ISACA CISM - Certified Information Security Manager - Governance Risk Management Security Program Incident Management

By Sam Patel · Updated Jul 10, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged1,969
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.2 (38)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

An information security manager is presenting the security program's value to the board of directors. Which METRICS are most meaningful to board-level stakeholders?

Answer choices

  • A. Number of security incidents, firewall rules reviewed, and vulnerability scan completion rates

  • B. Risk reduction trends, percentage of compliance requirements met, security investment ROI, and business impact of security incidents

  • C. Mean time to detect (MTTD), mean time to respond (MTTR), and number of security patches applied

  • D. Number of phishing emails blocked, malware detections per month, and IDS/IPS alerts triggered

Question 2

A security manager is working with the legal team to negotiate a cloud services agreement. Which security consideration is MOST important to address in the contract?

Answer choices

  • A. The cloud provider's employee headcount and office locations

  • B. Data ownership, jurisdiction, breach notification timelines, right-to-audit clauses, data deletion upon termination, and security standards compliance (SOC 2, ISO 27001)

  • C. The cloud provider's marketing claims about security features

  • D. Discount pricing for multi-year security services commitments

Question 3

An information security manager is developing business continuity and disaster recovery plans. What is the PRIMARY purpose of defining Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)?

Answer choices

  • A. To measure the security team's performance during disaster recovery exercises

  • B. To establish business-driven requirements that determine acceptable downtime and data loss, which drive technical recovery solution selection and investment decisions

  • C. To comply with regulatory requirements for documented recovery procedures

  • D. To set expectations with customers about service availability during disasters

Question 4

A newly appointed CISO is tasked with establishing an information security governance framework. The organization has no formal security program. What is the MOST important first step?

Answer choices

  • A. Purchase and deploy a SIEM solution to begin monitoring for threats

  • B. Conduct a comprehensive risk assessment to identify and prioritize security risks relative to business objectives

  • C. Develop an information security strategy aligned with business objectives and obtain senior management commitment

  • D. Hire additional security analysts to perform monitoring and response activities

Question 5

During an internal audit, an auditor reports that the information security policy has not been reviewed in 3 years and contains outdated references to legacy systems that no longer exist. What is the security manager's MOST appropriate response?

Answer choices

  • A. Update the policy to remove outdated references and mark it as current

  • B. Initiate a comprehensive policy review involving stakeholders, update content to reflect current environment and threats, obtain management approval, and establish an annual review cycle

  • C. Inform the auditor that policies don't need frequent updates if the organization hasn't changed significantly

  • D. Engage a consulting firm to rewrite all security policies from scratch