decide whether regulators must be told of the incident BTo find the underlying weakness so it can be corrected CTo document the attacker's timeline for the final report DTo determine which systems should be restored first

Correct answer: B. To find the underlying weakness so it can be corrected
Root cause analysis looks past symptoms to the underlying weakness, such as a missing patch or a flawed process, so it can be fixed and the incident does not recur. A timeline is an input to that analysis, not its goal.

Question 110Information Security Program⚑ Flag

Which metric is MOST appropriate for the manager of the IT operations team responsible for vulnerability remediation?

AAnnual security spending as a percentage of company revenue BStatus of strategic security initiatives against the roadmap CMean time to fix critical vulnerabilities by system group DOverall organizational risk rating compared with risk appetite

Correct answer: C. Mean time to fix critical vulnerabilities by system group
Operational managers need detailed, actionable metrics tied to the work they control, and remediation time by system group shows where to act. Comparisons with risk appetite suit executives but give the operations manager little direction.

Question 111Information Security Program⚑ Flag

A maintenance vendor needs remote access to an industrial control system. Which approach BEST manages the risk?

AMonitored, time-limited access granted only for scheduled work BUnrestricted access provided the vendor signs an NDA first CA permanent VPN account so the vendor can respond quickly DShared administrator credentials stored in the vendor's password vault

Correct answer: A. Monitored, time-limited access granted only for scheduled work
Granting access only when needed, with monitoring, limits exposure and leaves a record of vendor activity. A permanent account is convenient but creates a standing path into a sensitive system that attackers could abuse.

Question 112Incident Management⚑ Flag

Help desk staff often treat security issues as routine IT tickets because they cannot tell when an event is a security incident. What should the information security manager do FIRST?

ARemove security issue handling from the help desk's responsibilities BDefine clear incident criteria and train help desk staff to apply them CRoute every help desk ticket to the security team for a manual review DBuy a new ticketing system that categorizes all tickets automatically

Correct answer: B. Define clear incident criteria and train help desk staff to apply them
Clear criteria for what counts as a security incident, plus training, let front-line staff spot and route incidents correctly. Sending every ticket to security would overload the team without fixing the underlying confusion.

Question 113Information Security Governance⚑ Flag

At Zenith Corp, physical security, IT security, privacy and HR investigations are run by separate teams, and incidents fall through the gaps between them. Which governance outcome would BEST address this?

AIntegrating assurance functions so they work together without gaps BOptimizing the use of security knowledge and infrastructure CDelivering value by investing in security at an optimal cost DMeasuring performance to confirm that each team meets its own objectives

Correct answer: A. Integrating assurance functions so they work together without gaps
Assurance process integration coordinates functions such as physical security, IT security, privacy, HR and legal so there are no gaps or overlaps. Performance measurement tracks each team's results, but it does not bring separate teams together.

Question 114Incident Management⚑ Flag

Who should take part in the lessons-learned meeting after a major incident?

AOnly the external forensic firm that investigated the case BOnly the security analysts who led the technical response CKey parties involved, including business units and vendors DOnly senior management and the chief information security officer

Correct answer: C. Key parties involved, including business units and vendors
Including everyone who played a role, such as business owners, IT, legal, communications and key vendors, gives a full picture of what worked and what did not. Limiting it to the technical team misses gaps in decisions, communication and coordination.

Question 115Information Security Risk Management⚑ Flag

The risk register lists dozens of low-rated risks tied to unsupported software across several business units. Each risk is within appetite on its own. What should the information security manager do?

ATake no further action because each risk is within appetite BAsk each unit to close its entries in the register CRate each risk as high to get management's attention DReport the combined exposure, which may exceed appetite

Correct answer: D. Report the combined exposure, which may exceed appetite
Many small risks with a common cause can add up to an exposure beyond appetite, so management needs the combined view. Looking only at individual ratings hides this concentration.

Question 116Information Security Risk Management⚑ Flag

A BIA shows that order processing has a maximum tolerable downtime of four hours, yet its supporting database runs on a single server with no failover. What should the information security manager do FIRST?

APurchase a second database server and configure automatic failover BAsk the business to extend the maximum tolerable downtime to one day CEscalate the single point of failure directly to the board of directors DAnalyze the likelihood and impact of an outage beyond four hours

Correct answer: D. Analyze the likelihood and impact of an outage beyond four hours
The BIA sets the impact threshold, so the next step is to analyze how likely an outage beyond four hours is and what it would cost. Buying a failover server may be the eventual answer, but choosing it before the risk is analyzed skips the assessment.

