CISM Practice Exam 54 — 20 Questions

Question 1

A global organization has a policy that requires all employees to complete security awareness training within 30 days of hire and annually thereafter. During an audit, it was found that only 60% of employees completed the annual training. The CISO needs to address this non-compliance. Which of the following should be the FIRST step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conduct a root cause analysis to determine why employees are not completing the training.. Conducting a root cause analysis is the essential first step. It identifies why employees are not completing the training, allowing the CISO to implement targeted and effective solutions. This approach is consistent with continuous improvement and ensures that resources are used efficiently.

Answer

Report the non-compliance to the board of directors and request their intervention.

Answer

Revise the policy to extend the training deadline to 60 days to improve compliance.

Answer

Implement a technical control that blocks network access for employees who have not completed training.

Question 2

A healthcare provider is building a security awareness programme after a phishing incident exposed patient records. The CISO wants to demonstrate programme value to the board within the first year. Which approach BEST supports measuring and improving the programme?

Accepted Answer

Use simulated phishing campaigns with click and report rates, combined with role-based training completion and knowledge assessments.. A credible awareness measurement approach combines behavioural evidence from phishing simulations with participation data from training completion and comprehension checks from knowledge assessments. Together these show whether staff can recognise threats and act correctly, and they reveal where reinforcement is needed. This mix produces the trend evidence boards need to judge whether the programme is reducing human risk over time.

Answer

Measure the reduction in total security incidents across the organisation year over year.

Answer

Survey employees annually on their satisfaction with security training content and delivery.

Answer

Track the total number of phishing emails reported by staff each month and report the trend.

Question 3

A CISO is building the programme's risk treatment capability and wants to ensure that identified risks are handled consistently across business units. Which TWO activities are essential components of an effective risk treatment process? (Choose two.)

Accepted Answer

Documenting the selected treatment option and the residual risk accepted by the business owner. Consistent risk treatment requires that someone with authority owns each risk and that the chosen response, including any accepted residual risk, is documented. Ownership drives decisions and accountability; documentation preserves the audit trail and confirms acceptance happened at the right level. Full mitigation mandates, delegation to operations, and shifting rating scales all undermine consistency and either stall the process or make its outputs incomparable across business units.

Answer

Delegating all treatment decisions to the security operations team for speed

Answer

Requiring every identified risk to be mitigated to zero before the register can be closed

Answer

Recalculating every risk score monthly using a different qualitative scale each time

Question 4

A security manager is defining the structure of a new information security programme. The CISO has asked for a clear separation of duties between governance and execution. Which TWO of the following activities are typically governance responsibilities rather than operational execution? (Choose two.)

Accepted Answer

Reviewing and approving the enterprise risk register and accepting residual risks.. Governance involves setting direction, defining risk tolerance, and providing oversight, which includes approving policy and risk appetite and reviewing and accepting residual risks. Operational tasks such as configuring IDS signatures, monitoring dashboards, and running vulnerability scans execute the strategy and controls defined by governance, and are therefore not governance responsibilities.

Answer

Performing vulnerability scans on internal network segments.

Answer

Monitoring security dashboards and triaging alerts on a daily basis.

Answer

Configuring and tuning intrusion detection system (IDS) signatures.

Question 5

An organisation is preparing to adopt a control framework to structure its information security programme. The CISO must select an approach that provides a comprehensive catalogue of controls while allowing tailoring to the organisation's risk profile. Which approach BEST meets this requirement?

Accepted Answer

Adopt a comprehensive control catalogue as the baseline, then tailor control selection and implementation using the organisation's risk assessment results.. Control frameworks are designed to be adopted as a baseline and then tailored through risk assessment, which gives both completeness and proportionality. Implementing everything at maximum strength wastes resources, letting each unit choose its own framework destroys comparability, and a purely bespoke set risks blind spots that established catalogues are designed to prevent.

Answer

Build a bespoke control set from scratch based on internal incident history, avoiding external frameworks that may not reflect the organisation's environment.

