Free Preparation Discussions
MENU
Isaca CISM Exam Questions
- Topic 1: INFORMATION SECURITY GOVERNANCE: This section of the exam measures the skills of Information Security Managers and covers the foundational aspects of governance within an enterprise. It focuses on understanding organizational culture, legal and regulatory requirements, and defining clear structures and responsibilities. It also evaluates the ability to develop comprehensive information security strategies aligned with governance frameworks and standards, while incorporating strategic planning, budgeting, and resource management to demonstrate credibility in managing security at an executive level.
- Topic 2: INFORMATION SECURITY RISK MANAGEMENT: This section of the exam assesses the capabilities of Risk Analysts in identifying, analyzing, and managing information security risks. Candidates are expected to understand the emerging landscape of threats and vulnerabilities and conduct thorough risk assessments. The domain further evaluates knowledge of appropriate risk treatment methods, assigning risk ownership, and monitoring risks effectively to support continuous improvement and proactive risk mitigation across the organization.
- Topic 3: INFORMATION SECURITY PROGRAM: This section of the exam focuses on evaluating Security Program Managers in their ability to establish and oversee information security initiatives. It covers the planning and allocation of necessary resources, classification of information assets, and adherence to established security standards and frameworks. The candidate must also demonstrate skills in policy development, metrics tracking, and managing external service providers. Additionally, this domain includes the design, implementation, testing, and communication of security controls, as well as employee training and program reporting.
- Topic 4: INCIDENT MANAGEMENT: This section of the exam targets the responsibilities of Incident Response Coordinators and addresses the preparedness and operational response to security incidents. It involves developing incident response and business continuity plans, performing impact analysis, and testing readiness through simulations. The second part emphasizes operational management, including the use of tools, incident investigation, containment strategies, communication during crises, recovery processes, and conducting post-incident reviews to enhance future resilience.
Free Isaca CISM Exam Actual Questions
Note: Premium Questions for CISM were last updated On Oct. 03, 2026 (see below)
A finance department director has decided to outsource the organization's budget application and has identified potential providers. Which of the following actions should be initiated FIRST by IN information security manager?
Before outsourcing any application or service, an information security manager should first determine the required security controls for the new solution, based on the organization's risk appetite, security policies and standards, and regulatory requirements. This will help to evaluate and select the most suitable provider, as well as to define the security roles and responsibilities, service level agreements (SLAs), and audit requirements. Reference: https://www.isaca.org/credentialing/cism https://www.wiley.com/en-us/CISM+Certified+Information+Security+Manager+Study+Guide-p-9781119801948
Which of the following is the BEST way for an information security manager to learn of zero-day vulnerabilities?
The correct answer is B because cybersecurity threat intelligence groups provide the most effective source of information about zero-day vulnerabilities. Zero-day vulnerabilities are newly discovered or previously unknown weaknesses that may not yet have patches, signatures, or standard scanner checks. Threat intelligence sources can provide early warnings, exploit details, indicators of compromise, affected technologies, attacker tactics, and recommended mitigations. Signature-based malware detection tools are limited because they depend on known malicious patterns and may not detect new threats. Penetration testing can identify weaknesses, but it is periodic and limited to the scope of the test. Vulnerability scanning tools are useful for identifying known vulnerabilities, but they may not detect zero-day vulnerabilities until detection logic is available. In CISM risk management, organizations should maintain awareness of emerging threats and adapt controls as the threat environment changes. Therefore, cybersecurity threat intelligence groups are the best source for learning of zero-day vulnerabilities.
Which of the following should be done FIRST to determine the impact of a new regulatory requirement for cloud services?
The correct answer is C because before assessing impact, performing a gap analysis, or conducting a risk assessment, the organization must first determine whether the new regulatory requirement applies to its cloud services, data, jurisdictions, customers, industry, and processing activities. Applicability establishes whether the regulation is relevant and which systems, processes, contracts, business units, or data types are in scope. A risk assessment is important after applicability is confirmed, but performing it too early may waste resources or miss the correct scope. Reviewing the asset inventory may support scoping, but it should follow or support the applicability analysis. A gap analysis compares current practices against requirements, but this cannot be done properly until the organization confirms that the requirement applies and understands its scope. CISM risk management emphasizes identifying legal, regulatory, and contractual obligations as part of risk and compliance management. Therefore, determining applicability is the first step in understanding the impact of a new regulatory requirement.
