CISM Practice Test 32 — 15 Questions

Question 1

Based on the exhibit, which role is missing from the governance policy that would be essential for enforcing accountability?

Accepted Answer

A role with authority to enforce compliance and impose consequences. Option D is correct because without defined consequences or enforcement responsibilities, accountability is weak. Option A is wrong because audit provides assurance, not enforcement. Option B is wrong because compliance officer may exist but isn't defined. Option C is wrong because external auditor is not internal governance.

Answer

External auditor

Answer

Internal audit function

Answer

Chief compliance officer

Question 2

Given the exhibit, what is the MOST significant governance gap in the described architecture?

Accepted Answer

No defined security governance board or oversight mechanism. Option B is correct because the architecture description does not indicate a defined ownership or governance layer for the security controls. Option A is wrong as controls exist. Option C is wrong as MFA is there. Option D is wrong as monitoring exists. The gap is governance oversight, not technical.

Answer

Weak authentication for remote access

Answer

Insufficient physical security in data centers

Answer

Lack of intrusion detection for internal traffic

Question 3

Refer to the exhibit. A company implements this data classification scheme. Which risk is most likely introduced by this scheme?

Accepted Answer

Under-classification of internal data, leading to exposure. The classification scheme lacks an 'Internal' label for data that is not public but not highly sensitive. Employees may misclassify internal data as Public or Confidential, leading to under- or over-classification. Specifically, internal data (e.g., internal memos) may be incorrectly labeled as Public (under-classification) because there is no appropriate label. Option A (over-classification) would happen if Confidential is used for internal data, but the greater risk is under-classification of internal data.

Answer

Over-classification of data, increasing administrative burden

Answer

Inability to audit data access

Answer

Inconsistent handling of confidential data

Question 4

A government agency is criticized for poor security governance after a data breach. An external review finds that security policies are not aligned with agency's mission. The director wants to implement a governance framework that ties security to strategic objectives. Which framework is most suitable?

Accepted Answer

COBIT 2019. Option C is correct because COBIT is designed for governance and alignment with enterprise goals. Option A is a management system. Option B is operational. Option D is industry-specific.

Answer

NIST Cybersecurity Framework

Answer

PCI DSS

Answer

ISO 27001

Question 5

Refer to the exhibit. This error log indicates a failure in which component of information security governance?

Accepted Answer

Access control. The error shows that a user lacks privileges to update a policy, indicating a breakdown in access control. Option A (segregation of duties) is about dividing tasks to prevent fraud, not about insufficient privileges. Option C (policy enforcement) is broader and refers to compliance with policies, not updating them. Option D (audit trail) is about logging, which is functioning as the error was logged.

Answer

Policy enforcement

Answer

Segregation of duties

Answer

Audit trail

Question 6

Which THREE elements are typically included in a security governance charter?

Accepted Answer

Budget authority. Roles and responsibilities (A), reporting structure (C), and budget authority (D) are governance charter components. Technical diagrams (B) and incident procedures (E) are operational.

Answer

Incident response procedures

Answer

Technical architecture diagrams

Question 7

A multinational corporation is experiencing significant security incidents due to inconsistent security policies across subsidiaries. The CISO proposes implementing a centralized governance model. However, business unit leaders argue that local regulations require autonomy. Which approach best balances governance with local compliance?

Accepted Answer

Develop a framework of minimum security requirements, allowing local augmentation. Option B is correct because it allows a minimum set of requirements while enabling local augmentation to meet specific regulatory needs. Option A is too rigid and may conflict with local laws. Option C gives up central control entirely. Option D outsources governance, which may not address local nuances.

Answer

Implement a single global security policy with mandatory compliance

Answer

Delegate all security decisions to local business units

Answer

Outsource security governance to a third-party managed service

Question 8

Which TWO of the following are key indicators that an organization's information security governance is inadequate?

Accepted Answer

Frequent changes to security policies without approval. Frequent policy changes without approval (B) and absence of a risk appetite statement (D) directly indicate governance failures. High incident count (A) and low budget (C) may be symptoms but not definitive; multiple antivirus (E) is operational.