Question 117Information Security Program⚑ Flag

An information security manager wants to show that a new program initiative has improved the protection of sensitive data. What is MOST important to have in place?

AA baseline measurement taken before the initiative began BA dashboard tool that displays program metrics in real time CBenchmark data from other companies in the same industry DAn external auditor's opinion on the initiative's design

Correct answer: A. A baseline measurement taken before the initiative began
Improvement can only be shown by comparing results with a starting point. Without a baseline, later numbers have nothing to be measured against. A real-time dashboard presents data but cannot prove change on its own.

Question 118Information Security Program⚑ Flag

The information security steering committee is losing interest in monthly security updates. What should the security manager do?

AAsk the CIO to present the updates instead of the security team BRefocus updates on the risks and decisions that matter to the business CAdd more technical detail to show the work being done by the security team DReduce the updates to once a year to save committee meeting time

Correct answer: B. Refocus updates on the risks and decisions that matter to the business
Steering committees engage when updates link security to business priorities and ask for clear decisions. More technical detail usually makes updates less relevant to a business audience, not more.

Question 119Information Security Governance⚑ Flag

Pinnacle Insurance must appoint a data protection officer (DPO) and is considering giving the role to its CISO. What is the MAIN concern?

AThe CISO usually lacks the legal background that the DPO role needs BThe CISO would then have to report directly to the data protection authority CThe CISO may not have enough time to handle both sets of duties well DThe CISO could not independently monitor controls they helped design

Correct answer: D. The CISO could not independently monitor controls they helped design
A DPO must monitor compliance independently, and a CISO who decides how data is processed and protected would be reviewing their own work. Workload can be managed, but a conflict of interest goes to the heart of the role.

Question 120Incident Management⚑ Flag

What is the MOST effective way to prepare incident management team members for their responsibilities?

AGiving each team member a printed copy of the full response plan BRequiring every member to earn a technical security certification CRole-based training combined with participation in exercises DGeneral security awareness training delivered to all employees

Correct answer: C. Role-based training combined with participation in exercises
Role-based training and hands-on exercises build the specific skills and decision-making each member needs. General awareness training helps everyone spot and report incidents, but it does not prepare team members for their response duties.

Question 121Incident Management⚑ Flag

A post-incident review produced a list of improvement actions. What will BEST ensure the actions are completed?

AAssigning owners and due dates and tracking progress BIncluding the full list in the final incident report CEmailing the list to all members of the IT department DReviewing the list again at next year's incident review

Correct answer: A. Assigning owners and due dates and tracking progress
Actions need named owners, deadlines and follow-up reporting, or they tend to be forgotten once normal work resumes. Recording them in the report documents them but does not drive completion.

Question 122Information Security Program⚑ Flag

Which of the following is a leading indicator for the information security program?

ANumber of data breaches reported in the last quarter BTotal financial losses from security incidents this year CPercentage of critical assets with no assigned owner DNumber of regulatory fines paid over the past two years

Correct answer: C. Percentage of critical assets with no assigned owner
A leading indicator signals conditions that could cause future problems, allowing action before harm occurs. Unowned critical assets point to a likely future protection gap. Breach counts, losses and fines are lagging indicators that report harm already suffered.

Question 123Information Security Program⚑ Flag

The security manager must report program status to both the board and the IT operations team. What is the BEST approach?

ATailor the content and level of detail to each audience BGive both groups an identical one-page summary to save time CSend the same detailed technical report to both audiences DReport only to the board and let it brief IT operations

Correct answer: A. Tailor the content and level of detail to each audience
Different audiences need different information: the board needs risk and business impact, while IT operations needs actionable technical detail. One detailed technical report would overwhelm the board and fail to support its decisions.

Question 124Information Security Governance⚑ Flag

The head of a business unit refuses to implement a mandatory control, and discussions with the security manager have not resolved the issue. What should the security manager do NEXT?

ARecord the issue in the risk register and take no further action for now BEscalate the matter to the steering committee or senior management CReport the business unit head to the regulator for breaking the policy DImplement the control directly on the unit's systems without its approval

Correct answer: B. Escalate the matter to the steering committee or senior management
When agreement cannot be reached, the decision should go to senior management or the steering committee, who own the risk trade-off. Logging the risk without escalation leaves a policy breach with no accountable decision.

Question 125Information Security Risk Management⚑ Flag

A quarterly risk report states that a key access review control is in place, but the control has not been tested in two years. What is the GREATEST concern?

AReported risk levels may not match actual control performance BThe report could reach senior management later than planned CAuditors may ask for additional supporting documentation DThe control owner may need more training on running the review

Correct answer: A. Reported risk levels may not match actual control performance
The report assumes the control works; if it has not been tested, residual risk could be much higher than reported. Training needs are secondary to management making decisions on possibly false information.

