CISM

One question per exam domain, 4 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Information Security Governance

   A ride-hailing firm plans to launch in a country whose law requires rider records to stay in-country. Engineering needs nine months to re-architect; the commercial team announced a launch in three. What is the BEST recommendation?

   1. APropose a compensating control such as encrypting the affected records with keys held in-country, and treat that as satisfying the requirement
   2. BLaunch on the announced date and remediate afterwards, treating the interim gap as a risk documented and accepted by the manager
   3. CRecommend deferring the launch until the architecture change is complete, since a legal requirement cannot be accepted as a risk
   4. DAdvise that legal counsel pursue an exemption or informal forbearance while engineering proceeds with the launch as planned
   5. EPresent the legal obligation, the viable launch options and the exposure attached to each to the executives who own the market entry decision
   Show answer and explanation

   Correct answer

   Present the legal obligation, the viable launch options and the exposure attached to each to the executives who own the market entry decision

   Market entry is a business decision with legal consequences, so the manager's role is to make the obligation and the option space visible to the accountable executives rather than to select the outcome alone. Launching with a documented acceptance treats a statutory duty as if it were a discretionary risk the manager may accept. Pursuing forbearance while proceeding assumes an outcome not yet obtained. Declaring in-country key custody sufficient is a technical judgement about legal adequacy that only counsel can make. Unilaterally recommending deferral is closer to correct but still substitutes the manager's judgement for the decision owner's.

   Source: NIST IR 8286C, Staging Cybersecurity Risks for Enterprise Risk Management and Governance Oversight

2. Question 2 · Information Security Risk Management

   Two analysts rate the same ransomware scenario differently, one citing sector breach reporting, the other ten years without an incident. Both rationales are defensible. How can the manager make assessments repeatable?

   1. AAverage the two ratings and record the midpoint as the agreed likelihood for the ransomware entry in the register
   2. BInstruct analysts to rely only on internal incident history so that every rating is grounded in observed fact rather than opinion
   3. CEscalate each disagreement of this kind to the risk committee so that it adjudicates between the two ratings and sets one
   4. DDefine and publish shared likelihood criteria covering what evidence counts and how threat capability and targeting are weighed
   Show answer and explanation

   Correct answer

   Define and publish shared likelihood criteria covering what evidence counts and how threat capability and targeting are weighed

   A documented assessment approach with defined scales and stated evidence rules is what makes results repeatable, comparable and defensible when challenged. Averaging conceals a methodological disagreement behind a number and would produce a different answer with a different pair of analysts. Restricting evidence to internal history systematically underestimates threats the firm has not yet experienced, which is precisely the ransomware case being argued. Escalating individual disagreements does not scale to a full register and puts the risk committee in the analyst's seat instead of the decision maker's.

   Source: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments

3. Question 3 · Information Security Program

   A manager proposed allowlisting on packaging line workstations. Engineering says recipe changes several times per shift would each need approval, halting production. Risk remains above appetite. What should the manager do NEXT?

   1. AWithdraw the proposal and record the risk as accepted by manufacturing engineering, which owns the production impact
   2. BImplement the allowlisting as proposed, since the assessed risk already exceeds the organization's stated risk appetite
   3. CIdentify compensating controls with engineering that meet the security objective, then present the residual risk to the risk owner
   4. DEscalate to the chief executive and request a directive requiring manufacturing engineering to comply with the control
   Show answer and explanation

   Correct answer

   Identify compensating controls with engineering that meet the security objective, then present the residual risk to the risk owner

   When a selected control conflicts with an operational requirement, the manager looks for an alternative that achieves the same security objective and then reports the remaining risk to the accountable owner for a decision. Forcing the original control ignores a legitimate business impact, walking away leaves an above-appetite risk untreated and misassigns acceptance, and escalating for a directive skips the analysis that would tell executives whether the conflict has a workable solution.

   Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

4. Question 4 · Incident Management

   Attackers are active on a port segment including crane control systems. The security lead wants immediate isolation; the operations director objects that three vessels are mid-discharge. What should the security manager do?

   1. AConvene the incident commander and the operations business owner to weigh operational consequence against security risk and record the decision
   2. BEscalate directly to the chief executive so that the most senior available authority makes the call on interrupting operations
   3. CInstruct the security team to isolate the segment immediately, because containing attacker access always takes precedence over commercial impact
   4. DDefer to the terminal operations director, since the accountable business owner is entitled to decide when their systems are interrupted
   Show answer and explanation

   Correct answer

   Convene the incident commander and the operations business owner to weigh operational consequence against security risk and record the decision

   Containment is a risk decision with business consequences, and the plan's role is to bring the technical assessment and the operational consequence together under someone empowered to choose and to be accountable for the choice. Isolating unilaterally treats security as superior to the business it exists to protect. Deferring wholly to operations lets commercial pressure decide a risk question without the security assessment in the balance. Jumping to the chief executive bypasses the governance structure that was built precisely to resolve this, and adds delay while the attacker remains active.

   Source: NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management