Practice CISM exam questions across 4 domains. Detailed answer explanations. Start with 10 free questions — no signup required.
Loading practice session...
CISM is a ISACA certification with approximately 150 questions in 240 minutes. The table below shows the exam weighting published for each domain, so you can decide where to spend your study time instead of working through the syllabus in order.
| Domain | Exam weight | What it covers |
|---|---|---|
| Information Security Program | 33% | Develop and manage the information security program |
| Incident Management | 30% | Plan, establish, and manage incident response capability |
| Information Risk Management | 20% | Manage information risk to an acceptable level |
| Information Security Governance | 17% | Establish and maintain an information security governance framework |
A passing study plan usually trails the weighting: spend the most sessions on Information Security Program (33%), then check the next domain down before moving on. If your accuracy on a high-weight domain stays under 80%, more practice there is worth more than another pass at a low-weight topic.
These questions come from the CISM practice bank. Read the rationale even when you answer correctly — the explanation is usually where the exam technique lives.
A breach at Wharfedale Retail affecting customer payment data was confirmed at eleven o'clock on a Friday. The security team has contained the incident, and the legal team is still debating whether the notification deadline applies. Which action should the chief information security officer take?
Answer: A. Option A is correct because a decision to start the regulatory notification clock and prepare advice within it reflects the fact that the duty runs from awareness of the incident, so the assessment must be prepared inside the window. Waiting for legal certainty in Option B risks the deadline passing, and delaying until forensics conclude in Option D can extend well beyond the permitted period. Contacting customers before the regulator in Option C may misstate the position if obligations differ by jurisdiction.
A phishing campaign has now hit the same department three times in two months, and each time staff report it late. An after-action review finds that the response was handled ad hoc, no one owned follow-up, and the same control gaps were noted each time. Which output should the review produce to prevent the pattern from repeating?
Answer: B. Option B is correct: a revised response plan with corrective actions, assigned owners, and target dates. Lessons learned only change outcomes when each gap becomes a tracked action with accountability and a deadline. Option A is incorrect because discipline does not address the missing reporting path or the ad hoc response. Option C is incorrect because buying another filter skips the process gaps the review actually found. Option D is incorrect because a press statement is a communication artefact, not a corrective action.
The audit committee of a national health insurer has asked the newly appointed chief information security officer to explain how security spending is directed. Members observe that funding requests arrive as isolated technology purchases with no stated link to the business plan, and the regulator wants evidence that direction flows from the board. Which action should the officer recommend FIRST?
Answer: C. Option C is correct because a chartered steering committee gives the board explicit ownership of direction and risk appetite, which is the governance evidence the audit committee cannot currently produce. Consolidating purchases into one budget line changes accounting treatment without creating board direction. A control mapping lists safeguards but does not establish who decides strategy or how much disruption is acceptable. A penetration test demonstrates technical exposure rather than board authority over security investment.
You can answer 10 CISM practice questions free without creating an account. Each one is graded instantly with a written explanation. A free account keeps your progress, and the full bank (300+ questions) unlocks with a subscription.
The CISM exam is organised into 4 domains: Information Security Program (33%), Incident Management (30%), Information Risk Management (20%), Information Security Governance (17%). The weighting above shows how much of the exam each domain represents, so budget study time in the same proportion.
The CISM exam has approximately 150 questions in 240 minutes, with a passing score of 450. Practice sets here are scored the same way as the real exam so you can see whether you are above or below the line before test day.
Start with Information Security Program, the highest-weighted domain, then work down the list. Answer a mixed set after each domain pass — mixing domains forces you to identify what a question is asking before recalling the content, which is what the real exam does.
No. These are original practice questions written against the published CISM exam objectives. They mirror the style, difficulty, and domain weighting of the real exam, but the actual exam content is confidential and is not reproduced here.
A practice set shows you where you are; the rest of the CISM cluster shows you what to do next. Work through the domain checklist, then return here for another mixed set.