CISM Readiness Test

10 questions, balanced across the exam's topics. Answer each one, then submit for your practice readiness estimate and per-topic breakdown. This is a practice estimate — not a prediction or guarantee of your official exam result.

Question 1

The program is unmeasured. Which of the following concepts is BEST illustrated by this scenario?

Remote work security program Security metrics program Identity and access management program Threat intelligence program

Question 2

In the context of Information Security Governance, which of the following BEST describes Board oversight of information security?

Documentation -- charters, policies, decisions -- makes governance auditable. The board oversees security strategy, risk, and investment -- accountability cannot be delegated. Governance metrics -- posture, risk trends, program performance -- inform oversight. The CISO leads the security program with sufficient authority and independence to challenge.

Question 3

In the context of Information Security Risk Management, which of the following BEST describes Residual risk management?

Ransomware assessment -- vectors and recovery -- addresses the full scenario. Residual risk -- after treatment -- must be within appetite and monitored. Project risk -- security in change -- needs lifecycle management. Investment -- prioritized by risk reduction -- maximizes security value.

Question 4

In the context of Information Security Incident Management, which of the following BEST describes Incident documentation?

Exfiltration response -- scope, contain -- limits data loss. Documentation -- timeline, actions -- supports learning and defense. Cloud response -- provider coordination, log access -- addresses cloud specifics. Lessons -- captured and applied -- compound response capability.

Question 5

Vulnerabilities age without ownership. As the information security manager, what should be done FIRST in this situation?

Recommend the scanner as the program Recommend the IT team handle it alone Require a program: find, prioritize, fix, verify. Scan without remediating

Question 6

Everyone assumes someone else handles security. As the information security manager, what should be done FIRST in this situation?

Recommend the CISO own everything Recommend collective responsibility Define and communicate security roles: named accountability. Accept ambiguity

Question 7

Security risk is considered at go-live. Assessments exist but do not affect project decisions. Given these circumstances, what is the BEST course of action?

Require influence: assessment must shape the project. Accept decorative assessment Recommend stopping all risky projects Recommend hiding risks to protect timelines

Question 8

Regulators are notified late. Notification happens but is inaccurate. What should the information security manager do in this situation?

Accept inaccurate notification Recommend notifying before facts are known Recommend the PR team draft alone Require accuracy: verify before notifying.

Question 9

IoT is invisible to the program. Which of the following is the MOST appropriate action for the information security manager?

Accept invisibility Recommend banning IoT Recommend the facilities team run it alone Require program coverage: discover and control.

Question 10

Security responsibilities are undefined across units. Structure exists but security staff lack authority. What should the information security manager do in this situation?

Recommend security as advisors only Require authority: responsibility needs power. Accept powerless roles Recommend the business override security

Unanswered questions count as incorrect. Your answers are graded on the server; no answer key is sent to your browser.

← Back to the CISM page

About Contact Privacy Policy Terms of Service Refund Policy

Home Exams Simulations WorkTrials GameScope Account