CISM Practice Test 14 — 15 Questions

Question 1

A CISO is developing a security strategy. Which THREE elements should be included in a multi-year security roadmap?

Accepted Answer

Milestones for achieving target capability maturity levels. A roadmap should include milestones, resource allocation, and alignment with business objectives to guide implementation over time.

Answer

Current vulnerability scan results

Answer

Detailed network architecture diagrams

Question 2

An information security manager is designing a risk dashboard for the board of directors. Which of the following key risk indicators (KRIs) would be MOST effective for monitoring changes in the organization's security posture related to third-party risk?

Accepted Answer

Number of third-party vendors with critical or high-risk security findings.. KRIs should be leading indicators that predict risk changes. The number of third-party vendors with critical security findings is a direct measure of third-party risk and can indicate a rising risk trend before an incident occurs.

Answer

Average time to patch critical vulnerabilities in internal systems.

Answer

Number of successful phishing attacks against employees.

Answer

Percentage of vendors that have undergone security assessment in the last 12 months.

Question 3

Which capability maturity model (CMM) level is characterized by security processes being standardized and documented across the organization?

Accepted Answer

Level 3 - Defined. CMM Level 3 (Defined) involves standardized, documented processes.

Answer

Level 4 - Managed

Answer

Level 1 - Initial

Answer

Level 2 - Repeatable

Question 4

Which of the following is the PRIMARY responsibility of the CISO in an organization?

Accepted Answer

Owning the information security strategy and programme. The CISO is accountable for developing and maintaining the information security strategy and programme.

Answer

Managing the IT infrastructure

Answer

Auditing security controls

Answer

Performing day-to-day security operations

Question 5

What is the primary purpose of a security incident near-miss reporting culture?

Accepted Answer

To identify and address security gaps proactively. Encouraging reporting of near misses helps identify weaknesses and prevent future incidents.

Answer

To increase the security budget

Answer

To reduce the number of security policies

Answer

To assign blame for potential incidents

Question 6

Which of the following is the correct order in the security policy hierarchy, from highest to lowest level?

Accepted Answer

Enterprise Policy, Standards, Procedures, Guidelines. Enterprise policy sets the tone, followed by standards, then procedures, then guidelines.

Answer

Standards, Enterprise Policy, Procedures, Guidelines

Answer

Procedures, Standards, Enterprise Policy, Guidelines

Answer

Guidelines, Procedures, Standards, Enterprise Policy

Question 7

Which TWO factors are most important when prioritizing security investments? (Select TWO.)

Accepted Answer

The level of risk reduction achieved. Risk reduction and alignment with business strategy ensure investments address the most critical needs and support organizational goals.

Answer

The ease of implementation

Answer

The cost of the security solution

Answer

The popularity of the solution in the industry

Question 8

Which component is essential for building a strong security culture within an organization?

Accepted Answer

Executive sponsorship and visible leadership. Executive sponsorship demonstrates leadership commitment and sets the tone at the top.

Answer

Mandatory annual password changes

Answer

Increasing the security budget

Answer

Implementing the latest technology

Question 9

Which metric best indicates the effectiveness of a security awareness program in changing employee behavior?

Accepted Answer

Phishing simulation click rates. Phishing simulation click rates directly measure how employees respond to a common threat.

Answer

Percentage of employees who completed training

Answer

Number of security posters displayed

Answer

Number of training sessions delivered

Question 10

A CISO is reporting to the board of directors. Which metric would BEST demonstrate the effectiveness of the security program in reducing business impact?

Accepted Answer

Security investment vs. loss avoidance. Security investment vs. loss avoidance directly links spending to prevented losses, demonstrating ROI and program effectiveness to the board.

Answer

Number of security incidents

Answer

Patch compliance percentage

Answer

Mean time to detect (MTTD)

Question 11

A security manager is conducting a regulatory compliance review. Which THREE regulations are most likely to apply to a financial services company operating in the United States?

Accepted Answer

SOX (Sarbanes-Oxley Act). SOX applies to financial reporting, PCI DSS to payment cards, and sector-specific regulations may apply; GDPR is EU-specific.

Answer

HIPAA (Health Insurance Portability and Accountability Act)

Answer

GDPR (General Data Protection Regulation)

Question 12

An organization has a decentralized governance model where each business unit manages its own security. What is a key challenge of this model?

Accepted Answer

Inconsistent security policies and controls across units. Decentralized models often lead to inconsistent security practices and lack of standardization across the organization.

Answer

Lower cost due to elimination of central security team

Answer

Rapid decision-making due to fewer layers

Answer

Increased central control and uniformity

Question 13

An organization is implementing a hybrid governance model for information security. Which statement best describes this approach?

Accepted Answer

A central security team sets policies and provides oversight, while business units execute security operations. Hybrid combines centralized oversight with decentralized execution within business units.

Answer

All security decisions are made by a central security team

Answer

Each business unit has full autonomy over security without central coordination

Answer

Security is outsourced to a third-party provider

Question 14

Which capability maturity model (CMM) level indicates that security processes are measured and controlled?

Accepted Answer

Level 4: Managed. Level 4 (Managed) involves quantitative measurement and control of processes.

Answer

Level 3: Defined

Answer

Level 5: Optimizing

Answer

Level 2: Repeatable

Question 15

A company is considering a policy exception that would allow temporary non-compliance with a data encryption standard due to a legacy system. What is the most important element of the exception management process?

Accepted Answer

A documented remediation plan with timelines and risk acceptance. Exceptions must include a documented remediation plan and risk acceptance to ensure accountability.

Answer

Notification to all employees

Answer

Annual renewal without further review

Answer

Approval by the CISO only