A security manager must choose between two controls to mitigate a risk. Control A costs $50,000 and reduces risk by 80%. Control B costs $20,000 and reduces risk by 50%. The organization's risk appetite is low, and the budget is limited to $30,000. What should the security manager do?

Implement Control A and defer other security projects

Implement Control A and seek additional budget approval

Implement Control B and accept the residual risk

Implement both controls by reallocating funds from other projects

After a penetration test, the security team found that a critical application has a SQL injection vulnerability. The remediation plan must be prioritized based on risk. What should the team do first?

Immediately apply a web application firewall (WAF) rule to block SQL injection attempts

Document the vulnerability and accept the risk based on the current risk appetite

Develop a patch or code fix and schedule it for the next release cycle

Implement a temporary workaround, such as input validation, and plan a permanent fix

A hospital is integrating a new security information and event management (SIEM) system into its existing IT infrastructure. The integration must not interfere with critical patient care systems. What is the best way to integrate the SIEM?

Use passive network taps or log forwarding to collect data without affecting system performance

Connect the SIEM directly to all critical systems to ensure complete visibility

Deploy the SIEM in a test environment and only monitor non-critical systems

Install the SIEM agent on every server, including those running patient monitoring

A security assessment revealed that a legacy application has a known vulnerability that cannot be patched because the vendor no longer supports it. The application is critical to business operations. What is the most appropriate remediation action?

Accept the risk without any action because the application is critical

Remove the application from the network immediately

Upgrade the application to a newer version regardless of cost

Implement compensating controls, such as network segmentation and strict access controls

A healthcare organization is implementing new security controls to comply with data protection regulations. The risk assessment identified that patient records are at high risk of unauthorized access. Which control design principle should be prioritized when designing the access control solution?

Use a virtual private network (VPN) for all remote access to the network

Implement a single sign-on (SSO) system to simplify user access across all applications

Apply the principle of least privilege, granting users only the access necessary for their roles

Deploy a network access control (NAC) solution to restrict devices on the network

Certified Information Security Manager

Domain 3Objective 2

Program Implementation and Operations CISM Practice Questions (Page 5)

Part of the Domain 3: Information Security Program domain, which accounts for 33% of the CISM exam.

32questions here

7free pages

8concepts

33%of the exam

Questions 21–25

21expert · hard
A security manager must choose between two controls to mitigate a risk. Control A costs $50,000 and reduces risk by 80%. Control B costs $20,000 and reduces risk by 50%. The organization's risk appetite is low, and the budget is limited to $30,000. What should the security manager do?
Select an answer first
22application · medium
After a penetration test, the security team found that a critical application has a SQL injection vulnerability. The remediation plan must be prioritized based on risk. What should the team do first?
Select an answer first
23application · medium
A hospital is integrating a new security information and event management (SIEM) system into its existing IT infrastructure. The integration must not interfere with critical patient care systems. What is the best way to integrate the SIEM?
Select an answer first
24application · medium
A security assessment revealed that a legacy application has a known vulnerability that cannot be patched because the vendor no longer supports it. The application is critical to business operations. What is the most appropriate remediation action?
Select an answer first
25application · medium
A healthcare organization is implementing new security controls to comply with data protection regulations. The risk assessment identified that patient records are at high risk of unauthorized access. Which control design principle should be prioritized when designing the access control solution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.