CISM Practice Test 19 — 15 Questions

Question 1

A security manager is designing a security awareness program for a mid-sized organization. Which of the following is the MOST effective approach to ensure that training is relevant to different employee roles?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Provide role-based training that addresses specific risks for each job function.. Role-based training tailors content to specific job functions, making it more relevant and effective than generic training. Developers need secure coding, executives need social engineering awareness, and all staff need basic awareness.

Answer

Deliver the same annual training to all employees to ensure consistency.

Answer

Focus only on senior executives since they are the primary targets of social engineering.

Answer

Conduct quarterly phishing simulations without any formal training.

Question 2

Which THREE of the following are key activities in a third-party risk management (TPRM) program?

Accepted Answer

Ongoing monitoring of vendor security posture. TPRM includes onboarding risk assessment, contract security requirements, and ongoing monitoring.

Answer

Providing vendor with access to internal network

Answer

Performing background checks on vendor employees

Question 3

A security manager is developing a set of objectives and key results (OKRs) for the security program. Which THREE would be considered effective security OKRs?

Accepted Answer

Objective: Enhance incident response. Key Result: Achieve 100% of incidents logged within 1 hour of detection.. OKRs should be measurable and tied to security outcomes.

Answer

Objective: Implement a new SIEM. Key Result: Deploy SIEM by Q3.

Answer

Objective: Increase security awareness. Key Result: Conduct quarterly phishing simulations.

Question 4

A CISO is presenting security metrics to the board. Which of the following metrics would be MOST relevant for a one-page executive dashboard?

Accepted Answer

Breach count and associated financial impact. Executives need high-level summary metrics. Breach count is a lagging indicator that directly communicates security effectiveness to the board.

Answer

Mean time to detect (MTTD) for incidents

Answer

Number of firewall rule changes per month

Answer

Percentage of employees who completed training

Question 5

A CISO is evaluating the reporting structure for the information security team. Which reporting line is generally considered MOST effective for ensuring independence and organizational influence?

Accepted Answer

Report to the board of directors or audit committee. Reporting to the board of directors or a board committee ensures security has a direct voice at the highest level, avoiding conflicts with IT or business operations.

Answer

Report to the Chief Financial Officer (CFO)

Answer

Report to the Chief Information Officer (CIO)

Answer

Report to the Chief Operating Officer (COO)

Question 6

An organization is implementing a vendor risk management program. A vendor that provides cloud-based HR services will have access to employee PII. According to industry best practices, what should be the first step in the vendor lifecycle?

Accepted Answer

Perform a risk assessment of the vendor. The first step is to perform a risk assessment based on the vendor's data access and service criticality to determine the appropriate level of due diligence. This aligns with the NIST framework for third-party risk management.

Answer

Include security requirements in the contract

Answer

Request the vendor's SOC 2 report

Answer

Conduct an onsite audit of the vendor

Question 7

An organization with a mature security program allocates 12% of its IT budget to security. Which factor is MOST likely to support this level of investment?

Accepted Answer

The organization is in a highly regulated industry with strict compliance mandates. A mature program typically invests 10-15% of IT budget. The key driver is the organization's risk appetite and compliance requirements, not just revenue percentage.

Answer

The organization's IT budget is very large

Answer

The organization has a low number of security incidents historically

Answer

The organization has a high risk tolerance

Question 8

What is the PRIMARY purpose of a security champions program?

Accepted Answer

To embed security advocates in non-security teams to promote security best practices. Security champions act as advocates within teams, promoting security practices and bridging the gap between security and development.

Answer

To enforce security policies through peer pressure

Answer

To conduct security audits of other teams

Answer

To replace the security team in development projects

Question 9

A security manager is designing a metrics dashboard for the CISO. Which TWO metrics are leading indicators of security performance? (Select TWO)

Accepted Answer

Patch compliance percentage. Phishing click rate and patch compliance are proactive measures that predict future risk, unlike breach count and MTTD which are lagging.

Answer

Number of security incidents

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 10

A company is designing its security awareness program. Which approach BEST addresses the need for role-based training?

Accepted Answer

Provide secure coding training to developers and social engineering awareness to executives. Role-based training tailors content to specific job functions, making it more relevant and effective.

Answer

Focus only on phishing simulations for all staff

Answer

Deliver the same annual training to all employees

Answer

Create a single module covering all topics for everyone

Question 11

Which role is primarily responsible for designing and reviewing an organization's security architecture?

Accepted Answer

Security architect. The security architect designs and reviews security architecture to ensure it aligns with business requirements and security standards.

Answer

Security analyst

Answer

GRC analyst

Answer

SOC analyst

Question 12

A CISO is developing key risk indicators (KRIs) for the security programme. Which TWO of the following are lagging indicators? (Select TWO.)

Accepted Answer

Number of data breaches in the past quarter. Lagging indicators measure past performance or outcomes. Number of data breaches and mean time to respond (MTTR) are outcome and efficiency metrics that reflect past events. Patch compliance and phishing click rate are leading indicators.

Answer

Percentage of systems patched within SLA

Answer

Percentage of access reviews completed on time

Answer

Phishing click rate

Question 13

In a security awareness program, which training approach is most appropriate for software developers?

Accepted Answer

Secure coding practices and common vulnerabilities. Developers need secure coding training to address vulnerabilities in code they write. Role-based training ensures relevance and effectiveness.

Answer

Social engineering awareness for executives

Answer

Incident response procedures

Answer

General security awareness training covering phishing

Question 14

Which of the following is a leading indicator of security program effectiveness?

Accepted Answer

Phishing click rate. Leading indicators are proactive measures that predict future performance. Phishing click rate is a leading indicator because it measures current user behavior that can be improved before an incident occurs.

Answer

Number of security incidents

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 15

A CISO is designing the security organization for a financial services firm. Which reporting structure is most likely to ensure the independence and authority of the information security function?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board provides independence from operational pressures, allowing the CISO to enforce security without conflict of interest. Reporting to the CIO can create conflicts, as security may be subordinated to IT goals. Reporting to legal or risk committees may lack operational authority.

Answer

Reporting to the risk committee

Answer

Reporting to the CIO

Answer

Reporting to the chief legal officer