ISACA Certified Information Security Manager (CISM) - November 2026 Full Practice Exam 1

1. A board-approved tolerance permits limited downtime but prohibits a certain data transfer. How should the manager evaluate a proposal that meets the uptime goal but makes the prohibited transfer?
2. A board asks whether the security program is improving over time. Which evidence is most useful?
3. A business application uses shared administrator credentials. What is the most important program concern?
4. A business changes a critical process after the annual assessment. What is the best response?
5. A business-critical service depends on an unsupported operating system. What should the manager recommend?
6. A business executive accepts a residual security risk outside their delegated authority. What should the security manager do?
7. A business executive asks for a guaranteed time of full restoration early in an evolving incident. What should the manager communicate?
8. A business impact analysis finds that payroll must resume within eight hours. How should this inform security risk treatment?
9. A business owner accepts residual risk within authority. What should the security manager ensure next?
10. A business owner asks when a recovered service can reopen. What evidence should support the decision?
11. A business owner wants the security team to classify all records without business input. What should the manager explain?
12. A business service meets its backup schedule, but restore tests repeatedly fail. Which measure best reflects the problem?
13. A business strategy shifts from local hosting to international SaaS. What should the security manager do first?
14. A business unit repeatedly bypasses approval because the control is incompatible with its service model. What should the manager do first?
15. A CISO's reporting line prevents material risks from reaching senior leadership because an operations manager filters all reports. What is the primary concern?
16. A classification scheme is defined, but users do not know how to handle each category. What is needed?
17. A cloud migration project asks for a security review only one week before launch. What program improvement best prevents recurrence?
18. A cloud provider supplies many controls, but the business assumes it has transferred all security accountability. What should the manager clarify?
19. A company adopts a security baseline from another industry without tailoring it. What should the manager review?
20. A confirmed attacker is actively encrypting a critical file server. An approved playbook authorizes isolation, and isolation will interrupt service. What is the best immediate action?
21. A continuity exercise excludes a key supplier that operates the identity service. What should be improved?
22. A contract for a critical service lacks exit provisions. Which program risk should be addressed?
23. A control design depends on timely clock synchronization across systems. Why should the program manage that dependency?
24. A control owner says a policy exists, so the control must be effective. What evidence is most appropriate?
25. A control self-assessment consistently reports no weaknesses, while incidents reveal repeated failures. What should the manager investigate?
26. A critical application lacks an inventory entry and therefore misses patching and monitoring. What foundational program capability needs improvement?
27. A critical risk's indicator exceeds its agreed threshold for three consecutive periods. What should the manager do?
28. A data-loss prevention control blocks legitimate transactions without clear escalation. What should the manager do?
29. A dependency inventory lists software names but no versions or owners. What limitation is most important?
30. A detection generates thousands of false positives and overwhelms analysts. What should the manager prioritize?
31. A developer wants production customer data in a broadly accessible test environment. What should the manager prioritize?
32. A global company wants one security policy while respecting differing local obligations. What is the best approach?
33. A manager wants response staff to preserve a unified incident timeline across several tools. What is most important?
34. A manager wants to know whether logging covers the actions needed to investigate fraud. What is the best approach?
35. A monitoring tool flags unusual transfers from a critical server, but compromise is unconfirmed. What should the incident manager prioritize first?
36. A new CISO inherits a control program measured mainly by installed tools. Leadership asks how security supports expansion into regulated markets. What should the CISO establish first?
37. A new control reduces fraud but slows order fulfillment beyond an agreed service requirement. What should the manager recommend?
38. A new law changes breach-reporting obligations. What should trigger reassessment?
39. A new security architecture principle requires least privilege. What makes the principle operationally useful?
40. A new system processes personal data that is unnecessary for its business purpose. What is the best design recommendation?
41. A new threat intelligence report describes exploitation relevant to an exposed business-critical service. What should happen first?
42. A patch cannot be applied immediately to a critical production system. What should the manager require?
43. A penetration test shows that network segmentation rules permit a sensitive database path that the architecture forbids. What should happen?
44. A playbook directs responders to block an entire partner network, but the partner also supports emergency operations. What should be evaluated?
45. A post-incident review identifies five corrective actions, but none has an owner or due date. What should the manager do?
46. A privileged employee transfers to a different role but retains old access. Which process should be strengthened?
47. A process owner disputes the impact estimate for an outage. What is the best response?
48. A program has many controls but no consistent exception process. What should the manager establish?
49. A program measures only mean time to close findings, encouraging teams to close records without fixing problems. What should change?