Answer

Implement every control in the chosen catalogue to the highest specified level so that no gap can ever be identified by an auditor.

Answer

Allow each business unit to select controls from any framework it prefers, provided the unit documents its choices in its own risk register.

Question 6

A global manufacturer is consolidating its information security programme after several acquisitions. The CISO must establish a consistent policy framework across business units with differing local regulations. Which TWO actions are MOST important to ensure the framework is both consistent and compliant? (Choose two.)

Accepted Answer

Map the global policy framework to applicable external standards and regulations, and maintain a traceability matrix showing coverage per jurisdiction.. Consistency and compliance are achieved by pairing a mandatory global policy baseline with a governed exception path, and by mapping that baseline to applicable laws and standards through a traceability matrix. The exception process keeps local regulatory constraints visible and formally accepted, while the matrix provides audit evidence of coverage. Together they let the CISO standardise controls without ignoring jurisdictional differences.

Answer

Permit each acquired business unit to retain its existing policies until the next scheduled audit cycle.

Answer

Delegate policy ownership entirely to each regional CISO and require only annual attestation of compliance.

Answer

Adopt the strictest regulation from any jurisdiction as the single global standard for all business units.

Question 7

A security manager is defining the scope of an information security programme for a fast-growing fintech. Executive sponsors want assurance that the programme will address both organizational and technical dimensions. Which TWO elements are essential components of the programme scope? (Choose two.)

Accepted Answer

Defined roles, responsibilities, and accountability for information security across business and technology functions.. Programme scope must cover both governance and risk disciplines. A risk management process translates business context into prioritized protection decisions, while defined roles and accountability ensure those decisions are executed and sustained across functions. Licence lists, marketing plans, and device inventories are useful operational details but are not defining components of programme scope.

Answer

A complete inventory of every software licence held by the engineering department.

Answer

A consolidated list of the personal mobile devices used by the sales team.

Answer

A marketing plan describing how security certifications will be promoted to prospective customers.

Question 8

A CISO is establishing an information security governance framework. The organization operates in multiple countries with varying data protection laws. Which of the following should be the PRIMARY consideration when developing security policies?

Accepted Answer

Adopting the strictest regulatory requirements across all jurisdictions.. Adopting the strictest regulatory requirements across all jurisdictions is the primary consideration because it ensures compliance everywhere and provides a consistent baseline for security policies. This approach avoids the complexity of managing multiple policy sets and reduces the risk of non-compliance in any location, supporting a robust governance framework.

Answer

Implementing a single global policy that meets the minimum legal requirements.

Answer

Allowing each country to develop its own security policies independently.

Answer

Deferring to the legal department to determine policy requirements.

Question 9

A security manager is establishing a formal risk management process. The organization wants to ensure that risk treatment decisions are consistent and documented. Which TWO of the following are essential elements of an effective risk treatment plan? (Choose two.)

Accepted Answer

Defined risk response options mapped to each identified risk. An effective risk treatment plan documents the chosen response for each risk and records formal acceptance of residual risk by the accountable business owner. These elements ensure decisions are consistent, traceable, and aligned with risk appetite, enabling the organization to demonstrate due care and manage risk deliberately rather than incidentally.

Answer

Technical vulnerability scan results for all systems

Answer

Approval of the IT budget for security tools

Answer

A list of all security controls implemented across the enterprise

Question 10

During an annual programme review, a CISO finds that security policies exist but employees across regions interpret and apply them inconsistently. Auditors have flagged this as a governance weakness. Which action should the CISO take to strengthen policy governance?

Accepted Answer

Establish a formal policy lifecycle process with defined ownership, review cycles, exception handling, and communication requirements.. Inconsistent policy application is a governance problem best resolved by instituting a formal policy lifecycle covering ownership, review cadence, exception management, and communication. This creates accountability and an auditable process that auditors expect. Collapsing policies, decentralizing authority without oversight, or relying solely on attestation each fails to address the structural causes of inconsistent interpretation.

Answer

Delegate full policy authority to each regional security manager and remove central oversight.

