CISM Practice Test 15 — 15 Questions

Question 1

Which regulatory requirement mandates that organizations implement data protection measures for personal data of EU citizens?

Accepted Answer

GDPR. GDPR is the primary regulation for personal data protection in the EU.

Answer

SOX

Answer

PCI DSS

Answer

HIPAA

Question 2

Which of the following is the PRIMARY reason for aligning the information security program with business objectives?

Accepted Answer

To demonstrate the value of security to the business and gain executive support. Aligning security with business objectives ensures that security investments support business goals and demonstrate value to stakeholders.

Answer

To reduce the cost of security operations

Answer

To comply with regulatory requirements

Answer

To ensure security initiatives receive adequate funding

Question 3

A multinational organization must comply with GDPR, CCPA, and PCI DSS. The security manager is designing a compliance monitoring program. Which approach is MOST efficient?

Accepted Answer

Map common controls to multiple regulations. Mapping controls to multiple regulations reduces duplication and ensures comprehensive coverage across requirements.

Answer

Create separate monitoring programs for each regulation

Answer

Outsource compliance to a third-party

Answer

Focus only on the strictest regulation

Question 4

Which of the following is the PRIMARY benefit of having a formal policy exception management process?

Accepted Answer

Ensuring consistent treatment of exceptions with proper risk acceptance. A formal process ensures that exceptions are documented, reviewed, and approved, reducing uncontrolled risk.

Answer

Eliminating all security risks

Answer

Reducing the number of security policies

Answer

Automating policy enforcement

Question 5

A CISO is reporting to the board on the effectiveness of the security programme. Which TWO metrics are MOST appropriate for board-level reporting? (Select TWO)

Accepted Answer

Mean time to detect (MTTD) and mean time to respond (MTTR). Board-level metrics should focus on strategic impact, such as overall risk posture and financial implications.

Answer

Number of firewall rules changed

Answer

Number of employees who completed security training

Answer

Patch compliance percentage

Question 6

An organization is developing a security policy for remote access. According to the policy hierarchy, where should this policy fit?

Accepted Answer

Domain-specific standard. Enterprise security policy is high-level; domain-specific standards provide mandatory requirements for specific areas like remote access.

Answer

Procedure

Answer

Guideline

Answer

Enterprise security policy

Question 7

A CISO is preparing a business case for a new security investment. Which TWO elements are most important to include to justify the investment?

Accepted Answer

Breach cost avoidance based on industry benchmarks. Risk reduction value and breach cost avoidance directly quantify the benefits.

Answer

Vendor reputation

Answer

Ease of implementation

Answer

Number of security team members

Question 8

A policy exception management process allows a business unit to temporarily deviate from a security policy. What is the MOST important requirement for such an exception?

Accepted Answer

Implementation of compensating controls. Compensating controls are essential to mitigate the risk of the exception, ensuring the organization's risk posture is acceptable.

Answer

Documentation of the exception

Answer

Approval by the CISO only

Answer

A fixed expiration date

Question 9

A CISO is presenting a security investment proposal to the board. Which two metrics are most effective for articulating the business value of the investment?

Accepted Answer

Breach cost avoidance. Breach cost avoidance directly quantifies risk reduction, and compliance cost avoidance shows regulatory value.

Answer

Mean time to patch

Answer

Number of security staff

Answer

Number of security tools deployed

Question 10

A CISO is building a business case for a new security tool. Which approach BEST articulates the return on investment (ROI) to the board?

Accepted Answer

Risk reduction value minus total cost of ownership. Risk reduction value quantifies the expected reduction in loss, which directly ties to business value.

Answer

Total cost of ownership (TCO) compared to competitors

Answer

Compliance with industry standards

Answer

Number of alerts the tool will generate

Question 11

An organization's board of directors wants to improve security culture. Which initiative would have the GREATEST impact?

Accepted Answer

Establishing executive sponsorship of security. Executive sponsorship from the board demonstrates top-down commitment, which is critical for driving cultural change.

Answer

Increasing the security awareness training budget

Answer

Implementing a near-miss reporting system

Answer

Conducting monthly phishing simulations

Question 12

A CISO is developing a multi-year security roadmap aligned with business strategy. The organization is in a highly regulated industry with frequent regulatory changes. Which of the following should be the PRIMARY driver for prioritizing security initiatives?

Accepted Answer

Alignment with current and upcoming regulatory requirements. While risk reduction is important, in a highly regulated environment with frequent changes, compliance alignment ensures the organization avoids legal penalties and maintains business continuity.

Answer

Reduction of the mean time to detect (MTTD) security incidents

Answer

Cost savings from consolidating security tools

Answer

Achieving a target capability maturity model (CMM) level

Question 13

Which of the following is the PRIMARY role of the board of directors in information security governance?

Accepted Answer

Providing oversight and ensuring security is aligned with business strategy. The board sets the tone from the top and ensures security is integrated into organizational strategy and risk management.

Answer

Conducting daily security operations

Answer

Developing detailed security policies

Answer

Approving specific security technologies

Question 14

Which of the following is the primary responsibility of the board of directors in information security governance?

Accepted Answer

Setting risk appetite and overseeing security governance. The board is responsible for oversight, ensuring security aligns with business strategy and risk appetite.

Answer

Implementing day-to-day security operations

Answer

Conducting vulnerability assessments

Answer

Writing security policies

Question 15

An organization is deciding whether to adopt a centralized or hybrid security governance model. Which factor MOST strongly favors a hybrid model?

Accepted Answer

High degree of autonomy needed by business units with diverse needs. A hybrid model allows business units to maintain some autonomy while benefiting from central standards and oversight.

Answer

Minimal security budget

Answer

Low regulatory requirements

Answer

Uniform security across all business units