CISM Practice Test 17 — 15 Questions

Question 1

In which reporting model does the CISO have a direct reporting line to the CEO while also reporting to the CIO on operational matters?

Accepted Answer

Solid line to CEO, dotted line to CIO. A dotted line reporting to the CIO and solid line to the CEO gives the CISO strategic authority while maintaining operational alignment.

Answer

Solid line to CIO, dotted line to CEO

Answer

Dotted line to both CEO and CIO

Answer

Solid line to both CEO and CIO

Question 2

An organization is implementing a new security policy. Which step should occur AFTER the policy is approved?

Accepted Answer

Training and communication. After approval, training and awareness are essential to ensure employees understand and comply with the policy.

Answer

Stakeholder consultation

Answer

Gap analysis

Answer

Legal review

Question 3

A security policy is being developed. Which THREE steps are part of the policy development lifecycle? (Select THREE)

Accepted Answer

Drafting the policy based on input. The lifecycle includes analysis, consultation, drafting, review, approval, training, and monitoring.

Answer

Conducting penetration testing

Answer

Implementing the policy in firewalls

Question 4

An organization is updating its information security strategy. Which THREE elements should be included to ensure alignment with business objectives? (Select THREE)

Accepted Answer

Risk appetite and tolerance levels defined by the board. Strategy must be driven by business needs, risk appetite, and regulatory requirements.

Answer

Daily monitoring schedule for security operations center

Answer

A detailed list of firewall ports to block

Question 5

An organization is subject to GDPR, PCI DSS, and SOX. What is the BEST approach to manage compliance with multiple regulations?

Accepted Answer

Develop a control framework that maps to all regulations. A unified compliance framework that maps common controls to multiple regulations reduces duplication and cost.

Answer

Assign each regulation to a separate compliance team

Answer

Implement the most stringent requirements for all

Answer

Focus only on the regulation with the highest fines

Question 6

A company is selecting a security control framework. They want a prioritized set of controls that are implementation group-based and address common cyber threats. Which framework best meets these requirements?

Accepted Answer

CIS Controls v8. CIS Controls v8 are organized into Implementation Groups (IG1, IG2, IG3) and provide a prioritized, threat-informed set of controls.

Answer

COBIT 2019

Answer

NIST SP 800-53

Answer

ISO 27001 Annex A

Question 7

An organization is implementing a security controls framework and needs to prioritize controls for a small business with limited resources. Which implementation group from CIS Controls v8 should be addressed first?

Accepted Answer

IG1. CIS Controls v8 defines Implementation Group 1 (IG1) as the basic set of controls for small businesses with limited resources. IG1 is designed to be the minimum standard and should be implemented first.

Answer

IG2

Answer

IG3

Answer

IG0

Question 8

Which TWO of the following are components of a typical vulnerability management program?

Accepted Answer

Remediating identified vulnerabilities through patching. Vulnerability management includes scanning for vulnerabilities and remediation (patching).

Answer

Conducting security awareness training

Answer

Monitoring network traffic for anomalies

Answer

Performing penetration tests

Question 9

A company is implementing a vendor tiering system for third-party risk management. Which TWO factors should be used to determine the tier of a vendor?

Accepted Answer

Criticality of the service provided by the vendor. Vendor tiering is typically based on the sensitivity of data the vendor accesses and the criticality of the service they provide. These factors determine the risk level and required controls.

Answer

Vendor's marketing budget

Answer

Vendor's stock price

Answer

Vendor's annual revenue

Question 10

A company maintains a security scorecard for the executive team. Which metric is MOST appropriate to include as a leading indicator on a one-page dashboard?

Accepted Answer

Phishing click rate. Phishing click rate is a leading indicator that measures user awareness and predicts future compromise risk.

Answer

Average cost per incident

Answer

Number of data breaches in the past year

Answer

Number of security tools deployed

Question 11

An organization's security budget is 12% of the IT budget. Which of the following best describes the maturity of this security program?

Accepted Answer

Mature, as it aligns with the 10-15% benchmark. Industry benchmarks indicate that mature security programs allocate 10-15% of IT budget to security. 12% falls within this range, suggesting a mature program.

Answer

Immature, because security should be less than 5% of IT budget

Answer

Mature, but only if it also includes a separate budget for compliance

Answer

Overbudgeted, as the ideal is 8% of IT budget

Question 12

In the context of defense-in-depth, which control provides protection at the network layer to prevent unauthorized access?

Accepted Answer

Firewalls. Firewalls are a network security control that filter traffic based on rules.

Answer

Encryption of data at rest

Answer

Antivirus software

Answer

Security awareness training

Question 13

A company is developing security metrics to present to the C-suite. Which metric is a leading indicator of security performance?

Accepted Answer

Percentage of user access reviews completed on time. Leading indicators predict future security outcomes. Access review completion rates indicate how well access controls are managed, which reduces risk of unauthorized access.

Answer

Mean time to detect (MTTD) security incidents

Answer

Total cost of security incidents

Answer

Number of data breaches in the past quarter

Question 14

An organization's CISO reports to the CIO. The CISO is concerned that security initiatives are often deprioritized due to conflicts of interest. Which reporting structure would best address this concern?

Accepted Answer

Reporting to the board or risk committee. Reporting to the board or a risk committee provides independent oversight and reduces conflicts inherent in reporting to IT or operations.

Answer

Reporting to the CEO

Answer

Reporting to the COO

Answer

Reporting to the CFO

Question 15

A CISO is establishing a vendor risk management (TPRM) program. Which THREE of the following are key components of an effective TPRM program?

Accepted Answer

Exit procedures to ensure data is returned or destroyed.. A TPRM program includes onboarding risk assessment, ongoing monitoring, and exit procedures to manage risks throughout the vendor lifecycle.

Answer

Performing a single annual assessment for all vendors.

Answer

Requiring all vendors to have ISO 27001 certification.