CISM Practice Test 47 — 15 Questions

Question 1

Which THREE elements are essential components of a third-party risk management (TPRM) program? (Select THREE)

Accepted Answer

Contractual security requirements. Contractual security requirements (Option B) are essential because they legally bind the vendor to specific security controls, data protection obligations, and compliance standards. Without these enforceable clauses in the contract, the organization has no formal recourse if the vendor suffers a breach or fails to meet security expectations. This is a foundational element of any third-party risk management program, as it sets the baseline for acceptable risk transfer and due care.

Answer

Automated patching of vendor systems

Answer

Shared SOC services

Question 2

A multinational corporation with a decentralized information security program has recently experienced a data breach involving customer PII. The breach originated from a regional office that had not implemented the global security baseline due to local IT staff claiming 'unique operational requirements.' The CISO has tasked the security manager with revising the program to prevent recurrence. The organization has 12 regional offices, each with its own IT leadership, and a central security team. The budget is tight, and there is resistance to centralized control. Which of the following is the BEST course of action for the security manager?

Accepted Answer

Establish a mandatory global security baseline with a formal exception process requiring CISO approval for any deviation. Establishing a mandatory global security baseline with a formal exception process ensures consistency while allowing for justified deviations that are formally approved by the CISO, addressing the root cause of non-compliance. Option A is wrong because increasing audits may detect issues but does not enforce compliance without binding standards. Option B is wrong because training alone does not ensure implementation when local IT can claim unique requirements. Option C is wrong because allowing each office to maintain its own program perpetuates fragmentation and does not enforce a consistent baseline.

Answer

Increase the frequency of security audits for all regional offices

Answer

Provide additional training to regional IT staff on the importance of security baselines

Answer

Allow each regional office to maintain its own security program as long as it meets minimum standards

Question 3

Which capability maturity model (CMM) level indicates that security processes are managed and measured using quantitative metrics?

Accepted Answer

Level 4: Managed. Level 4 (Managed) is characterized by quantitative management of processes.

Answer

Level 3: Defined

Answer

Level 2: Repeatable

Answer

Level 5: Optimizing

Question 4

Which governance structure is characterized by a single security team that serves the entire organization?

Accepted Answer

Centralized. A centralized governance model consolidates security responsibilities under one team, ensuring consistent policy enforcement and resource allocation.

Answer

Matrix

Answer

Hybrid

Answer

Decentralized

Question 5

Which capability maturity model (CMM) level indicates that security processes are proactively measured and optimized?

Accepted Answer

Level 5 (Optimizing). Level 5 (Optimizing) focuses on continuous improvement through quantitative measurement.

Answer

Level 4 (Managed)

Answer

Level 2 (Repeatable)

Answer

Level 3 (Defined)

Question 6

A multinational corporation is establishing a risk appetite framework. The board has defined risk appetite as 'no more than one major security incident per year resulting in financial loss exceeding $1M'. Which of the following best represents the risk tolerance for a specific business unit's annual cybersecurity budget allocation?

Accepted Answer

The business unit should maintain annual losses from security incidents between $500,000 and $1,000,000.. Risk appetite is the broad level of risk the organization is willing to accept, while risk tolerance is the acceptable variation around that appetite. In this case, the tolerance is a range of financial loss from the appetite level up to the capacity (maximum bearable loss). A range of $500,000 to $1,000,000 defines the boundaries within which the business unit can operate without breaching appetite.

Answer

The business unit may experience up to $1M in losses per year from security incidents.

Answer

The business unit can accept up to $1.5M loss from a single incident per year.

Answer

The business unit should not exceed a single incident causing $500,000 loss per year.

Question 7

An information security manager is designing a security awareness program. Which approach BEST addresses the different learning needs of various employee groups?

Accepted Answer

Deliver role-based training: secure coding for developers, social engineering for executives, and basic awareness for all. Role-based training ensures that each group receives content relevant to their responsibilities.

Answer

Use only phishing simulations as training

Answer

Focus training only on high-risk groups such as system administrators

Answer

Provide the same annual training to all employees to ensure consistency

Question 8

Which THREE of the following are components of a security operations center (SOC)?

Accepted Answer

Response. A SOC includes monitoring, detection, and response capabilities. Security awareness training is not a SOC function; it is part of the awareness program.

Answer

Vulnerability scanning

Answer

Security awareness training

Question 9

An organization is implementing a security champions program. What is the primary purpose of this initiative?

Accepted Answer

To embed security advocates within development teams to improve secure coding practices. Security champions embed security advocates within development teams to promote secure practices.

Answer

To conduct security awareness training for all employees

Answer

To provide a career path for security professionals

Answer

To replace the need for a dedicated security team

Question 10

A security manager is developing metrics for the executive dashboard. Which combination of metrics provides a balanced view of security program performance?

Accepted Answer

Phishing click rate and mean time to detect (MTTD). A balanced dashboard should include both leading and lagging indicators to show current effectiveness and past outcomes.

Answer

Budget spent and number of security tools deployed

Answer

Patch compliance percentage and number of phishing simulation clicks

Answer

Number of security incidents and mean time to respond (MTTR)

Question 11

An organization is implementing a third-party risk management (TPRM) program. Which approach best addresses nth-party risk?

Accepted Answer

Requiring that key vendors include security requirements in contracts with their subcontractors. Nth-party risk refers to risks from suppliers of your suppliers. Contractual requirements that cascade down the supply chain are essential to manage this risk.

Answer

Performing on-site audits of all third parties

Answer

Accepting the risk since it is outside the organization's control

Answer

Conducting annual assessments of all direct vendors only

Question 12

Which of the following is a key objective of implementing a security champions program?

Accepted Answer

To embed security advocates in development teams. Security champions are volunteers within development teams who promote security best practices and facilitate communication between security and development.

Answer

To replace the need for a formal security awareness program

Answer

To reduce the number of security tools needed

Answer

To conduct phishing simulations for all employees

Question 13

A security manager is developing OKRs for the security team. Which TWO key results are appropriate leading indicators? (Select TWO)

Accepted Answer

Complete 100% of privileged access reviews quarterly. Leading indicators are proactive; patch compliance reflects current security posture, and access review completion indicates governance effectiveness.

Answer

Achieve zero critical vulnerabilities in external scans

Answer

Reduce number of data breaches by 20%

Answer

Decrease mean time to detect (MTTD) to under 1 hour

Question 14

What is the primary purpose of a vulnerability management program?

Accepted Answer

To identify, assess, and remediate security weaknesses in systems. Vulnerability management aims to identify, classify, and remediate vulnerabilities to reduce the attack surface.

Answer

To enforce access control policies

Answer

To detect and respond to security incidents

Answer

To manage third-party security risks

Question 15

Which of the following is a leading indicator of security program effectiveness?

Accepted Answer

Access review completion rate. Leading indicators measure proactive security posture; access review completion rate indicates how well entitlements are managed.

Answer

Number of data breaches

Answer

Cost of a data breach

Answer

Mean time to respond (MTTR)