Answer

Require annual attestation from all employees that they have read and understood every security policy document.

Answer

Replace all existing policies with a single short acceptable use statement signed annually by every employee.

Question 11

A software company is defining the roles and responsibilities within its information security programme. The CISO wants clarity on who is accountable for ensuring that security requirements are integrated into the software development lifecycle. Which role should be assigned this accountability?

Accepted Answer

The security manager responsible for the secure development programme, who defines requirements and verifies their implementation.. Accountability for embedding security into the software development lifecycle belongs with the security role that owns the secure development programme. That role defines requirements, sets lifecycle gates, and verifies implementation, while development teams remain responsible for building to those requirements. Keeping audit independent and QA focused on functional quality preserves clear separation of duties.

Answer

The quality assurance manager, because testing is already part of their remit.

Answer

The development team lead, because they manage the engineers who write the code.

Answer

The internal audit function, because it independently assesses whether controls are working.

Question 12

During a programme review, a security manager finds that many controls were implemented but no one can demonstrate whether they reduce risk as intended. Which action should be taken to improve the programme's ability to show control effectiveness?

Accepted Answer

Define control objectives, assign owners, and establish metrics and testing that evidence whether each control operates effectively.. Demonstrating effectiveness requires more than counting implemented controls. Each control needs a defined objective tied to risk, a named owner, and measurable evidence from testing or monitoring that it operates as intended. That structure lets the programme detect failures, remove redundant effort, and give leadership defensible assurance, which inventories and attestations alone cannot provide.

Answer

Purchase an automated compliance platform and import the existing control descriptions.

Answer

Increase the frequency of vulnerability scanning across all internet-facing systems.

Answer

Require business units to attest annually that they comply with all security policies.

Question 13

A global financial services firm has a mature information security program. The CISO wants to ensure that the program's strategic objectives remain aligned with changing business goals, such as a new push into mobile banking. Which of the following is the MOST effective way to achieve this alignment?

Accepted Answer

Establish a security steering committee that includes business unit leaders to review and adjust security strategy regularly.. The most effective way to align the security program with changing business goals is to establish a governance structure that includes business stakeholders. A security steering committee facilitates ongoing communication and ensures that security strategy is adjusted in response to business shifts. This proactive approach is central to CISM's focus on aligning security with organizational objectives.

Answer

Increase the security awareness training budget for all employees.

Answer

Update the information security policy to include mobile banking security requirements.

Answer

Conduct an annual penetration test on all mobile banking applications.

Question 14

A healthcare organization has a security program that relies on a risk assessment conducted three years ago. Since then, the organization has adopted cloud services and telehealth, and new privacy regulations have been enacted. The CISO is concerned that the current security controls may not adequately address the new risks. Which of the following should the CISO do FIRST to ensure the program remains effective?

Accepted Answer

Perform a new risk assessment that includes the cloud and telehealth environments.. The CISO should first perform a new risk assessment because significant changes such as cloud adoption, telehealth, and new regulations alter the risk landscape. A current risk assessment identifies new threats, vulnerabilities, and regulatory requirements, enabling the organization to update controls and policies effectively. This aligns with CISM's emphasis on continuous risk management as the core of an information security program.

Answer

Conduct a security awareness campaign focused on telehealth and cloud security.

Answer

Implement additional security controls for cloud and telehealth based on industry best practices.

Answer

Update the information security policy to include cloud and telehealth security requirements.

Question 15

A multinational corporation has a decentralized information security program. Each business unit manages its own security budget and controls, leading to inconsistent practices and duplicated efforts. The CISO wants to improve program efficiency and effectiveness while respecting business unit autonomy. Which of the following is the BEST approach?

Accepted Answer

Establish a common security framework and governance model that defines minimum standards while allowing business units flexibility.. The best approach is to establish a common security framework and governance model that sets minimum standards while allowing flexibility. This hybrid model enables consistent risk management and compliance across the organization, reduces duplication, and respects business unit autonomy. It aligns with CISM principles of balancing enterprise-wide security with business-specific needs.