50. A program reports 100% training completion. Which additional measure best assesses effectiveness?
51. A project places highly sensitive processing in a broadly trusted network zone. What should a security architecture review focus on?
52. A proposed control reduces risk substantially but leaves residual exposure above approved tolerance. What is the best recommendation?
53. A proposed data-sharing project has unclear business ownership. What should be resolved before accepting its privacy and security risks?
54. A ransomware incident is contained. Which factor should guide restoration order?
55. A response exercise identifies that restoration takes twelve hours against a four-hour objective. What should happen next?
56. A response metric reports rapid ticket closure, but reopened incidents are increasing. What should the manager change?
57. A response team cannot distinguish test alerts from real alerts during an exercise. What preparation would most help?
58. A response team receives an extortion demand during a confirmed breach. What should guide the organization's decision process?
59. A response team restores a compromised system from backup before removing the attacker's access. What is the main risk?
60. A response team wants to compare mean containment time across quarters, but the incident mix changed substantially. What should the manager consider?
61. A response team wants to improve detection after finding that an attacker remained unnoticed for weeks. Which review is most useful?
62. A risk assessment excludes outsourced services because they are not owned internally. What should the security manager explain?
63. A risk assessment identifies a threat but no plausible vulnerability or business impact. What is missing?
64. A risk assessment uses an ordinal high/medium/low scale. What should the manager avoid claiming?
65. A risk owner accepted an exposure before a merger. The merger doubles the affected transaction volume and adds a new jurisdiction. What should happen?
66. A risk owner chooses a temporary compensating control while a permanent fix is developed. What should the manager require?
67. A risk register contains 'cloud is dangerous.' What improvement is most useful?
68. A risk treatment is complete, but no one has tested whether the control works. What is the most important next step?
69. A security assessment ranks systems by server count, but one small system processes most customer payments. What should drive its priority?
70. A security-awareness campaign reduces reported phishing clicks but also discourages employees from reporting mistakes. What should the manager change?
71. A security control stops working silently after a system upgrade. What should the program add?
72. A security dashboard is green because failed scans are excluded from its denominator. What is the primary improvement?
73. A security exception has no expiry, owner, or review trigger. Which governance weakness is most significant?
74. A security manager has an approved strategy but no delivery plan. What should be developed next?
75. A security manager is asked to approve a legal interpretation of a new privacy rule. What is the best response?
76. A security manager must recommend treatment for a low-impact risk whose mitigation cost far exceeds expected benefit. What is the best approach?
77. A security manager must reduce costs without undermining required protection. What should be evaluated first?
78. A security manager wants independent assurance over the program they operate. Which arrangement is strongest?
79. A security operations provider detects an incident but waits six hours to notify the customer because no threshold was agreed. What should be improved?
80. A security policy has been approved but employees consistently misunderstand it. Which measure best evaluates whether communication is effective?
81. A security policy is technically detailed, changes weekly, and requires board approval for every parameter. What improvement is most appropriate?
82. A security program spans several countries and business units. What best supports consistent accountability?
83. A security program's priorities remain unchanged after major business divestment. What is the best next step?
84. A security service depends on one employee who will leave next month. What should the manager prioritize?
85. A security steering committee spends every meeting on individual service-desk tickets. What should its agenda emphasize?
86. A senior executive requests an exception to a mandatory legal requirement. What should the manager do?
87. A service has recovered, but customers cannot complete transactions because a dependent identity service remains down. What does this demonstrate?
88. A service team needs emergency privileged access during outages. What is the best design?
89. A strategy sets 'improve security' as its only objective. What should the manager add?
90. A supplier handles sensitive data, but provides only a generic security brochure. What evidence should the manager seek?
91. A supplier's audit report covers corporate offices but not the hosted service purchased by the organization. What should the manager do?
92. A suspected incident turns out to be an authorized maintenance action. What should the team do?
93. A suspected insider incident involves the employee who normally administers the affected logs. What should the manager arrange?
94. A system is suspected of compromise. Investigators may need evidence for disciplinary or legal proceedings. What is most important during collection?
95. A system owner asks to retain all transaction logs indefinitely. What should guide retention?
96. A tabletop exercise has never included executives or legal staff. What is the primary limitation?
97. A team calculates loss using highly uncertain incident frequencies. What should the manager communicate?
98. A team cannot determine which customer records were accessed because application audit events were never collected. What is the most important follow-up?
99. A team closes an incident when the alert stops, although the cause is unknown and persistence checks are incomplete. What is the concern?
