Free Isaca CISM Exam Questions

Become Isaca Certified with updated CISM exam questions and correct answers

Page: 1 / 195

Total 975 Questions | Updated On: Jul 28, 2026

Add To Cart

Question 1

To help ensure that an information security training program is MOST effective, its contents should be:

A : based on recent incidents.

B : based on employees’ roles.

C : aligned to business processes.

D : focused on information security policy.

Answer: B

Question 2

Which of the following should an information security manager do FIRST when noncompliance with security standards is identified?

A : Report the noncompliance to senior management.

B : Validate the noncompliance.

C : Include the noncompliance in the risk register.

D : Implement compensating controls to mitigate the noncompliance.

Answer: B

Question 3

An incident response team has established that an application has been breached. Which of the following should be done NEXT?

A : Maintain the affected systems in a forensically acceptable state

B : Conduct a risk assessment on the affected application

C : Inform senior management of the breach.

D : Isolate the impacted systems from the rest of the network

Answer: D

Question 4

Which of the following is the MOST important characteristic of an effective information security metric?

A : The metric expresses residual risk relative to risk tolerance.

B : The metric is frequently reported to senior management.

C : The metric directly maps to an industry risk management framework.

D : The metric compares the organization's inherent risk against its risk appetite.

Answer: A

Question 5

Management has announced the acquisition of a new company. The information security manager of the parent company is concerned that conflicting access rights may cause critical information to be exposed during the integration of the two companies. To BEST address this concern, the information security manager should:

A : calate concerns for conflicting access rights to management.

B : view access rights as the acquisition integration occurs.

C : plement consistent access control standards.

D : rform a risk assessment of the access rights.

Answer: C

Page: 1 / 195

Total 975 Questions | Updated On: Jul 28, 2026

Add To Cart