CISM Practice Test 31 — 15 Questions

Question 1

Refer to the exhibit. The audit finding reveals a deficiency in which critical aspect of information security governance?

Accepted Answer

Strategic alignment between security objectives and business goals is missing.. Option C is correct because the lack of measurable objectives linked to business outcomes indicates a failure in strategic alignment. Option A is wrong because while risk management is related, the finding specifically addresses strategy. Option B is wrong because the board may have approved the current strategy, but it is deficient. Option D is wrong because resource allocation is not the direct issue.

Answer

The board has not approved the security strategy.

Answer

Resource allocation for security initiatives is not based on business impact.

Answer

Risk management processes are not integrated with business planning.

Question 2

Which of the following is the best indicator that an organization has effective information security governance?

Accepted Answer

Security metrics are reviewed by the board quarterly. Review of security metrics by the board demonstrates governance oversight and strategic alignment. Option A (low incident count) could be due to luck. Option C (high budget) does not guarantee effectiveness. Option D (certifications) indicates compliance, not necessarily governance performance.

Answer

Achievement of ISO 27001 certification

Answer

The security budget has increased year over year

Answer

Low number of security incidents

Question 3

A company has recently adopted COBIT 2019 as its governance framework. The board is requesting a concise report on the effectiveness of the security program. Which reporting structure best aligns with COBIT's guidance?

Accepted Answer

Dashboard showing alignment of security goals with enterprise goals, using KRIs and KPIs. Option C is correct because COBIT emphasizes linking security goals to enterprise goals and using KRIs and KPIs. Option A lists incidents but does not show alignment. Option B is too technical. Option D is compliance-focused, not governance.

Answer

List of all security incidents and their impacts

Answer

Compliance status with all applicable regulations

Answer

Detailed technical vulnerabilities discovered during penetration tests

Question 4

After a merger, two companies with different security cultures are being integrated. What is the BEST approach for the information security manager to achieve a unified governance structure?

Accepted Answer

Develop a new framework incorporating strengths from both companies. Option B is correct because developing a new framework that incorporates best practices from both is most effective. Option A is wrong because adopting one company's framework may cause resistance. Option C is wrong because separate frameworks hinder integration. Option D is wrong as waiting leads to confusion.

Answer

Implement a regulatory framework as the baseline

Answer

Maintain separate frameworks until a natural convergence occurs

Answer

Adopt the security framework of the acquiring company

Question 5

An organization's information security governance committee has not met for the past six months. Which of the following is the most significant risk associated with this situation?

Accepted Answer

Lack of oversight leading to misalignment with business strategy. Without regular governance committee meetings, there is no oversight of security activities, leading to potential misalignment with business objectives. Option A (increased costs) could occur but is not the primary risk. Option C (delayed incident response) is operational. Option D (regulatory fines) is a possible consequence but less immediate than loss of strategic alignment.

Answer

Increased operational costs due to uncoordinated security investments

Answer

Regulatory fines from noncompliance

Answer

Delayed response to security incidents

Question 6

Refer to the exhibit. A security administrator reports that the VPN tunnel to the remote peer (10.1.1.1) intermittently fails. Based on the configuration, which of the following is the most likely cause?

Accepted Answer

Improper NAT traversal configuration. The configuration is missing the 'set pfs' command and does not include NAT traversal settings. Intermittent failure often occurs when NAT is involved and no NAT traversal is configured. Option A (mismatched IKE parameters) would cause constant failure. Option B (incorrect ACL) would prevent specific traffic, not intermittent. Option C (expired certificate) is irrelevant as pre-shared key is used.

Answer

Mismatched IKE phase 1 parameters

Answer

Expired digital certificate

Answer

Incorrect access-list 101

Question 7

An organization's governance framework requires regular reporting to the board. Which reporting frequency and format is MOST effective for a board with limited security expertise?

Accepted Answer

Quarterly report summarizing key risk indicators and business impact. Option C is correct because quarterly reports with business impact language and risk trends are tailored for board understanding. Option A is wrong because weekly is too frequent and technical. Option B is wrong because annual is too infrequent. Option D is wrong because technical depth is inappropriate.

