CISM Sample Questions and the 450 Passing Score, Explained

The passing score, up front

ISACA CISM results are reported on a scaled score from 200 to 800, and you need 450 or higher to pass. The scale is not a percentage — 450 is not "56 percent" — it is a scaled value ISACA derives from your performance across the paper, so do not try to back-calculate how many questions you can afford to miss. The exam itself is 150 multiple-choice questions in 4 hours, spread across four domains: information security governance, information risk management and compliance, information security program, and incident management.

CISM questions have a signature style you must learn to read. Most items present a management situation and offer two answers that are both defensible — a technically sound action and the action ISACA's doctrine prefers. The exam is testing whether you think like a security manager accountable to the business, or like an engineer reaching for the nearest technical fix. The five worked examples below are written in that style. Each one is original, and each explanation names the doctrine that decides it.

Five worked examples in the CISM style

Sample question 1. A security manager learns that ransomware has encrypted several file servers and the incident has been confirmed. What should the security manager do FIRST?

• A. Begin hardening the remaining servers against the same attack vector
• B. Activate the incident response plan and notify stakeholders according to the escalation policy
• C. Commission a forensic investigation to identify the root cause
• D. Restore the encrypted servers from the most recent backups

Correct answer: B. A confirmed incident triggers the plan. Activating the incident response plan and following the escalation and notification path is always the first move, because it mobilises the people, authority, and communication structure every later action depends on. The strongest distractor is D: restoring from backup feels decisive and is genuinely part of the response, but restoring before the incident process is running risks re-infecting clean systems, destroying evidence, and skipping the containment and notification steps the plan exists to sequence. Option A (hardening) and option C (forensics) are both legitimate — later. CISM consistently puts process before technology: the plan first, then the technical work inside it.

Sample question 2. A risk assessment shows that the cost of fully mitigating a particular risk exceeds the value of the asset it protects. Who has the authority to formally accept this residual risk?

• A. The information security manager
• B. The chief information security officer
• C. Senior business management
• D. The internal audit committee

Correct answer: C. Risk ownership sits with the business. Senior management owns the assets, the budget, and the consequences, so only senior business management can formally accept residual risk on the organisation's behalf. The strongest distractor is B: the CISO is the most senior security figure in the list, and in daily practice security leaders recommend, document, and track risk decisions — but recommending is not accepting. The security function's role is to quantify the risk, present treatment options, and record the decision, not to absorb business risk onto itself. Option D fails for a different reason: audit provides independent assurance and must stay independent of the decisions it later reviews. Whenever a CISM question asks who accepts a risk, the answer is the business owner of that risk.

Sample question 3. An organisation is building a new information security program. Which of the following is the MOST important factor in ensuring the program succeeds?

• A. Deploying best-of-breed security technologies across the estate
• B. Aligning the program with the organisation's business objectives
• C. Recruiting a larger team of certified security specialists
• D. Benchmarking the program against peer organisations

Correct answer: B. ISACA's doctrine is unambiguous: a security program exists to support business outcomes, and alignment with business objectives is what earns it funding, authority, and staying power. The strongest distractor is A — best-of-breed technology is real work that real managers genuinely prioritise, but technology chosen before the business case is understood becomes shelf-ware that protects the wrong things. Staffing (C) and benchmarking (D) are supporting activities; neither rescues a program the business sees as an obstacle. When CISM asks what is MOST important about a program, strategy, or initiative, look first for the answer about business alignment.

Sample question 4. A new data protection regulation affecting the organisation's industry has just come into force. What should the information security manager do FIRST?

• A. Purchase a compliance management tool to track the new requirements
• B. Perform a gap assessment comparing current practices against the regulation
• C. Update all security policies to reference the new regulation
• D. Schedule organisation-wide awareness training on the regulation

Correct answer: B. You cannot plan a response to a requirement you have not measured yourself against. The gap assessment establishes where the organisation already complies and where it does not, and every subsequent decision — budget, tooling, policy changes, training — depends on its findings. The strongest distractor is C: updating policies sounds like the administrative first step, but rewriting documents before knowing the gaps produces policy text that may miss the actual deficiencies and duplicate controls that already exist. Option A buys tooling to track a problem that has not yet been scoped, and D trains staff before anyone knows what behaviour needs to change. CISM rewards the sequence: assess first, then act on evidence.

Sample question 5. The information security manager is preparing the quarterly security report for the board of directors. Which of the following would be MOST valuable to include?

• A. The total number of vulnerabilities detected during the quarter
• B. A detailed list of blocked intrusion attempts by source address
• C. Trends in business risk exposure and the outcomes of security investments
• D. The percentage of systems compliant with the patching policy

Correct answer: C. Boards govern in the language of business risk and outcomes. A report that shows how risk exposure is trending and what the organisation got for its security spending supports real decisions about investment and risk appetite. The strongest distractor is D: patching compliance is a legitimate operational metric and belongs in a report to IT management, but as a board headline it is a technical activity measure that says nothing about whether the business is safer. Options A and B are raw operational counts — thousands of blocked attempts and detected vulnerabilities describe effort, not risk. The governing principle: report upward in business terms, report downward in technical terms, and never confuse the two audiences.

How to use samples like these

Worked examples only help if you study the reasoning, not the letters. For every CISM practice question you attempt, force yourself to name the doctrine before checking the answer: process before technology, the business owns risk, alignment before tooling, assess before acting. If your chosen answer and the doctrine disagree, that disagreement is the lesson — it shows you exactly where your instincts still run technical instead of managerial.

Pace matters too. Four hours for 150 questions is about 96 seconds per item, which is comfortable for knowledge questions and tight for the long judgement scenarios. Practise with full-length timed papers, score yourself by domain, and concentrate revision on the domain whose scenarios you keep deciding like an engineer. Timed, domain-scored free practice tests on Study4Pass are one way to run that diagnostic before the real sitting. Before booking, check how much the CISM exam costs, look for vouchers or discounts that could reduce the fee, and follow the CISM exam roadmap so your preparation runs in the right order.