CISM practice examsIn development
Certified Information Security Manager
The CISM certification validates expertise in managing and governing an enterprise information security program. It focuses on security strategy, risk management, program development, and incident management from a managerial perspective.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Information Security Governance | 17% |
| Information Security Risk Management | 20% |
| Information Security Program | 33% |
| Incident Management | 30% |
Two sample questions
1. An organization's RTO for its customer portal is 4 hours, but the last disaster recovery test showed actual recovery took 12 hours. What should the security manager do?
- Identify the bottlenecks causing the gap and implement improvements to meet the business-defined RTO — correct
- Change the RTO to 12 hours to match reality to support the organizations risk management objectives effectively
- Outsource disaster recovery to meet the RTO as part of the ongoing security monitoring and assessment process
- Accept the discrepancy since real disasters rarely happen
Why: The RTO is defined by business needs. When testing reveals the RTO cannot be met, the security manager should identify and address the specific bottlenecks preventing timely recovery. Changing the RTO to match poor performance does not address the business requirement.
2. An organization wants to establish a security champions program within its development teams. What is the MOST important success factor?
- Requiring security champions to complete the same training curriculum as full-time information security analysts
- Providing champions with appropriate training, tools, and recognition while keeping their primary development role intact — correct
- Selecting only the most senior developers as champions regardless of their interest in security-related activities
- Transferring all application security testing responsibilities from the security team to the security champions group
Why: Security champions are most effective when they receive appropriate training and tools, are recognized for their contributions, and maintain their primary development role, serving as embedded security advocates.
The real CISM exam
| Length | 240 minutes (4 hours) |
|---|---|
| Questions | 150 |
| Pass mark | 450 out of 800 |
| Price | $575 (ISACA members) / $760 (non-members) |
| Recommended before you sit it | 5+ years of information security management experience (waivers available for up to 2 years) |
| Valid for | 3 years |
Exam facts as published by ISACA; always check the vendor’s page before you book.
Study CISM with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.