Free ISACA CISM Actual Exam Questions

The BIA’s main job is figuring out which processes are critical and need to bounce back first, so I’d say A makes the most sense here. Recovery priorities come before setting specific metrics like RPO. A

I think D can be ruled out since vulnerability analysis is more about risk assessment, not impact analysis. Between A and B, maybe the main goal is to identify what needs recovery first, which points to A? But does defining RPO come before or after that?

Risk assessment is the core security role here, so D fits best.

A/C? Making sure the info security policy stays updated with changes (A) and proper documentation (C) seem crucial too, since changes can impact security rules and records. Risk advice is vital, but these keep the policy aligned and traceable.

It’s B for me. Real threats highlight the actual risks the company faces, so policies need to address those first to be effective and responsive, not just follow high-level strategies or standards.

It’s A for me. Business strategy sets the overall direction and priorities for the company, so security policies have to support that. If policies don’t align with what the business is trying to achieve, they could end up protecting things that don’t matter or missing what’s critical. Threats and frameworks are important, but they’re more about how to implement security rather than deciding what to focus on first. Industry standards help too, but they’re usually minimum requirements, not the main driver behind policy development.

I get why D makes sense, but I think B is actually stronger here. Industry frameworks are recognized standards that guide how to structure and run an info security program effectively. Aligning with them helps ensure you’re not missing crucial elements and stay compliant with best practices across the board. The security strategy (D) is important but usually built on top of those frameworks, so B feels like the foundational alignment for long-term success.

Wouldn’t B also be strong since industry frameworks offer proven structures to build on?

C imo, simulated phishing directly tests user awareness and initial response, which is a big part of actual incident handling, unlike walkthroughs or just penetration tests.

B. A black box test is more about seeing how the team handles unknown threats in real-time, which really tests their actual response skills instead of just planning or simulated attacks.

D imo, while categorization is part of triage, the main goal is to stop the threat from causing more damage ASAP. Without containment, even if you know what’s going on, the incident can escalate quickly. Coordination and mitigation come into play later, but containment is the immediate priority once you identify the threat.

Probably C here too. Triage is all about quickly figuring out what kind of incident you’re dealing with and how serious it is, so you can decide what to do next. Coordination (A) and containment (D) come after you know what you’re facing, and mitigation (B) is more of a long-term fix. So sorting and prioritizing events makes the most sense as the first step.

B, because if users can spot and report issues, culture is actually working.

C seems about structure, but does that alone prove culture success?

Probably B here. Even if you capture evidence first, without documenting the chain of custody, that evidence won't hold up in court. It's about making sure everything stays uncontaminated and accounted for legally. D is definitely out since rebooting can alter or destroy important data, and A’s more for criminal cases, not the primary civil process step. So yeah, securing proper documentation from the start is the way to go.

Maybe B makes the most sense since keeping the chain of custody intact is crucial for any legal process. If the evidence isn’t properly documented, it could get thrown out in court.

A/B? I get why some say C for accounting purposes, but I think the question is about the primary basis for asset value, not just book value. Replacement cost (A) or business cost when assets aren’t available (B) seem more relevant for real-world valuation. Between those two, B could matter if the asset is rare or hard to replace, making the business cost a better measure. So I’d pick B here as it reflects what you’d actually spend if the asset’s unavailable, which might be more practical than just replacement cost.

Maybe A makes the most sense here since replacement cost shows what you’d pay now to get the asset, which is relevant for real current value. Original cost minus depreciation (C) is more about historical cost and doesn’t reflect market changes. Total cost of ownership (D) is useful for decisions but isn’t typically how value gets determined in accounting. B seems off because business cost when assets aren’t available is too situational and not a standard valuation method.

I’m thinking option B might have a stronger case here. Training directly engages staff and helps them understand why the policies matter, which can build acceptance from the ground up. Management support is important, but if employees don’t get what’s expected of them through training, acceptance could still lag. Could training alone really drive better buy-in than visible management backing though?

It’s A because when senior management visibly supports security policies, employees take them more seriously. Without that tone from the top, even good training or funding might not get staff on board.

Maybe D here, because vulnerability assessments scan for current weaknesses that attackers could exploit right now, giving a more live snapshot of threats than a risk register, which might lag behind updates.

B seems solid since it lists all known risks, not just tech ones like C or D. But does it really reflect new threats quickly enough to be most comprehensive? Anyone think ongoing threat intel might be missing there?

A vs C? Insurance transfers risk rather than reducing it, so that’s not mitigation. Stopping the activity (B) is more about avoidance. The core of mitigation is controlling or lessening the risk, which fits improving security controls (C) perfectly, so definitely C here.

It’s C because mitigation means reducing risk, not avoiding it. Improving security controls lowers the chance or impact, which fits perfectly, unlike B which is straight-up avoidance.

C/D? I’d say D fits better since you want comprehensive info from all involved, not just risk owners. Interviews help capture a full picture, which is crucial for a solid BIA.

Option D seems key since the main goal of interviews is really to gather broad info from all relevant parties, ensuring no critical details slip through the cracks during the BIA.

C imo, risk owners usually sign off on treatment plans, not implement them directly.

A/B? I think B is less likely since control effectiveness is more an auditor or control owner job, but the risk owner definitely has to work closely on treatment, so A fits better than C or D.

B imo, having a solid plan ensures you can restore from backups effectively, not just having data.

B vs C, but B’s plan actually directs recovery actions, not just storing data.