CISM Practice Test 48 — 15 Questions

Question 1

A CISO is designing a security scorecard for the board of directors. Which metric is most appropriate to include for a one-page executive dashboard?

Accepted Answer

Percentage of systems patched within SLA. The board needs high-level, strategic metrics. Percentage of systems patched within SLA provides a clear, concise view of vulnerability management status, which is critical for risk reduction.

Answer

Detailed list of known vulnerabilities

Answer

Number of phishing simulations conducted

Answer

Names of vendors with critical findings

Question 2

A security architect is designing a defense-in-depth strategy for a financial institution. Which TWO of the following are essential components of a defense-in-depth approach?

Accepted Answer

Network segmentation to isolate critical systems.. Defense-in-depth uses multiple layers of security controls. Network segmentation limits lateral movement, and endpoint detection provides visibility at the host level.

Answer

A single, strong firewall at the network perimeter.

Answer

A single sign-on (SSO) solution for all applications.

Answer

Annual penetration testing as the primary security control.

Question 3

An information security manager is asked to justify an increase in the security budget. Which approach BEST demonstrates the value of the security program?

Accepted Answer

Calculating the ROI by estimating breach avoidance and compliance cost savings. Presenting the return on investment (ROI) by quantifying avoided breach costs and compliance savings provides a business case for budget increases.

Answer

Comparing the proposed budget to industry benchmarks

Answer

Highlighting the number of security tools currently in use

Answer

Listing all security certifications held by the team

Question 4

In a vendor tiering system for third-party risk management, which factor is most critical for determining the tier?

Accepted Answer

Vendor's data access and service criticality. The vendor's access to sensitive data and the criticality of the service to business operations are the primary factors for tiering, as they directly impact risk exposure.

Answer

Vendor's annual revenue

Answer

Vendor's geographic location

Answer

Vendor's number of employees

Question 5

Which control family in NIST SP 800-53 addresses the identification and authentication of users?

Accepted Answer

Identification and Authentication (IA). The Identification and Authentication (IA) family in NIST SP 800-53 covers user identification, authentication, and credential management.

Answer

Personnel Security (PS)

Answer

System and Communications Protection (SC)

Answer

Access Control (AC)

Question 6

A company wants to establish a security champions program. What is the primary benefit of embedding security champions in development teams?

Accepted Answer

Ensuring security is considered during the design and development phases. Security champions act as liaisons, promoting secure coding practices and facilitating communication between security and development, thereby integrating security earlier.

Answer

Eliminating the requirement for a dedicated security team

Answer

Reducing the need for automated security testing tools

Answer

Reducing the frequency of penetration testing

Question 7

Which of the following is a leading indicator for security performance?

Accepted Answer

Patch compliance percentage. Leading indicators are proactive measures that predict future performance. Patch compliance is a leading indicator because it shows current security posture that influences future incidents.

Answer

Mean time to recover (MTTR)

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 8

Which metric is considered a lagging indicator of security program performance?

Accepted Answer

Mean time to detect (MTTD). Lagging indicators measure past events. Mean time to detect (MTTD) is a lagging indicator because it reflects historical detection efficiency.

Answer

Patch compliance percentage

Answer

Access review completion rate

Answer

Phishing simulation click rate

Question 9

An organization is selecting security controls from NIST SP 800-53. Which TWO control families are most directly related to access control? (Select TWO)

Accepted Answer

Identification and Authentication (IA). Access Control (AC) and Identification and Authentication (IA) are the primary families governing access management.

Answer

Configuration Management (CM)

Answer

System and Communications Protection (SC)

Answer

Audit and Accountability (AU)

Question 10

A security manager is building a business case for additional security budget. Which THREE justifications are most effective for obtaining executive approval? (Select THREE)

Accepted Answer

Compliance cost avoidance. Breach avoidance value, compliance cost avoidance, and operational efficiency gains are direct, quantifiable benefits that resonate with executives.

Answer

Number of security tools deployed

Answer

Industry peer comparison

Question 11

Which of the following is a leading indicator of security program effectiveness?

Accepted Answer

Phishing click rate. Leading indicators predict future security performance, and phishing click rate is a proactive measure that can be improved before a breach occurs.

Answer

Mean time to detect (MTTD)

Answer

Breach count

Answer

Number of security incidents

Question 12

An organization is implementing a security controls framework based on NIST SP 800-53. The CISO wants to prioritize controls that will provide the greatest risk reduction for critical assets. Which approach should be used to select the initial set of controls?

Accepted Answer

Apply the critical controls first, focusing on those that address the highest risks.. Applying critical controls first, such as those from the CIS Critical Security Controls, ensures that the most impactful controls are implemented early to reduce risk.

Answer

Select all controls from the framework to achieve full compliance.

Answer

Implement business-enabling controls before any other controls.

Answer

Choose compensating controls to replace all technical controls.

Question 13

A security manager is designing a vulnerability management program. Which TWO of the following are essential processes?

Accepted Answer

Regular vulnerability scanning of all systems.. Vulnerability management includes regular scanning and a prioritization process to remediate based on risk. Patching is part of remediation, but scanning and prioritization are foundational.

Answer

Immediate patching of all vulnerabilities within 24 hours.

Answer

Vulnerability disclosure program for external researchers.

Answer

Penetration testing of all applications annually.

Question 14

An information security manager needs to justify a budget increase. Which approach would be MOST effective for gaining executive approval?

Accepted Answer

Present ROI analysis showing breach avoidance savings. Executives respond to financial justification. ROI based on breach avoidance demonstrates value in monetary terms.

Answer

List all planned technology purchases

Answer

Describe the latest cyber threats

Answer

Show industry benchmarks for security spending

Question 15

A CISO is evaluating metrics for an executive security report. Which TWO of the following are lagging indicators?

Accepted Answer

Mean time to detect (MTTD) security incidents.. Lagging indicators reflect past incidents or performance. Breach count and mean time to detect (MTTD) are outcome-based metrics that show what has already happened.

Answer

Number of security awareness training sessions held.

Answer

Patch compliance rate for critical systems.

Answer

Percentage of employees who completed security training.