Question 126Information Security Risk Management⚑ Flag

How does information classification PRIMARILY support the risk assessment process?

AIt determines which employees may access each category of information BIt assigns technical controls to each system according to its location CIt sets the relative sensitivity of data so impact can be rated DIt lists the threat actors most likely to target each category of data

Correct answer: C. It sets the relative sensitivity of data so impact can be rated
Classification establishes how sensitive and valuable information is, giving a consistent basis for rating the impact of its compromise. Access decisions do use classification, but that is an outcome of classification rather than its contribution to risk assessment.

Question 127Incident Management⚑ Flag

Why should senior executives take part in incident response tabletop exercises?

ATo learn the technical steps needed to restore servers and applications BTo practice the key business decisions they would face in a real crisis CTo evaluate the individual performance of technical staff members DTo meet an internal requirement that every exercise has an audience

Correct answer: B. To practice the key business decisions they would face in a real crisis
Executives make high-impact calls during major incidents, such as shutting down services or notifying regulators, and exercises let them practice those decisions. They do not need to learn technical restoration steps, which belong to the technical teams.

Question 128Incident Management⚑ Flag

An incident revealed that a key access control was far less effective than the last risk assessment assumed. What should the information security manager do?

AAccept the risk because the incident has already been resolved BWait for the next scheduled risk assessment to record the finding CRemove the control because it failed to prevent the incident DUpdate the risk assessment with the control's real effectiveness

Correct answer: D. Update the risk assessment with the control's real effectiveness
An incident gives real evidence about how a control performs, so the risk assessment should be updated promptly to support better treatment decisions. Waiting for the next cycle leaves management deciding on outdated risk information.

Question 129Information Security Program⚑ Flag

What is the PRIMARY purpose of assessing the information security program with a capability maturity model?

ATo identify gaps between the current and desired states BTo compare the program with those of key competitors CTo certify the program against an international standard DTo rank security staff by their individual performance

Correct answer: A. To identify gaps between the current and desired states
A maturity assessment shows where processes stand today compared with the target, which guides the improvement roadmap. Comparison with competitors may be a side benefit, but it does not set direction based on the organization's own needs.

Question 130Information Security Program⚑ Flag

The company announces a plan to expand into online retail within a year. What should the security manager do about the security architecture?

AAsk the retail platform vendor to redesign the architecture BReview it now to ensure it will support the new business model CKeep the current architecture until an incident shows a need DWait until the retail platform is built and then add controls

Correct answer: B. Review it now to ensure it will support the new business model
Security architecture must evolve with business strategy, and an early review lets controls be built into the new model. Adding controls after the platform is built costs more and is likely to leave gaps.

Question 131Information Security Governance⚑ Flag

A new board member at Apex Manufacturing asks to review the company's firewall rule sets at every board meeting. What is the BEST response from the CISO?

AExplain the board's oversight role and offer risk-based summary reporting BProvide the full rule sets, since board members have the right to see them CRefuse the request, since firewall rules are confidential technical data DAsk the IT team to present the firewall rules at the next board meeting

Correct answer: A. Explain the board's oversight role and offer risk-based summary reporting
The board's role is oversight of strategy and risk, so it needs summarized, risk-focused information rather than technical detail. Providing raw rule sets pulls the board into operations and does not help it govern.

Question 132Incident Management⚑ Flag

A company acquired a competitor and absorbed several of its business processes. What should happen with the business impact analysis?

AKeep the existing BIA unchanged until its scheduled review in two years BAsk the acquired company to maintain its own separate BIA indefinitely CReplace the BIA with an external benchmark for the company's industry DUpdate the BIA to include the new processes and their dependencies

Correct answer: D. Update the BIA to include the new processes and their dependencies
An acquisition changes critical processes and dependencies, so the BIA must be updated to keep recovery priorities accurate. Waiting for the scheduled review leaves response and recovery plans resting on outdated information.

Question 133Incident Management⚑ Flag

Legal counsel advises that an incident is likely to lead to a lawsuit. What should the information security manager ensure for the relevant logs and records?

AThey are placed on legal hold and routine deletion stops BThey are deleted once the incident has been resolved CThey are reviewed and only the key entries are retained DThey are kept only under the normal log retention schedule

Correct answer: A. They are placed on legal hold and routine deletion stops
A legal hold stops routine deletion of records that may be needed in litigation, protecting the organization from claims that it destroyed evidence. Following the normal retention schedule could let relevant logs be overwritten before the case ends.