100. A team encrypts data in transit but exposes it to excessive authorized users after arrival. What gap remains?
101. A team implements MFA but leaves an old authentication path that bypasses it. What should the manager prioritize?
102. A team proposes biometric login as the only recovery method for a critical service. What should be evaluated?
103. A team proposes storing encryption keys with unrestricted access beside the protected data. What should the manager require?
104. A team recommends avoiding a service because its unavoidable exposure exceeds tolerance. What does risk avoidance mean here?
105. A team reports inherent and residual risk as identical without evaluating existing controls. What should the manager question?
106. A team requests a security tool that duplicates an existing capability. What should the manager evaluate before approval?
107. A team restores from backup but has not checked whether the backup contains the same malicious persistence. What should it do?
108. A team wants to compare two risk treatments with different costs, implementation times, and residual exposure. What is the best decision basis?
109. A third-party contract delegates incident handling but says nothing about notifying the customer. What is the primary risk-management gap?
110. A vendor security questionnaire is completed once at onboarding. The service later becomes business-critical. What should happen?
111. A vulnerability backlog is large. Which prioritization method is best?
112. After an acquisition, systems use different identity standards. What should guide security integration priorities?
113. After recovery, a business owner wants to skip lessons learned because operations are busy. What is the best recommendation?
114. All employees receive the same awareness course, but finance staff continue approving fraudulent bank-detail changes. What is the best improvement?
115. An alert suggests data exfiltration, but a business team explains that the transfer may be an approved export. What is the best next step?
116. An application has a severe vulnerability, but strong compensating controls may block the attack path. What should the assessor evaluate?
117. An architecture board approves cloud designs without security participation until final implementation. What governance change is most useful?
118. An emergency configuration change is made during containment. What should happen after stabilization?
119. An employee's access review is approved based only on job title, although actual duties changed. What improvement is needed?
120. An incident affects a hospital scheduling service and a noncritical archive. Which prioritization is most appropriate?
121. An incident affects several departments. Technical staff give conflicting instructions to business leaders. What should the manager establish?
122. An incident crosses multiple jurisdictions. What should the communication plan account for?
123. An incident is confirmed in a supplier-operated environment. What should the customer's incident manager do?
124. An incident playbook contains a supplier hotline that is no longer staffed. What preparation improvement is needed?
125. An incident's technical scope is small, but it affects regulated personal data. What should determine notification obligations?
126. An insurer covers some financial loss from cyber incidents. What must the manager still assess?
127. An organization cannot tolerate more than fifteen minutes of lost transaction data. Which recovery objective directly expresses this?
128. An organization has a response document but no assigned decision authority for shutting down a revenue service. What should be corrected during preparation?
129. An organization has no named owner for a critical customer-data asset. Why is this a governance problem?
130. An organization is moving to continuous delivery. Which security-program adaptation is most useful?
131. An organization learns that the same exploited flaw remains in other business units after the first unit recovers. What should the response coordinate?
132. An organization requires independent approval before privileged staff modify financial controls. Which principle does this implement?
133. An organization wants to know whether responders can execute recovery steps, not merely describe them. Which exercise provides stronger evidence?
134. Developers repeatedly introduce the same authorization flaw. Which response best addresses the systemic cause?
135. During a major outage, employees share unverified breach details externally. What should the manager activate?
136. During an incident, a responder sends forensic images through an unapproved personal file-sharing account. What is the primary concern?
137. Encrypted backups cannot be restored because the only key was lost. What program weakness is most important?
138. Enterprise architecture proposes consolidating identity services. What should security contribute to the decision?
139. Executives want proof that the response program can adapt to a new attack technique. What provides the strongest evidence?
140. Security funding is requested for a costly control. Which justification is strongest for executive review?
141. Security objectives conflict with a revenue launch. What should governance primarily provide?
142. Security requirements are added to projects, but nobody verifies them at acceptance. What program step is missing?
143. Security standards require configuration checks, but new servers bypass the provisioning process. What is the best systemic improvement?
144. The board receives hundreds of vulnerability counts but cannot determine business significance. What reporting change is best?
145. The incident team relies on a collaboration platform that is unavailable during the incident. What preparation is most relevant?
146. The organization claims compliance proves its security risk is acceptable. What should the security manager explain?
147. The response team discovers that a compromised credential is also used by several service accounts. What is the best next step?
148. The team needs to preserve volatile evidence from a running host while stopping active harm. What should guide the decision?
149. Two divisions accept incompatible levels of customer-data exposure. No enterprise risk appetite is documented. Who should approve the common direction?
150. Two risks have identical likelihood ratings but very different potential business consequences. What should prioritization consider?

Comments — 0