CISM Practice Test 16 — 15 Questions

Question 1

An organization's board of directors wants to ensure that security activities align with business objectives. Which governance practice best supports this alignment?

Accepted Answer

Developing a multi-year security roadmap tied to business strategy. A security strategy that directly references business goals ensures that security investments and initiatives support organizational priorities.

Answer

Conducting annual security awareness training

Answer

Implementing a decentralized security model

Answer

Hiring a CISO with a technical background

Question 2

Which of the following is the PRIMARY responsibility of the board of directors regarding information security governance?

Accepted Answer

Setting the strategic direction and oversight of the security programme. The board is responsible for ensuring that information security is aligned with business objectives and that adequate resources are allocated.

Answer

Performing technical vulnerability assessments

Answer

Approving specific security tools and technologies

Answer

Conducting daily security monitoring activities

Question 3

Which of the following is the FIRST step in the security policy development lifecycle?

Accepted Answer

Gap analysis. A gap analysis identifies current state vs. desired state, which is necessary before drafting policy.

Answer

Legal review

Answer

Stakeholder consultation

Answer

Drafting the policy

Question 4

Which board-level metric is MOST useful for measuring the effectiveness of the incident response process?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) directly measures how quickly incidents are contained and remediated.

Answer

Patch compliance percentage

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 5

A CISO is building a business case for a new security tool. Which TWO metrics would BEST justify the investment to senior leadership?

Accepted Answer

Compliance cost avoidance. Senior leadership cares about financial impact. Breach cost avoidance and compliance cost avoidance directly demonstrate value by reducing potential losses.

Answer

Mean time to respond (MTTR) improvements

Answer

Phishing simulation click rate

Answer

Number of vulnerabilities discovered

Question 6

What is the first step in the security policy development lifecycle?

Accepted Answer

Gap analysis. Gap analysis identifies missing or inadequate controls before drafting new policies.

Answer

Legal review

Answer

Drafting the policy

Answer

Stakeholder consultation

Question 7

Which governance model is characterized by a single, centralized security team that serves the entire organization?

Accepted Answer

Centralized. Centralized governance consolidates security resources and authority under one team, ensuring consistent policy enforcement and streamlined management.

Answer

Federated

Answer

Decentralized

Answer

Hybrid

Question 8

A financial services firm is subject to SOX, PCI DSS, and GDPR. The CISO needs to implement a regulatory change management process. Which THREE steps are essential?

Accepted Answer

Assess impact on existing controls. Monitoring regulatory changes, assessing impact, and updating controls are critical to maintaining compliance.

Answer

Immediately enforce all changes regardless of cost

Answer

Outsource compliance to a single vendor

Question 9

A CISO is designing a security metrics program for the board. Which TWO metrics are MOST appropriate for board-level reporting?

Accepted Answer

Security investment vs. loss avoidance. Mean time to respond (MTTR) and security investment vs. loss avoidance are strategic metrics that inform risk management and resource allocation.

Answer

Phishing simulation click rate

Answer

Average patch deployment time

Answer

Number of firewall rules

Question 10

During a policy exception review, the CISO identifies that multiple exceptions have been granted for the same control due to business constraints. What is the best course of action?

Accepted Answer

Revise the policy to accommodate the business need. Addressing root causes reduces reliance on exceptions and strengthens the security posture.

Answer

Escalate to the board for approval

Answer

Increase monitoring of excepted systems

Answer

Reject all future exceptions for that control

Question 11

Which of the following is the BEST metric for the board to assess the security program's effectiveness in detecting threats?

Accepted Answer

Mean time to detect (MTTD). Mean time to detect (MTTD) directly measures the speed of threat detection, a key indicator of detection capability.

Answer

Patch compliance percentage

Answer

Number of security incidents

Answer

Phishing simulation click rate

Question 12

Which board-level committee typically receives security reports to provide oversight?

Accepted Answer

Audit/risk committee. The audit/risk committee is responsible for oversight of risk management and control, including security.

Answer

Nominating committee

Answer

Compensation committee

Answer

Finance committee

Question 13

A CISO is developing a multi-year security roadmap. Which of the following should be the PRIMARY driver for prioritizing initiatives?

Accepted Answer

Alignment with business strategy and risk appetite. The roadmap must align security initiatives with the organization's strategic business objectives to ensure relevance and support.

Answer

Ease of implementation

Answer

Availability of new technology

Answer

Cost of the initiative

Question 14

Which of the following best describes the role of the chief information security officer (CISO) in a governance context?

Accepted Answer

The CISO oversees the security program and reports to executive leadership. The CISO is responsible for developing and implementing the security program, reporting to executive leadership.

Answer

The CISO delegates all strategic decisions to the CIO

Answer

The CISO is a peer to the board with voting rights

Answer

The CISO is primarily a technical role focused on firewall management

Question 15

An organization is implementing a security awareness program. Which metric is MOST indicative of a positive security culture?

Accepted Answer

High near-miss reporting rate. A high near-miss reporting rate indicates that employees are vigilant and willing to report potential issues without fear of blame.

Answer

Low number of incidents caused by human error

Answer

Low phishing simulation click rate

Answer

High training completion percentage