Question 134Information Security Program⚑ Flag

Producing one monthly security metric takes analysts two days of manual work, and no one uses it to make decisions. What should the information security manager do?

AAutomate collection of the metric to save analyst time BPresent the metric to more stakeholders to increase its use CRetire the metric or replace it with one that drives action DReduce how often the metric is produced to once a quarter

Correct answer: C. Retire the metric or replace it with one that drives action
Metrics should be useful enough to justify the effort of producing them. A metric no one acts on wastes resources even if it becomes cheaper to collect. Automating it lowers cost but keeps a measure that adds no value.

Question 135Information Security Risk Management⚑ Flag

A company uses more than 300 vendors and has limited security staff. How should the information security manager plan ongoing third-party risk monitoring?

ATier vendors by criticality and set monitoring by tier BReview every vendor with the same annual questionnaire CMonitor only the vendors with the largest contract value DRely on vendors to report any security issues they find

Correct answer: A. Tier vendors by criticality and set monitoring by tier
Risk-based tiering puts the most monitoring effort on vendors that handle sensitive data or support critical services. Contract value alone is a weak guide, since a small vendor can still hold highly sensitive data.

Question 136Information Security Program⚑ Flag

A company wants to adopt a control framework to guide its security program. What should MOST influence the choice?

AHow often it is cited in recent industry publications BThe number of detailed controls the framework contains CWhich framework the security team used at a past employer DIts fit with business, legal and regulatory requirements

Correct answer: D. Its fit with business, legal and regulatory requirements
A framework is only useful if it addresses the obligations and objectives the organization actually faces. Choosing the one with the most controls adds effort without ensuring the right risks are covered.

Question 137Information Security Governance⚑ Flag

Halcyon Bank is launching a data classification program. What is the information security manager's MOST appropriate role?

AApprove all classification decisions made by the business data owners BDevelop the classification scheme and help owners apply it correctly CLabel all documents and files once owners tell IT what they contain DAssign a classification level to every data set in the organization

Correct answer: B. Develop the classification scheme and help owners apply it correctly
The security manager designs the scheme and supports owners, while data owners decide the classification of their own data. Assigning levels to every data set would take that decision away from the people accountable for the data.

Question 138Information Security Risk Management⚑ Flag

A development team is starting work on a new customer-facing mobile banking app. When is it MOST effective to identify the security risks of the application?

ADuring user acceptance testing, once all features are complete BAfter the first security incident, using the lessons learned CDuring the design phase, through threat modeling with the team DAfter the app is deployed, through an external penetration test

Correct answer: C. During the design phase, through threat modeling with the team
Identifying risk during design allows weaknesses to be addressed when changes are cheapest and easiest to make. A penetration test after deployment is valuable, but finding design flaws at that point is costly and leaves the app exposed in the meantime.

Question 139Incident Management⚑ Flag

The information security manager needs funding to improve incident response capabilities. What is the BEST basis for the business case?

AIndustry surveys showing the average number of cyberattacks per year BThe potential business impact identified in the BIA and risk assessment CA list of new security tools recommended by the security operations team DBudget figures that competitors are reported to spend on cybersecurity

Correct answer: B. The potential business impact identified in the BIA and risk assessment
Tying investment to the organization's own potential business impact shows executives exactly what the funding protects. Industry attack statistics may raise awareness, but they do not show the value to this specific business.

Question 140Incident Management⚑ Flag

An organization with cyber insurance suffers a major data breach. Which action should be taken EARLY in the response?

AWait to contact the insurer until recovery is done BHire any forensic firm and send the bill to the insurer CContact the insurer only if a lawsuit is filed later DNotify the insurer as required by the policy terms

Correct answer: D. Notify the insurer as required by the policy terms
Many policies require prompt notice and may require approved vendors, so early notification protects coverage. Hiring a forensic firm without checking the policy could mean those costs are not reimbursed.

Question 141Information Security Program⚑ Flag

During an asset inventory, the information security manager finds a customer database for which no business unit will accept ownership. What should the manager do?

AMark the database as unclassified until an owner volunteers BEscalate to senior management to assign an accountable owner CTake ownership on behalf of the information security team DAssign ownership to the IT team that hosts the database

Correct answer: B. Escalate to senior management to assign an accountable owner
Ownership is a business responsibility, and senior management has the authority to assign it when units decline. If the security team takes ownership, accountability blurs and business risk decisions land in the wrong hands. The hosting team is a custodian, not the owner.

Question 142Information Security Program⚑ Flag

A new privileged access management solution has just been deployed. What should the security manager do NEXT?

