Free ISACA CISM practice questions

Sample question 1. An analyst plans to examine the original seized hard drive directly because making a copy takes too long. What does SP 800-86 recommend?

1. Examining the original, since it is the most accurate source.
2. Working only on a verified copy.
3. Skipping the drive and relying on memory captures.
4. Wiping the drive after a quick look.

Sample question 2. The enterprise builds several AI features on top of pre-trained models downloaded from public repositories. What does the AI RMF expect regarding these models?

1. They can be trusted once downloaded, since they are widely used.
2. They must never be used for enterprise work.
3. They need checking only once, before first use.
4. They are monitored with the AI system as a whole.

Sample question 3. The enterprise has 2,400 suppliers and a small third-party risk team. How should the team decide where to focus?

1. Work through the supplier list in alphabetical order.
2. Focus on the suppliers with the highest annual spend.
3. Assess every supplier to the same depth each year.
4. Know the suppliers and prioritize them by criticality.