CISM Practice Test 21 — 15 Questions

Question 1

An organization is designing a third-party risk management (TPRM) program. They have identified a vendor that stores sensitive customer data. According to best practices, what should be the minimum requirement for this vendor's contract?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Contractual security requirements and right to audit. For vendors handling sensitive customer data, the contract must include security requirements such as data protection clauses, incident notification timelines, and the right to audit. This ensures contractual enforceability of security controls.

Answer

Vendor's insurance certificate

Answer

Annual self-assessment questionnaire only

Answer

SOC 2 Type II report without contractual clauses

Question 2

A company is designing a third-party risk management (TPRM) program. Which THREE of the following are essential components of the ongoing monitoring phase for a critical vendor?

Accepted Answer

Annual reassessment of the vendor's security controls. Ongoing monitoring includes continuous assessment of security posture. Annual reassessment is part of the cycle, but ongoing monitoring includes more frequent checks. Contractual requirements are set during onboarding, not monitored ongoing. Exit procedures are for termination.

Answer

Contractual requirement for data encryption

Answer

One-time onboarding risk assessment

Question 3

An organization is designing a security operations center (SOC). Which of the following functions is PRIMARILY responsible for analyzing alerts and determining if they represent genuine threats?

Accepted Answer

Security Analyst. Security analysts are responsible for alert triage and investigation.

Answer

SOC Manager

Answer

Security Architect

Answer

Incident Responder

Question 4

A security manager needs to justify an increase in the security budget to the board. The current budget is 0.15% of revenue. Which approach would most effectively demonstrate the need for additional funding?

Accepted Answer

Show that the budget is below the industry benchmark of 0.2-0.5% of revenue and detail the risks of underfunding.. Benchmarking against industry standards (0.2-0.5% of revenue) and showing the gap provides a compelling case.

Answer

Compare the budget to last year's spending and note the increase in threats.

Answer

Present a cost-benefit analysis showing how additional investment reduces breach probability and potential loss.

Answer

Highlight recent high-profile breaches in the industry.

Question 5

Which of the following is a LEADING indicator of security performance?

Accepted Answer

Patch compliance percentage. Leading indicators predict future performance; patch compliance measures proactive risk reduction.

Answer

Cost of a data breach

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 6

A SOC analyst receives an alert about a potential malware infection on a critical server. Which step should the analyst take FIRST?

Accepted Answer

Perform initial triage to verify the alert and assess severity. The first step in incident response is to investigate and confirm the alert (triage) to avoid acting on false positives.

Answer

Reboot the server to clear the potential malware

Answer

Notify the incident response team and escalate

Answer

Disconnect the server from the network immediately

Question 7

Which of the following is the PRIMARY benefit of a security champions program?

Accepted Answer

Embedding security advocates in business units. Security champions act as liaisons within development teams, promoting security best practices and improving collaboration.

Answer

Reducing the need for security awareness training

Answer

Automating security testing

Answer

Eliminating third-party risks

Question 8

A security awareness manager is designing role-based training. Which training is most appropriate for software developers?

Accepted Answer

Secure coding practices. Developers need specialized training on secure coding practices to reduce vulnerabilities in applications.

Answer

Phishing identification

Answer

Social engineering awareness

Answer

Incident response procedures

Question 9

Which of the following is the primary objective of a security champions programme?

Accepted Answer

To embed security advocates within development teams. A security champions programme embeds security advocates within development teams to promote secure practices, improve communication, and embed security into daily work, rather than incident response or policy enforcement.

Answer

To enforce security policies across the organization

Answer

To conduct phishing simulations for employees

Answer

To provide an escalation path for security incidents

Question 10

Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?

Accepted Answer

Phishing click rate. Phishing click rate is a leading indicator because it predicts future incidents by measuring current behavior.

Answer

Number of vulnerabilities patched

Answer

Mean time to respond (MTTR)

Answer

Number of security incidents

Question 11

An organization is implementing a security controls framework and needs to prioritize which controls to implement first. According to CIS Controls v8, which approach aligns with the principle of 'implementation groups'?

Accepted Answer

Start with all controls from IG1, then move to IG2 and IG3 as resources allow. CIS Controls v8 defines Implementation Groups (IG1, IG2, IG3) that prioritize controls based on organizational maturity, starting with the most foundational and critical controls.

Answer

Focus only on controls that address the greatest risks regardless of group

Answer

Implement IG3 controls first as they are the most advanced

Answer

Implement controls from all groups simultaneously to achieve comprehensive coverage

Question 12

Which of the following is the PRIMARY purpose of a security champions program?

Accepted Answer

Embed security advocates in dev teams to promote secure practices. Security champions act as liaisons in development teams, promoting security practices and facilitating communication with the security team.

Answer

Enforce compliance with security policies

Answer

Reduce the number of phishing simulations

Answer

Replace the need for a dedicated security team

Question 13

Which of the following security team roles is primarily responsible for designing and implementing security solutions to protect an organization's systems and data?

Accepted Answer

Security architect. The security architect designs the overall security structure, including policies, technologies, and controls. Other roles focus on operations, analysis, or governance.

Answer

Security analyst

Answer

GRC analyst

Answer

Penetration tester

Question 14

An organization is defining objectives and key results (OKRs) for the security program. Which TWO of the following are examples of leading indicators that could be used as key results?

Accepted Answer

Phishing click rate. Leading indicators are proactive and predictive. Phishing click rate (user behavior) and patch compliance (vulnerability management) are leading indicators.

Answer

Number of security incidents

Answer

Mean time to respond (MTTR)

Answer

Number of data breaches

Question 15

A large organization is implementing a security controls framework and wants to prioritize controls that provide the greatest risk reduction with the least operational friction. Which approach should the security manager adopt?

Accepted Answer

Prioritize critical controls that address high-risk areas and enable business operations. Prioritizing critical controls first, especially those that address the most significant risks and are business-enabling, aligns with defense-in-depth and risk-based decision making.

Answer

Implement all controls from the chosen framework simultaneously

Answer

Implement compensating controls only for legacy systems

Answer

Select controls based on regulatory compliance requirements only