AAnnounce to management that privileged access risk is eliminated BClose the project and release the implementation team CVerify that the solution meets the defined control objectives DPurchase additional licenses to allow for future growth

Correct answer: C. Verify that the solution meets the defined control objectives
Post-implementation validation confirms the control works as intended and addresses the risk it was selected for. Closing the project without this check could leave a gap that no one notices until an incident.

Question 143Information Security Governance⚑ Flag

Which document BEST establishes the authority, scope and responsibilities of the information security function within an organization?

AA security charter approved by senior management BThe job description of the information security manager CThe security standards issued by the IT department DThe incident response plan for the security team

Correct answer: A. A security charter approved by senior management
A charter approved by senior management formally gives the security function its mandate, scope and authority. A job description covers one person's duties, not the authority of the function as a whole.

Question 144Information Security Risk Management⚑ Flag

A critical software vendor plans to use a subcontractor to host the company's customer data. What is the MOST important contractual protection for the company?

AThe right to choose which subcontractor the vendor hires BA fee discount if the subcontractor has a service outage CA clause making the vendor liable for all resulting losses DNotice of subcontractors and flow-down of security terms

Correct answer: D. Notice of subcontractors and flow-down of security terms
The company needs to know about these fourth parties and make sure they meet the same security obligations as the vendor. Making the vendor liable may help recover costs but does not reduce the risk to the data.

Question 145Information Security Risk Management⚑ Flag

When estimating residual risk for a critical system, which evidence should the information security manager rely on MOST?

AResults of recent testing of the controls' operating effectiveness BStatements from the system administrator that controls are in place CThe vendor's marketing claims about the product's built-in security DControl descriptions documented in the approved system security plan

Correct answer: A. Results of recent testing of the controls' operating effectiveness
Residual risk depends on how well controls actually work, so tested evidence of operating effectiveness is the most reliable basis. Documented control descriptions are tempting, but they show design intent, not whether the controls function as expected.

Question 146Incident Management⚑ Flag

A disaster recovery test shows a critical system took 10 hours to restore, while its RTO is 6 hours. What should the information security manager do FIRST?

ARepeat the same test right away until the system meets the RTO BNote the result in the test report and close out the exercise CFind the causes of the delay and report fixes to management DChange the RTO to 10 hours so that future tests will pass

Correct answer: C. Find the causes of the delay and report fixes to management
The gap should be analyzed and reported so management can decide on fixes such as better procedures, tools or funding. Changing the RTO to match the result ignores the business requirement that set it in the first place.

Question 147Incident Management⚑ Flag

Which condition should be met BEFORE an incident is formally closed?

AThe affected systems have run without errors for one full day BThe incident handler states that the attack seems to have stopped CAll employees have been told the full details of the incident DEradication and recovery are verified and records are complete

Correct answer: D. Eradication and recovery are verified and records are complete
Closure requires evidence that the threat is gone, systems work properly and records are complete for review and legal needs. A handler's view that the attack has stopped is not enough without verification and documentation.

Question 148Information Security Program⚑ Flag

What is the BEST way to keep the information asset inventory accurate over time?

AAsk business units to send updates whenever they remember BRun network discovery scans and rebuild the inventory monthly CHave the security team audit the entire inventory once a year DBuild inventory updates into change and procurement processes

Correct answer: D. Build inventory updates into change and procurement processes
Linking updates to the processes that create, change or retire assets keeps the inventory current as part of normal work. An annual audit finds errors late and leaves the inventory outdated for most of the year. Network scans also miss information assets that are not devices, such as data sets.

Question 149Information Security Program⚑ Flag

A company outsources customer data processing to a third party. Who remains accountable for protecting that data?

AThe regulator that oversees the data protection rules BThe company that owns the data and outsourced the work CThe third party, since it now performs the processing DThe third party's insurer, under the contract's coverage

Correct answer: B. The company that owns the data and outsourced the work
Accountability for data protection cannot be outsourced, even though tasks and responsibilities can be. The third party has contractual duties, but the company still answers to customers and regulators if the data is compromised.

Question 150Information Security Governance⚑ Flag

Quantum Labs has a culture that values speed and team autonomy, and staff resist rigid rules. When designing the security strategy, what is the BEST approach?

AAvoid adding any controls that might slow teams down or limit autonomy BWait until the culture changes before starting the security strategy CDesign controls that fit the culture while still managing key risks DImpose strict controls to change the culture as quickly as possible

Correct answer: C. Design controls that fit the culture while still managing key risks
A strategy that works with the culture gains acceptance and is more likely to be followed, while still addressing the main risks. Imposing rigid controls in this culture often leads to workarounds and weaker security.