CISM Practice Test 18 — 15 Questions

Question 1

A global e-commerce company is designing its information security program. The CISO wants to implement a defense-in-depth strategy for the web application layer. Which combination of controls best achieves this objective?

Accepted Answer

WAF, input validation, and security logging. Option B is correct because defense-in-depth requires multiple layers of controls: detection (WAF), prevention (input validation), and response (monitoring). Option A is wrong as IDS alone is detection only. Option C is wrong as patching is a single layer. Option D is wrong as encryption provides confidentiality but not attack prevention.

Answer

SSL/TLS encryption and VPN access

Answer

Web application firewall (WAF) and intrusion detection system (IDS)

Answer

Regular patching and vulnerability scanning

Question 2

A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?

Accepted Answer

NIST Cybersecurity Framework. Option C is correct because NIST CSF is scalable, risk-based, and suitable for organizations of all sizes. Option A is wrong as ISO 27001 is comprehensive but resource-intensive. Option B is wrong as COBIT is focused on IT governance, not specifically security. Option D is wrong as PCI DSS applies only to credit card data.

Answer

ISO/IEC 27001

Answer

COBIT 2019

Answer

PCI DSS

Question 3

A small business is developing its first information security program. Which approach is most effective?

Accepted Answer

Conduct a risk assessment to identify key assets and threats.. Conducting a risk assessment first establishes the foundation for a tailored, cost-effective program. Prematurely adopting a full framework can be overwhelming; point solutions and full outsourcing are less sustainable.

Answer

Hire an external security consultant to design the entire program.

Answer

Adopt a comprehensive framework like ISO 27001 immediately.

Answer

Purchase and deploy a next-generation firewall.

Question 4

Which THREE of the following are key performance indicators (KPIs) for an information security program?

Accepted Answer

Number of security awareness training completions per quarter.. KPIs measure program effectiveness: incident response time, vulnerability remediation rate, and security awareness training completion are direct indicators. Number of firewalls is a resource count.

Answer

Total number of security staff.

Answer

Average number of firewall rules per device.

Question 5

A financial institution's security program must comply with PCI DSS, GDPR, and SOX. Which approach is MOST efficient to manage overlapping compliance requirements?

Accepted Answer

Implement a single control set mapped to all applicable regulations. Option A is correct because implementing a single set of controls mapped to multiple regulations reduces duplication and simplifies management. Option B is wrong focusing only on the strictest may miss unique requirements. Option C is wrong separate sets are inefficient. Option D is wrong outsourcing does not address overlap.

Answer

Develop three separate control sets for each regulation

Answer

Focus only on the requirements of the strictest regulation

Answer

Engage external auditors to manage compliance for each regulation

Question 6

An organization has a mature security program but is experiencing an increase in successful social engineering attacks. The incident response team has confirmed that the attacks are bypassing current controls. What should the program manager do first?

Accepted Answer

Conduct a root cause analysis and update risk assessment. Option D is correct because the first step in continuous improvement is to analyze the root cause and update the risk assessment. Option A is wrong as increasing training without understanding the gap may be inefficient. Option B is wrong as it only addresses future incidents, not current vulnerabilities. Option C is premature without analysis.

Answer

Implement multi-factor authentication for all systems

Answer

Disable email links and attachments

Answer

Increase the frequency of security awareness training

Question 7

An organization's security program has been in place for two years, but recently several security incidents occurred due to lack of user awareness. What is the most likely root cause?

Accepted Answer

The awareness program is not regularly updated or evaluated for effectiveness.. Without periodic evaluation and updates, awareness programs become stale and ineffective. The other options are indirect or insufficient.

Answer

Lack of a security awareness program.

Answer

Insufficient budget for security tools.

Answer

Insufficient firewall rules.

Question 8

Which THREE of the following are critical success factors for implementing an information security program?

Accepted Answer

Risk-based approach to prioritize controls.. Executive support, alignment with business, and risk-based approach are critical. Having the latest technology and compliance as sole driver are not success factors.

Answer

Compliance as the primary driver.

Answer

Deployment of the latest security technology.

Question 9

An organization's security program includes metrics to measure performance. Which metric BEST indicates the effectiveness of the vulnerability management process?

Accepted Answer

Mean time to remediate (MTTR) vulnerabilities. Option B is correct because mean time to remediate (MTTR) directly reflects how quickly vulnerabilities are addressed, showing process effectiveness. Option A is wrong count alone does not indicate resolution. Option C is wrong scan coverage is a process measure, not outcome. Option D is wrong number of patches deployed may include non-critical patches.

Answer

Number of vulnerabilities identified

Answer

Number of patches deployed per month

Answer

Percentage of systems scanned weekly

Question 10

A security program manager is reviewing the results of a recent internal audit that identified several security gaps. The manager must prioritize remediation efforts. Which factor should be given the MOST weight?

Accepted Answer

Business impact of the vulnerability. Option C is correct because business impact (potential financial, reputational, or operational damage) is the primary driver for prioritization. Option A is a constraint, not a priority factor. Option B is important but impact often outweighs likelihood. Option D may reduce urgency but not replace impact.

Answer

Likelihood of exploitation

Answer

Availability of compensating controls

Answer

Cost of remediation

Question 11

A security program lacks executive support. What is the best strategy to gain support?

Accepted Answer

Show risk quantification in business terms. Presenting risk in financial terms (risk quantification) resonates with executives. Option D is correct. Options A, B, C are less effective: quick wins may not address long-term support; threatening fines may breed resentment; hiring a consultant is temporary.

Answer

Hire a security consultant to advise

Answer

Implement quick-win security improvements

Answer

Threaten regulatory fines for non-compliance

Question 12

Which of the following best describes the primary purpose of an information security program?

Accepted Answer

To manage security risks in alignment with business strategy. Option C is correct because the program's goal is to align security with business objectives and manage risk to an acceptable level. Option A is wrong as availability is one aspect of CIA triad, not the primary purpose. Option B is wrong as security is an enabler, not an absolute obstacle. Option D is wrong as legal compliance is a component, not the overarching goal.

Answer

To ensure 100% system availability

Answer

To eliminate all security risks

Answer

To achieve compliance with all applicable regulations

Question 13

Which of the following is the primary purpose of an information security program?

Accepted Answer

Protect the confidentiality, integrity, and availability of information assets.. The program's overarching goal is to protect the confidentiality, integrity, and availability of information assets, aligned with business needs.

Answer

Implement firewalls and antivirus software.

Answer

Achieve compliance with regulations only.

Answer

Eliminate all security risks.

Question 14

Which TWO of the following are essential components of a security program governance structure?

Accepted Answer

Security charter. Options A and D are correct because a steering committee provides oversight and a security charter defines authority. Option B is wrong as a help desk is operational. Option C is wrong as vulnerability scanning is a technical control, not governance. Option E is wrong as an incident response plan is operational.

Answer

Vulnerability scanning schedule

Answer

Incident response plan

Answer

Help desk ticketing system

Question 15

A security manager is tasked with building a business case for a new security program. Which metric is most persuasive to senior management?

Accepted Answer

Estimated financial exposure from unmitigated risks.. Senior management cares about business impact; showing financial risk exposure demonstrates the need in their language.

Answer

Number of security incidents detected per month.

Answer

Percentage of systems patched within 30 days.

Answer

Hours spent on security training.