Free Preparation Discussions
MENU
Isaca CISM Exam Questions
- Topic 1: INFORMATION SECURITY GOVERNANCE: This section of the exam measures the skills of Information Security Managers and covers the foundational aspects of governance within an enterprise. It focuses on understanding organizational culture, legal and regulatory requirements, and defining clear structures and responsibilities. It also evaluates the ability to develop comprehensive information security strategies aligned with governance frameworks and standards, while incorporating strategic planning, budgeting, and resource management to demonstrate credibility in managing security at an executive level.
- Topic 2: INFORMATION SECURITY RISK MANAGEMENT: This section of the exam assesses the capabilities of Risk Analysts in identifying, analyzing, and managing information security risks. Candidates are expected to understand the emerging landscape of threats and vulnerabilities and conduct thorough risk assessments. The domain further evaluates knowledge of appropriate risk treatment methods, assigning risk ownership, and monitoring risks effectively to support continuous improvement and proactive risk mitigation across the organization.
- Topic 3: INFORMATION SECURITY PROGRAM: This section of the exam focuses on evaluating Security Program Managers in their ability to establish and oversee information security initiatives. It covers the planning and allocation of necessary resources, classification of information assets, and adherence to established security standards and frameworks. The candidate must also demonstrate skills in policy development, metrics tracking, and managing external service providers. Additionally, this domain includes the design, implementation, testing, and communication of security controls, as well as employee training and program reporting.
- Topic 4: INCIDENT MANAGEMENT: This section of the exam targets the responsibilities of Incident Response Coordinators and addresses the preparedness and operational response to security incidents. It involves developing incident response and business continuity plans, performing impact analysis, and testing readiness through simulations. The second part emphasizes operational management, including the use of tools, incident investigation, containment strategies, communication during crises, recovery processes, and conducting post-incident reviews to enhance future resilience.
Free Isaca CISM Exam Actual Questions
Note: Premium Questions for CISM were last updated On Mar. 24, 2026 (see below)
Which of the following BEST facilitates an information security manager's efforts to obtain senior management commitment for an information security program?
Communicating the residual risk is the best way to facilitate an information security manager's efforts to obtain senior management commitment for an information security program. The residual risk is the level of risk that remains after applying the security controls and mitigation measures. The residual risk reflects the effectiveness and efficiency of the information security program, as well as the potential impact and exposure of the organization. The information security manager should communicate the residual risk to the senior management in a clear, concise, and relevant manner, using quantitative or qualitative methods, such as risk matrices, heat maps, dashboards, or reports. The communication of the residual risk should also include the comparison with the inherent risk, which is the level of risk before applying any security controls, and the risk appetite, which is the level of risk that the organization is willing to accept. The communication of the residual risk should help the senior management to understand the value and performance of the information security program, as well as the need and justification for further investment or improvement. Presenting evidence of inherent risk, reporting the security maturity level, and presenting compliance requirements are all important aspects of the information security program, but they are not the best ways to obtain senior management commitment. These aspects may not directly demonstrate the benefits or outcomes of the information security program, or they may not align with the business objectives or priorities of the organization. For example, presenting evidence of inherent risk may show the potential threats and vulnerabilities that the organization faces, but it may not indicate how the information security program addresses or reduces them. Reporting the security maturity level may show the progress and status of the information security program, but it may not relate to the risk level or the business impact. Presenting compliance requirements may show the legal or regulatory obligations that the organization must fulfill, but it may not reflect the actual security needs or goals of the organization.Therefore, communicating the residual risk is the best way to obtain senior management commitment for an information security program, as it shows the results and value of the information security program for the organization.Reference= CISM Review Manual 2023, page 411; CISM Practice Quiz2
An organization is planning to open a new office in another country. Sensitive data will be routinely sent between the two offices. What should be the information security manager's FIRST course of action?
The first course of action is to identify applicable regulatory requirements (D). CISM governance requires understanding legal and regulatory obligations before defining policies, controls, or technical measures. Encryption (B), training (A), and policy updates (C) must be based on regulatory requirements to ensure compliance and avoid legal exposure. Jurisdictional risk assessment is foundational when operating across borders.
Which of the following is MOST appropriate to communicate to senior management regarding information risk?
Risk profile changes are the most appropriate to communicate to senior management regarding information risk because they reflect the current level and nature of the risks that the organization faces and how they may affect its objectives and performance. Senior management needs to be aware of any changes in the risk profile so that they can make informed decisions and allocate resources accordingly. Risk profile changes also help senior management monitor the effectiveness of the risk management process and identify any gaps or weaknesses that need to be addressed.
Reference=Communicating Information Security Risk Simply and Effectively, Part 1,CISM Domain 2: Information Risk Management (IRM) [2022 update]
An incident handler is preparing a forensic image of a hard drive. Which of the following MUST be done to provide evidence that the image is an exact copy of the original?
Which of the following is the BEST indication that an organization has a mature information security culture?
The BEST indication that an organization has a mature information security culture is when its staff consistently consider risk in making decisions. When an organization's staff understands the risks associated with their actions and are empowered to make risk-informed decisions, it indicates that the organization has a mature information security culture.
According to the Certified Information Security Manager (CISM) Study Manual, 'A mature information security culture exists when the people within the organization understand and appreciate the risks associated with information and technology and when they take steps to manage those risks on a daily basis.'
While information security training, documented information security policies, and regular interaction between the chief information security officer (CISO) and the board are all important components of a mature information security culture, they are not sufficient on their own. It is only when staff consistently consider risk in making decisions that an organization's information security culture can be considered mature.
Certified Information Security Manager (CISM) Study Manual, 15th Edition, Pages 151-152.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Katina
6 days agoClorinda
13 days agoVeronique
20 days agoEden
28 days agoChrista
1 month agoMilly
1 month agoYan
2 months agoBethanie
2 months agoRegenia
2 months agoNieves
2 months agoEvangelina
3 months agoLynelle
3 months agoRamonita
3 months agoCiara
3 months agoJesse
4 months agoDaniela
4 months agoAnnmarie
4 months agoBernadine
4 months agoBernardo
5 months agoCelestina
5 months agoTaryn
5 months agoHelaine
5 months agoMarti
6 months agoCarlene
6 months agoLavelle
6 months agoYesenia
7 months agoThomasena
7 months agoLouvenia
9 months agoKanisha
9 months agoVinnie
9 months agoJackie
11 months agoArt
11 months agoLon
12 months agoCaprice
1 year agoNoah
1 year agoFernanda
1 year agoYong
1 year agoAshley
1 year agoBarrett
1 year agoDavida
1 year agoLauran
1 year agoLuis
1 year agoShaunna
1 year agoLaquita
1 year agoOlive
1 year agoLili
1 year agoBrittani
1 year agoJannette
1 year agoLeonor
1 year agoJohnetta
1 year agoDyan
1 year agoGlory
1 year agoLavera
1 year agoTroy
1 year agoFallon
1 year agoOllie
1 year agoStephanie
1 year agoArlen
1 year agoStephaine
2 years agoJunita
2 years agoBea
2 years agoMicah
2 years agoLavelle
2 years agoThurman
2 years agoAlline
2 years agoJerry
2 years agoChun
2 years ago