CISM Practice Test 18 — 15 Questions

Question 1

A security manager needs to justify an increase in the security budget. Which metric is MOST compelling to demonstrate the value of security investments to the board?

Accepted Answer

Return on investment (ROI) from avoided breach costs. ROI calculations, such as breach avoidance value, show financial benefit and resonate with the board.

Answer

Number of phishing simulations conducted

Answer

Percentage of IT budget allocated to security

Answer

Number of security tools deployed

Question 2

A company is implementing a third-party risk management program and needs to prioritize vendors for assessment. Which factor should be given the highest weight?

Accepted Answer

Data access level and service criticality. The sensitivity of data accessed and the criticality of the service to operations are primary risk factors for vendor prioritization.

Answer

Contract value

Answer

Duration of the relationship

Answer

Vendor size

Question 3

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this principle?

Accepted Answer

Network segmentation, intrusion detection systems, and full-disk encryption. Defense-in-depth uses multiple layers of controls. Network segmentation, IDS, and encryption provide preventive, detective, and corrective layers at different points.

Answer

A single firewall with access control lists

Answer

Antivirus software on all endpoints

Answer

Physical locks on server room doors and CCTV

Question 4

During a third-party risk assessment, the security team discovers that a critical vendor's sub-supplier (nth party) has access to sensitive data. The vendor contract does not address nth-party risk. What is the BEST course of action?

Accepted Answer

Revise the contract to require the vendor to flow down security requirements to sub-suppliers. The organization should require the vendor to contractually manage nth-party risks, as the organization's data is still at risk.

Answer

Accept the risk because the vendor is contractually responsible

Answer

Perform an on-site assessment of the sub-supplier

Answer

Request that the vendor terminate the sub-supplier relationship

Question 5

An organization is developing a security scorecard for the CISO. Which of the following is a leading indicator that would be most useful for predicting future security incidents?

Accepted Answer

Percentage of systems compliant with patch SLAs. Leading indicators, such as the percentage of systems with known vulnerabilities patched within the SLA, provide early warning of potential issues. Patch compliance is a proactive measure that reduces risk.

Answer

Mean time to respond (MTTR) to incidents

Answer

Number of security incidents in the past quarter

Answer

Total cost of security incidents

Question 6

Which TWO of the following are characteristics of a security champions program that contribute to its effectiveness?

Accepted Answer

Champions act as liaisons between security and their teams. Security champions are embedded in teams and receive specialized training, enabling them to advocate security practices.

Answer

Champions report directly to the CISO

Answer

Champions are rotated every six months

Answer

Champions have authority to enforce security policies

Question 7

Which security control framework is organized into Implementation Groups (IG1, IG2, IG3) based on organizational risk profile and resources?

Accepted Answer

CIS Controls v8. CIS Controls v8 uses Implementation Groups to help organizations prioritize controls based on their maturity and risk.

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Question 8

An organization is designing a vendor tiering process for its third-party risk management program. Which TWO factors are MOST appropriate for determining a vendor's risk tier?

Accepted Answer

Type and sensitivity of data the vendor accesses. Data access and service criticality are primary factors for tiering vendors.

Answer

Vendor's geographic location

Answer

Number of employees at the vendor

Answer

Vendor's annual revenue

Question 9

During a third-party risk assessment, the security team discovers that a critical vendor has subcontracted data processing to another company without notification. This represents which type of risk?

Accepted Answer

Nth-party risk. Nth-party risk refers to risks from suppliers of your suppliers, which can be overlooked.

Answer

Fourth-party risk

Answer

Inherent risk

Answer

Residual risk

Question 10

A security awareness program includes phishing simulations. Which metric best measures the long-term effectiveness of the program?

Accepted Answer

Click rate trend over multiple simulation cycles. A sustained downward trend in click rate over time indicates improved awareness and behavior, while single-click rate or reported emails may vary.

Answer

Number of phishing simulation campaigns per year

Answer

Pass rate on phishing simulation knowledge test

Answer

Number of employees who report phishing emails

Question 11

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this approach?

Accepted Answer

Network segmentation, intrusion detection system, and incident response plan. Defense-in-depth uses multiple layers of controls; here, network segmentation (preventive), IDS (detective), and incident response plan (corrective) cover different stages.

Answer

Access control lists, data loss prevention, and encryption

Answer

Firewall, antivirus, and encryption

Answer

Security awareness training, vulnerability scanning, and patching

Question 12

A company is designing a security awareness program. Which approach is MOST effective for ensuring that employees apply security principles in their daily work?

Accepted Answer

Role-based training: developers receive secure coding training, executives receive social engineering awareness. Role-based training targets specific risks relevant to each job function, making the training more practical and memorable.

Answer

Annual computer-based training for all employees covering general security topics

Answer

Monthly phishing simulations without any accompanying training

Answer

A one-time security awareness seminar conducted by an external consultant

Question 13

In designing a security programme for a mid-sized enterprise, the CISO is deciding which security framework to adopt for control selection. Which of the following frameworks is specifically structured around implementation groups (IG1, IG2, IG3) to help organizations prioritize controls based on risk and maturity?

Accepted Answer

CIS Controls v8. The CIS Controls v8 are organized into three Implementation Groups (IG1, IG2, IG3) to guide organizations in prioritizing controls based on their risk profile and security maturity. NIST SP 800-53 and ISO 27001 use different categorizations.

Answer

ISO 27001 Annex A

Answer

NIST SP 800-53

Answer

COBIT 2019

Question 14

Which TWO metrics are considered leading indicators for information security program performance?

Accepted Answer

Patch compliance percentage. Leading indicators predict future performance; phishing click rate and patch compliance are proactive measures.

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 15

Which TWO budget components are considered 'services' in a typical security budget?

Accepted Answer

Penetration testing conducted by an external firm. Services include external consultants and managed security services, not personnel or technology purchases.

Answer

Security awareness training software license

Answer

Firewall hardware

Answer

Salaries for security staff