50 Free CISM Practice Questions — Certified Information Security Manager

Preparing for CISM? These questions cover all four domains.

---

Domain 1: Information Security Governance (Questions 1–12)

Question 1

What is the primary responsibility of senior management regarding information security?

a) Implementing security controls
b) Approving security policies and allocating resources
c) Monitoring daily security operations
d) Conducting risk assessments

Show Answer

Answer: b) Approving security policies and allocating resources

Explanation: Senior management sets the direction by approving security strategy, policies, and budget. Day-to-day operations are delegated to the security team.

Question 2

Which document defines the organization's security direction and principles?

a) Standard
b) Procedure
c) Policy
d) Guideline

Show Answer

Answer: c) Policy

Explanation: Policies are high-level management directives defining the security approach. Standards specify mandatory controls. Procedures detail steps. Guidelines provide recommendations.

Questions 3–12

[Full set covers governance frameworks, security strategy, metrics, organizational structures, awareness programs]

---

Domain 2: Information Security Risk Management (Questions 13–22)

Question 3

What is the difference between inherent risk and residual risk?

a) Inherent risk is risk before controls; residual risk is risk after controls
b) Residual risk is risk before controls; inherent risk is after
c) They are the same
d) Inherent risk is always higher than residual risk

Show Answer

Answer: a) Inherent risk is risk before controls; residual risk is risk after controls

Explanation: Inherent risk exists without any controls. Residual risk remains after controls are implemented. The goal is to reduce residual risk to an acceptable level.

Question 4

Which risk response involves outsourcing to an insurance company?

a) Avoidance
b) Mitigation
c) Transfer
d) Acceptance

Show Answer

Answer: c) Transfer

Explanation: Risk transfer shifts financial impact to a third party (insurance, contracts). Risk mitigation reduces likelihood/impact. Avoidance eliminates the activity. Acceptance acknowledges the risk.

Questions 5–22

[Full set covers risk assessment methodologies, BIA, risk appetite, third-party risk, risk reporting]

---

Domain 3: Information Security Program (Questions 23–36)

Question 5

Which framework provides a comprehensive set of security controls?

a) COBIT
b) NIST SP 800-53
c) ITIL
d) PMBOK

Show Answer

Answer: b) NIST SP 800-53

Explanation: NIST SP 800-53 provides a catalog of security and privacy controls for federal information systems. COBIT is for IT governance, ITIL for service management.

Question 6

What is the primary goal of a data classification scheme?

a) Encrypting all data
b) Applying appropriate protection based on data sensitivity
c) Reducing storage costs
d) Complying with all regulations

Show Answer

Answer: b) Applying appropriate protection based on data sensitivity

Explanation: Data classification labels data by sensitivity (Public, Internal, Confidential, Restricted) to apply proportional security controls. Not all data needs the same protection.

Questions 7–36

[Full set covers security controls selection, data classification, asset management, security architecture, compliance monitoring]

---

Domain 4: Incident Management (Questions 37–50)

Question 7

What is the first step in the incident response process?

a) Containment
b) Preparation
c) Detection
d) Recovery

Show Answer

Answer: b) Preparation

Explanation: Preparation (policies, team, tools, training) is the foundation of incident response. Without preparation, detection and response will be ineffective.

Question 8

What is the primary purpose of a post-incident review?

a) Assigning blame
b) Identifying lessons learned and improving the process
c) Documenting technical details
d) Calculating financial loss

Show Answer

Answer: b) Identifying lessons learned and improving the process

Explanation: Post-incident reviews (lessons learned) identify what worked, what didn't, and how to improve incident handling — focusing on process improvement, not blame.

Questions 9–50

[Full set covers IR plan development, team roles, forensic procedures, chain of custody, BCP/DRP testing]

---

How Did You Score?

Access all CISM practice questions →