ISACA CISM Practice Test

CISM practice test: what's covered

• Certified Information Security Manager

Free CISM sample questions

1. A newly appointed CISO is asked to "improve security" at a manufacturing firm with no formal program. Which action should the CISO take FIRST?

   • A. Procure a SIEM and managed detection service
   • B. Understand the business strategy, regulatory obligations and risk appetite, and align an information security strategy to them
   • C. Mandate company-wide security awareness training
   • D. Hire additional security analysts
   Show answer

   Correct: B. CISM is manager-first: governance precedes operations. A strategy must align with business objectives before tools, training, or staffing decisions are made. Buying a SIEM (option B) is the classic technician trap — it locks in tooling before the program direction is defined and almost always leads to misalignment with what the business actually needs.

2. The board asks for a single metric that demonstrates the maturity of information security governance. Which is MOST appropriate to report?

   • A. Number of vulnerabilities patched per month
   • B. Degree of alignment between information security strategy and business strategy, evidenced through documented and approved governance artefacts
   • C. Annual security training completion percentage
   • D. Mean time to detect (MTTD) for incidents
   Show answer

   Correct: B. At the governance level, the board cares about strategic alignment — not operational metrics. Patch counts and MTTD are program-level KPIs. Training completion is a program metric. The most representative governance metric is whether the strategy is demonstrably aligned with business objectives.

3. Who is ULTIMATELY accountable for information security at an organisation?

   • A. The Chief Information Security Officer (CISO)
   • B. The Board of Directors and senior management
   • C. The Chief Information Officer (CIO)
   • D. The Data Protection Officer (DPO)
   Show answer

   Correct: B. Accountability for information security cannot be delegated. The board and executive management are ultimately accountable; the CISO is responsible for execution. Confusing accountability (board) with responsibility (CISO) is one of the most common CISM mistakes.

4. A steering committee for information security is being formed. Which TWO members are MOST important to include for an effective governance committee? (Choose 2)

   • A. Head of Legal / General Counsel
   • B. Head of a major business unit representing revenue-generating operations
   • C. Security operations analyst
   • D. External penetration tester
   • E. Junior compliance auditor
   • F. Help-desk team lead
   Show answer

   Correct: A and B. Governance steering committees must include business and legal leadership to align security with strategy and obligations. SOC analysts, pentesters, and help desk are operational roles — important to the program but not governance. Putting only technical staff on a steering committee is a classic CISM trap.

5. A CISO presents a business case to deploy a new identity governance platform. Which element will MOST influence senior management approval?

   • A. A list of new product features
   • B. A risk-based cost-benefit analysis linking the investment to reduced business risk and measurable outcomes
   • C. A demonstration of the user interface
   • D. The vendor's market analyst ratings
   Show answer

   Correct: B. Executive sponsors approve investments tied to business outcomes — reduced risk, regulatory alignment, productivity gains. Features and UI matter to operators, not to boards. Always anchor the business case in risk and value.

Last updated: 2026-10-19

CISM practice test FAQ

Related practice tests

• CISA practice test
• CRISC practice test
• CGEIT practice test
• CISSP practice test
• CCSP practice test
• ISO 27001 practice test