Answer

Low budget for security awareness

Answer

High number of security incidents

Answer

Use of multiple antivirus solutions

Question 9

TechStart, a cloud-based startup, has rapidly grown from 50 to 500 employees. It lacks a formal security governance structure. The CEO asks the CISO to develop one. The CISO finds that the company's culture values speed over compliance. The board expects a governance framework within three months. What is the most practical approach?

Accepted Answer

Start with a lean governance model, focusing on critical assets and compliance requirements. Option A is correct because starting with a lean governance model focusing on critical assets and compliance requirements is achievable and respects the culture. Option B is too heavy. Option C neglects governance. Option D postpones and risks non-compliance.

Answer

Implement a full COBIT framework immediately

Answer

Defer governance until after the next product launch

Answer

Focus solely on technical controls like firewalls and IAM

Question 10

Which of the following is the PRIMARY purpose of an incident response plan?

Accepted Answer

To provide a systematic method for responding to incidents. The primary purpose of an incident response plan is to establish a structured, systematic methodology for detecting, containing, eradicating, and recovering from security incidents. This ensures that the organization can minimize damage, reduce recovery time and costs, and preserve evidence for forensic analysis. Without a predefined plan, responses become ad hoc, increasing the likelihood of errors and extended downtime.

Answer

To assign blame for security failures

Answer

To prevent all security incidents from occurring

Answer

To meet regulatory compliance requirements

Question 11

Which THREE of the following are essential components of an incident response plan? (Select exactly 3)

Accepted Answer

Communication plan for internal and external stakeholders. A communication plan is essential because it defines how the incident response team will coordinate internally and notify external stakeholders such as regulators, law enforcement, customers, and the media. Without a predefined communication plan, critical updates may be delayed or mishandled, leading to regulatory penalties or reputational damage. This aligns with NIST SP 800-61 and CISM best practices for incident management.

Answer

A list of all software licenses in the organization

Answer

Annual budget for security tools

Question 12

An organization's incident response plan includes a step to 'contain the incident.' Which of the following actions is an example of containment?

Accepted Answer

Disconnecting an infected workstation from the network. Disconnecting an infected workstation from the network is a classic containment action because it immediately isolates the compromised system, preventing the spread of malware or unauthorized lateral movement to other hosts. Containment focuses on limiting the scope and impact of an incident, not on remediation or investigation. This step aligns with the NIST SP 800-61 incident response lifecycle, where containment is performed before eradication and recovery.

Answer

Restoring data from backup

Answer

Analyzing log files to determine the attack vector

Answer

Removing malware from the system

Question 13

Which of the following are key components of an information security program's strategic plan? (Select two.)

Accepted Answer

Security program vision and objectives. The strategic plan for an information security program defines the long-term direction and governance framework. The security program vision and objectives (B) establish the overarching goals and alignment with business strategy, while the roadmap for security initiatives (D) provides the phased implementation plan to achieve those objectives. These are foundational components of strategic planning, not operational or tactical elements.

Answer

Annual budget allocation

Answer

Incident response procedures

Question 14

During a review of the information security program, the security manager discovers that the program's objectives are not aligned with the organization's strategic business goals. What is the best course of action?

Accepted Answer

Revise the program objectives to align with business goals.. The CISM framework emphasizes that an information security program must be directly aligned with the organization's strategic business goals to ensure that security investments support business objectives rather than hinder them. Revising the program objectives to align with business goals (Option B) is the correct course of action because it ensures that security controls, risk appetite, and resource allocation are driven by business needs, not isolated technical requirements. This alignment is a core principle of the Information Security Program domain, as misalignment can lead to wasted resources, reduced executive support, and increased business risk.

Answer

Justify the existing objectives to management to demonstrate their value.

Answer

Implement additional security controls to compensate for the misalignment.

Answer

Escalate the issue to the board of directors without changes.

Question 15

Which of the following are essential components of an information security program governance framework? (Select TWO.)

Accepted Answer

A security steering committee with executive representation.. A security steering committee with executive representation is essential because it provides strategic oversight, aligns security initiatives with business objectives, and ensures resource allocation and governance accountability. This committee typically includes C-level executives who approve security policies, review risk posture, and enforce compliance across the organization.

Answer

A formal risk appetite statement.

Answer

An incident response plan.

CISM Practice Test 32 — 15 Questions

Exhibit

CISM Practice Test 32 — 15 Questions

Exhibit