Answer

Monthly dashboard of technical control effectiveness metrics

Answer

Annual presentation of the overall security risk register

Answer

Weekly technical briefings on incidents and vulnerabilities

Question 8

A company's security steering committee includes representatives from Human Resources, Legal, and Risk Management, but not from Business Operations. What is the most likely consequence of this membership gap?

Accepted Answer

Security policies may not align with operational processes. Without operations, security policies may not align with day-to-day business processes, leading to inefficiencies or resistance. Option B (increased costs) could occur but is not the most direct consequence. Option C (data breaches) is less likely. Option D (regulatory non-compliance) is possible but secondary.

Answer

Data breaches will occur more frequently

Answer

Security spending will increase unexpectedly

Answer

The company will face regulatory fines

Question 9

During an internal audit, it was found that the security policy does not address the use of personal devices for work. Which governance action should be taken first?

Accepted Answer

Develop a mobile device management policy and conduct a risk assessment. Option D is correct because governance starts with policy development based on risk assessment. Option A is reactive and may disrupt operations. Option B puts technology before policy. Option C is a partial solution.

Answer

Train users on security awareness

Answer

Purchase MDM software

Answer

Immediately ban all personal devices

Question 10

A multinational corporation is designing an information security strategy to support its global operations. Which approach best ensures that the strategy is actionable and measurable?

Accepted Answer

Define KPIs and KRIs aligned with business goals. Defining key performance indicators (KPIs) and key risk indicators (KRIs) tied to business goals allows the organization to track progress and effectiveness. Option A relies solely on external best practices, which may not fit the specific context. Option B focuses on cost-benefit analysis, which is important but not sufficient for actionability. Option D addresses technology adoption without a measurement framework.

Answer

Conduct a cost-benefit analysis of security controls

Answer

Base the strategy on industry best practices

Answer

Adopt a leading-edge technology roadmap

Question 11

Which THREE of the following are key indicators of a mature information security governance process? (Select exactly three.)

Accepted Answer

Security risk appetite is defined and reported to the board. Options A, C, and E are correct. A mature governance process includes business-aligned metrics (A), board-level risk reporting (C), and regular strategy review (E). B is operational metrics. D is a reactive metric.

Answer

Mean time to patch critical vulnerabilities is under 48 hours

Answer

Number of security incidents decreased by 20% year-over-year

Question 12

Which THREE of the following are challenges in implementing information security governance in a decentralized organization?

Accepted Answer

Redundant security controls and tools. Decentralized organizations often face inconsistent policy enforcement (A), redundant security controls (B), and diverse regulatory compliance (D). Centralized incident response (C) is typically not a challenge; it may be absent, but the challenge is lack of centralization. Unified risk reporting (E) is a goal, not a challenge.

Answer

Unified risk reporting

Answer

Centralized incident response

Question 13

Which TWO of the following are essential components of an information security governance framework according to ISACA's COBIT?

Accepted Answer

Value delivery. Strategic alignment (C) and value delivery (E) are key governance principles in COBIT. Performance measurement (A) is also important but not a foundational component; firewall config (B) and incident response (D) are operational.

Answer

Performance measurement

Answer

Incident response playbook

Answer

Firewall configuration

Question 14

Given the exhibit, what is the MOST appropriate action for the information security manager?

Accepted Answer

Implement the action plan to reduce KRI value. Option B is correct because the KRI is in the yellow zone (5-10%) and requires management attention and accelerated patching. Option A is wrong because escalation is for red status. Option C is wrong because immediate remediation is for critical issues. Option D is wrong because acceptance board approval is for risks that exceed appetite, but here it is within tolerance.

Answer

Request board approval to accept the risk level

Answer

Declare a security crisis and mobilize incident response

Answer

Escalate to the board for immediate decision

Question 15

During an internal audit, it is discovered that business units frequently purchase cloud services without involving the IT security department. Which governance deficiency does this scenario most clearly demonstrate?

Accepted Answer

Absence of a procurement security policy. The lack of a procurement security policy that mandates involvement of IT security indicates a gap in governance controls. Option A (weak access controls) might be a consequence but not the root deficiency. Option B (inadequate training) is not primary. Option C (lack of incident response) is unrelated to procurement.

Answer

Inadequate security awareness training

Answer

Lack of an incident response plan

Answer

Weak access control over cloud resources

CISM Practice Test 31 — 15 Questions

Exhibit

CISM Practice Test 31 — 15 Questions

Exhibit