CISM Practice Test 13 — 15 Questions

Question 1

An organization is implementing a security culture measurement program. Which THREE metrics would BEST indicate a positive security culture?

Accepted Answer

Percentage of employees completing security training. A positive culture is reflected in proactive reporting, low error rates, and high engagement. Near miss reporting, training completion, and low human error incidents are key indicators.

Answer

Time since last security audit

Answer

Number of security incidents reported to management

Question 2

A CISO is building a business case for a new security tool. Which of the following approaches is MOST effective for justifying the investment?

Accepted Answer

Demonstrating how the tool reduces the likelihood and impact of a potential breach, translating to expected loss avoidance. Quantifying risk reduction in monetary terms directly links security investment to business value and risk management.

Answer

Highlighting that competitors are using the same tool

Answer

Comparing the tool's cost to industry averages for similar tools

Answer

Emphasizing the tool's advanced features and technical capabilities

Question 3

A multinational organization must comply with GDPR, CCPA, and PCI DSS. Which approach is MOST effective for managing these overlapping requirements?

Accepted Answer

Develop a unified compliance framework that maps controls to multiple regulations. A unified compliance framework reduces duplication and ensures consistent control application across regulations.

Answer

Outsource compliance management to a third-party consultant

Answer

Prioritize compliance based on the most stringent regulation

Answer

Assign separate teams to manage each regulation

Question 4

Which of the following best describes a key benefit of a centralized information security governance model?

Accepted Answer

Consistent enforcement of security policies and standards. Centralized models provide consistent application of controls and policies across the organization.

Answer

Greater autonomy for business units

Answer

Reduced need for executive oversight

Answer

Faster adaptation to local business needs

Question 5

Which TWO elements are key components of a security culture measurement program?

Accepted Answer

Phishing simulation click rates. Phishing simulation click rates and training completion rates are common quantitative measures of security culture.

Answer

Number of security policies

Answer

Vulnerability scan frequency

Answer

Firewall log size

Question 6

An organization's information security program has been operational for two years. The security manager is asked to propose changes to improve effectiveness. Which approach should the manager take first?

Accepted Answer

Conduct a maturity assessment of the current program.. Before making any changes, the security manager must first understand the current state of the program. A maturity assessment (e.g., using the CMMI or COBIT framework) evaluates the effectiveness, gaps, and capability levels of existing processes and controls. This baseline ensures that subsequent improvements are targeted and justified, rather than arbitrary or misaligned with the organization's actual needs.

Answer

Implement new security controls based on industry best practices.

Answer

Increase the security awareness training budget.

Answer

Revise the information security policy.

Question 7

Which of the following is the most significant risk in this architecture?

Accepted Answer

Direct SQL authentication from application server to database. Direct SQL authentication from the application server to the database bypasses any centralized authentication or service account management, creating a single point of failure for credential compromise. If the application server is breached, an attacker can extract hardcoded or stored database credentials and gain unfettered access to the database, leading to potential data exfiltration or destruction. This risk is magnified because direct SQL authentication often uses static, long-lived credentials without the layered controls (e.g., MFA, session auditing) that would be present in a more robust authentication path.

Answer

Segmentation of network zones

Answer

Admin access via VPN and jump host

Answer

Use of TLS 1.3 for encryption

Question 8

Which TWO components are essential for an effective information security governance framework?

Accepted Answer

Board-level oversight of security programs. Board-level oversight and alignment with business objectives are foundational to governance, ensuring security is integrated into organizational strategy.

Answer

Implementation of an intrusion detection system

Answer

Detailed technical configuration guides

Answer

Daily threat intelligence feeds

Question 9

Which of the following is the FIRST step in the security policy development lifecycle?

Accepted Answer

Gap analysis. The lifecycle begins with gap analysis to identify missing or outdated policies before drafting or approval.

Answer

Legal review

Answer

Approval

Answer

Stakeholder consultation

Question 10

A CISO is developing a multi-year security roadmap. Which approach best ensures the roadmap aligns with business strategy?

Accepted Answer

Align security initiatives with the organization's strategic business objectives. Roadmaps should be derived from business objectives to ensure relevance and executive support.

Answer

Prioritize initiatives based on security team capacity

Answer

Base the roadmap on the latest industry threat intelligence

Answer

Create the roadmap based on compliance requirements only

Question 11

An organization has a decentralized governance model where each business unit manages its own security team. The CISO reports to the CIO. Which of the following is the GREATEST risk associated with this structure?

Accepted Answer

Inconsistent enforcement of security policies across business units. In a decentralized model, inconsistent security practices across business units can lead to gaps in protection and difficulty in enforcing enterprise-wide standards.

Answer

Difficulty in achieving economies of scale for security operations

Answer

Lack of skilled security personnel in some business units

Answer

Increased cost due to duplication of security tools

Question 12

In a Capability Maturity Model (CMM) for information security processes, which level is characterized by processes being measured and controlled?

Accepted Answer

Level 4 (Managed). Level 4 (Managed) involves quantitative measurement and control of processes.

Answer

Level 5 (Optimizing)

Answer

Level 2 (Repeatable)

Answer

Level 3 (Defined)

Question 13

The board of directors has requested a security metrics dashboard. Which metric would BEST demonstrate the effectiveness of the incident response process?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) directly measures the speed and effectiveness of incident response.

Answer

Percentage of users trained

Answer

Number of security incidents

Answer

Patch compliance percentage

Question 14

An organization is designing a security metrics dashboard for the board of directors. Which THREE metrics are most appropriate for board-level reporting?

Accepted Answer

Patch compliance percentage for critical systems. These metrics provide strategic insight into security effectiveness and compliance.

Answer

Average age of security patches in days

Answer

Number of intrusion detection alerts per day

Question 15

An organization has a decentralized governance model with security teams embedded in each business unit. The CISO is concerned about inconsistent security controls across the enterprise. What is the BEST recommendation to address this?

Accepted Answer

Adopt a hybrid governance model with enterprise-wide standards and local execution. A hybrid model combines the benefits of centralized oversight with decentralized execution, ensuring consistency while maintaining business unit flexibility.

Answer

Conduct a risk assessment to prioritize controls

Answer

Implement a centralized security operations center (SOC) to monitor all units

Answer

Move to a fully centralized governance model