EN简体繁體
Sign in
Home / ISACA / CISM
ISACA · CISM

CISM Exam Practice Questions

Certified Information Security Manager

CISM English PDF practice questions: 870 questions in source order, with options supported by the source format, answers and available explanations. Access covers this exam only. One-time payment; no automatic renewal.

Exam overview

For security managers directing governance, risk management, security programs and incident management.

ISACA has announced a revised CISM outline effective November 3, 2026. Use the outline for your exam date.

Exam code
CISM
Official exam / credential
Certified Information Security Manager
Exam format
Multiple-choice questions
Exam duration
240 minutes
Official exam questions
150 questions
Official exam languages
English, Spanish, Simplified Chinese, Japanese, French, German

Official exam languages and practice-question file languages are listed separately. Confirm the exam version and available languages when booking with the provider.

Official sources: Provider reference 1 · Provider reference 2
Information checked: 2026-10-20

Supported languages

  • English
  • Simplified Chinese
Try before you buy

First 20 practice questions

870 total questions

Questions follow the source order. Expand each answer to see its explanation.

Disclaimer: All questions on ExamPico are compiled from internet sources and are provided for study reference only.

Question 16

Question#16Topic1

What does a gap analysis do?
  1. Shows the change from one point in time to another in the history of incident response plans in any organization
  2. Addresses potential or frequent vulnerabilities with commonly used services
  3. Identifies a lack of patches and security configurations for devices in a network
  4. Identifies an organization's current incident response and where it aims to be
Show answer and explanation

Answer

D

Explanation

Correct answer: Identifies an organization's current incident response and where it aims to be A gap analysis identifies an organization's current incident response and where it aims to be. This allows the organization to identify weaknesses, improve, advance, and identify additional resources needed for this advancement. A gap analysis does not show the change from one point in time to another in the history of incident response plans. It also doesn't address potential or frequent vulnerabilities with commonly used services or identify a lack of patches and security configurations like a vulnerability scanner would.CISM Review Manual, 16th Edition. Pg 270.

Question 17

Question#17Topic1

Aaron is the information security manager responsible for incident response management. He works for a fast-growing company that is expanding into many other countries. What is the challenge he is MOST LIKELY facing?
  1. Lack of communication process
  2. Lack of management buy-in and consensus
  3. Incident Management Team (IMT) turnover
  4. Mismatch to organizational goals and structure
Show answer and explanation

Answer

D

Explanation

Correct answer: Mismatch to organizational goals and structure A mismatch to organizational goals and structure is the most likely problem with a fast-growing company. It is simply likely that the IMT and their plans will not keep up with the growth (according to ISACA; this may not be true for your business). The other options are all sources of challenges. They may be what you are facing in your business, but the exam is about what is most likely: the rule, not the exception.CISM Review Manual, 16th Edition. Pg 272–273.

Question 18

Question#18Topic1

While working through the protect phase of the incident response lifecycle, a known issue is discovered on a server. The server is subsequently fixed. The issue is called a:
  1. Threat
  2. Vulnerability
  3. Incident
  4. Patch
Show answer and explanation

Answer

B

Explanation

Correct answer: Vulnerability A vulnerability is a weakness in a system (or other places). The vulnerability could be exploited and result in a compromise. The compromise would be an incident. The patch is the standard fix for weaknesses within the code of a server, its Operations System (OS), or applications. The threat is the damage that this incident could cause.CISM Review Manual, 16th Edition. Pg 269.

Question 19

Question#19Topic1

It is MOST LIKELY that the information and information related systems incident response responsibility belongs to the:
  1. Chief Risk Officer (CRO)
  2. Information security manager
  3. Chief Executive Officer (CEO)
  4. Board of Directors (BoD)
Show answer and explanation

Answer

B

Explanation

Correct answer: Information security manager The information security manager is most likely to be responsible for information security incidents. The Chief Executive Officer (CEO) or Board of Directors (BoD) would be accountable. If not accountable, they would be informed. The Chief Risk Officer (CRO) would be consulted and informed.CISM Review Manual, 16th Edition. Pg 256.

Question 20

Question#20Topic1

A database that is critical for the functioning of the business that Alice works for must be back online within 15 hours to ensure the corporation will survive a fire in the data center. Her team has calculated that emergency response to the fire and the damage assessment will take approximately four hours. After the disaster is declared, they have 11 remaining hours. What is the 11-hour window referred to as?
  1. Recovery Point Objective (RPO)
  2. Maximum Tolerable Outage (MTO)
  3. Service Delivery Objective (SDO)
  4. Recovery Time Objective (RTO)
Show answer and explanation

Answer

D

Explanation

Correct answer: Recovery Time Objective (RTO) The RTO has three definitions in the ISACA manual. Due to the way this scenario is constructed, it is the only answer to the question. RTO could be the entire time of nonfunctionality, the time from failure to technical recovery, or, as in this question, the time from disaster declaration to operational status. The RPO is the age of the data that is recovered from something like a backup tape. The MTO is the amount of time that the corporation can tolerate being in the alternate processing mode. The SDO is the percentage of functionality that must be at the alternate processing site.CISM Review Manual, 16th Edition. Pg 286.

Downloads and personal use

  • Purchase this exam question set separately with 1, 3, 6 or 12 months of download access.
  • After payment confirmation, your library shows the download link and exact expiry time.
  • Download again during your term. Purchase a new term after expiry.
  • PDFs are licensed for personal study only and must not be resold or shared publicly.
  • Files already saved to your device are not remotely deleted when access expires.
How to choose your certification