During which of the following development phases is it MOST challenging to implement security controls?
The development phase is the stage of the system development life cycle (SDLC) where the system requirements, design, architecture, and implementation are performed. The development phase is most challenging to implement security controls because it involves complex and dynamic processes that may not be well understood or documented. Security controls are essential for ensuring the confidentiality, integrity, and availability of the system and its data, as well as for complying with regulatory and contractual obligations. However, security controls may also introduce additional costs, risks, and constraints to the development process, such as:
Increased complexity and overhead of testing, verification, validation, and maintenance
Reduced flexibility and agility of changing requirements or design
Increased dependency on external vendors or third parties for security services or products
Increased vulnerability to errors, defects, or vulnerabilities in the code or configuration
Increased difficulty in measuring and reporting on security performance or effectiveness
Therefore, implementing security controls in the development phase requires careful planning, coordination, communication, and collaboration among all stakeholders involved in the SDLC. It also requires a clear understanding of the security objectives, scope, criteria, standards, policies, procedures, roles, responsibilities, and resources for the system. Moreover, it requires a proactive approach to identifying and mitigating potential threats or risks that may affect the security of the system.
Reference= CISM Manual1, Chapter 3: Information Security Program Development (ISPD), Section 3.1: System Development Life Cycle (SDLC)2
1: https://store.isaca.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles2: https://store.isaca.org/s/store#/store/browse/cat/a2D4w00000Ac6NNEAZ/tiles
A recent application security assessment identified a number of low- and medium-level vulnerabilities. Which of the following stakeholders is responsible for deciding the appropriate risk treatment option?
Verified Answer: According to the CISM Review Manual, 15th Edition, Chapter 3, Section 3.2.1.3, 'The appropriate risk treatment option is decided by the chief information security officer (CISO) or the designated risk owner.'1
The CISO is the senior executive who is responsible for overseeing and managing the information security program of an organization. The CISO has the authority and expertise to assess the risks, determine the risk appetite and tolerance levels, and select the most suitable risk treatment options for each risk. The CISO also has the accountability and responsibility for implementing, monitoring, and reporting on the risk treatment activities.
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Ryan Adams
13 days agoSandra Jones
1 month agoMonica Gonzalez
1 month agoAshley Wilson
2 months agoJason Brown
3 months agoJessica Flores
3 months agoRonald Smith
4 months agoAnthony Phillips
4 months agoWilliam Morris
5 months agoEric Lewis
5 months agoRachel Morgan
6 months agoLisa Collins
6 months agoAngela Clark
5 months agoEric Rogers
5 months agoSandra Hall
5 months agoStephen Bell
6 months agoVesta
6 months agoFausto
7 months agoKatina
7 months agoClorinda
7 months agoVeronique
7 months agoEden
8 months agoChrista
8 months agoMilly
8 months agoYan
8 months agoBethanie
9 months agoRegenia
9 months agoNieves
9 months agoEvangelina
9 months agoLynelle
10 months agoRamonita
10 months agoCiara
10 months agoJesse
10 months agoDaniela
11 months agoAnnmarie
11 months agoBernadine
11 months agoBernardo
11 months agoCelestina
12 months agoTaryn
12 months agoHelaine
1 year agoMarti
1 year agoCarlene
1 year agoLavelle
1 year agoYesenia
1 year agoThomasena
1 year agoLouvenia
1 year agoKanisha
1 year agoVinnie
1 year agoJackie
1 year agoArt
1 year agoLon
2 years agoCaprice
2 years agoNoah
2 years agoFernanda
2 years agoYong
2 years agoAshley
2 years agoBarrett
2 years agoDavida
2 years agoLauran
2 years agoLuis
2 years agoShaunna
2 years agoLaquita
2 years agoOlive
2 years agoLili
2 years agoBrittani
2 years agoJannette
2 years agoLeonor
2 years agoJohnetta
2 years agoDyan
2 years agoGlory
2 years agoLavera
2 years agoTroy
2 years agoFallon
2 years agoOllie
2 years agoStephanie
2 years agoArlen
2 years agoStephaine
2 years agoJunita
2 years agoBea
2 years agoMicah
2 years agoLavelle
2 years agoThurman
2 years agoAlline
2 years agoJerry
2 years agoChun
2 years ago