Answer

Outsource all security functions to a managed security service provider (MSSP).

Answer

Centralize all security decision-making and budgets under the CISO.

Answer

Allow each business unit to continue independently but require them to report security metrics to the CISO.

Question 16

A financial services firm has a mature information security program. The Chief Information Security Officer (CISO) is asked by the board to demonstrate that the program is aligned with the organization's strategic objectives. Which of the following is the MOST effective way for the CISO to provide this assurance?

Accepted Answer

Map security program objectives and metrics to specific business goals and report on their contribution.. The board wants assurance that security is not a siloed function but is integrated with business strategy. Mapping security objectives and metrics to business goals provides that assurance by showing how security enables business outcomes. Other options focus on compliance, technical posture, or incident history, which do not directly address strategic alignment. The CISO should use business language and measurable contributions to demonstrate value.

Answer

Present the results of the latest penetration test and vulnerability remediation statistics.

Answer

Conduct a gap analysis against ISO/IEC 27001:2022 and present the results to the board.

Answer

Provide a summary of security incidents and the associated financial losses over the past year.

Question 17

A multinational corporation's information security program is decentralized, with each business unit managing its own security controls. The CISO wants to implement a federated governance model to improve consistency while respecting business unit autonomy. Which of the following is the MOST critical factor for the success of this model?

Accepted Answer

Defining clear roles, responsibilities, and decision rights between central and business unit security teams.. A federated governance model balances central oversight with business unit autonomy. The most critical factor is defining clear roles, responsibilities, and decision rights, which prevents confusion and ensures consistent application of security policies while allowing local flexibility. Other options focus on technology, compliance, or centralization, which do not address the core governance challenge. Without clear decision rights, federated models often stall.

Answer

Requiring each business unit to achieve ISO/IEC 27001 certification within one year.

Answer

Establishing a central security operations center (SOC) that monitors all business units.

Answer

Implementing a single security toolset across all business units to ensure uniformity.

Question 18

A CISO is building a new information security program for a multinational corporation. The board has approved a risk appetite statement but has not yet approved a security budget. The CISO must decide which activity to perform FIRST to ensure the program aligns with business objectives. What should the CISO do first?

Accepted Answer

Translate the board's risk appetite into specific security requirements and objectives. The correct answer is to translate the board's risk appetite into specific security requirements and objectives. This step ensures the security program is aligned with business goals and provides a basis for resource allocation, prioritization, and measurement. It bridges the gap between high-level risk tolerance and operational security activities, enabling the CISO to build a program that effectively manages risk in line with the organization's strategic direction.

Answer

Conduct a comprehensive asset inventory and vulnerability assessment

Answer

Purchase and deploy an advanced endpoint detection and response (EDR) solution

Answer

Implement a security awareness training program for all employees

Question 19

An organization is establishing a new information security program. The CISO needs to ensure that the program's structure and processes are aligned with the organization's overall business strategy. Which of the following should be the CISO's FIRST step?

Accepted Answer

Meet with executive leadership to understand business objectives and risk appetite.. The CISO's first step should be to meet with executive leadership to understand business objectives and risk appetite. This ensures that the security program is aligned with the organization's strategy from the outset. Without this understanding, subsequent activities like risk assessment and policy development may not support business goals. This step is fundamental to CISM's approach to information security governance.

Answer

Develop a comprehensive set of security policies and procedures.

Answer

Implement a security awareness training program for all employees.

Answer

Conduct a risk assessment to identify and prioritize risks to the organization.

Question 20

A healthcare organization is conducting a risk assessment for a new telehealth platform that will process protected health information. The assessment team proposes using a qualitative approach because of tight deadlines. Which of the following is the MOST significant limitation of relying solely on qualitative risk assessment for this initiative?

Accepted Answer

It may produce inconsistent ratings that are difficult to compare across systems or justify to regulators. Qualitative risk assessment relies on subjective judgment and descriptive scales, which can lead to inconsistent ratings across assessors and make it difficult to compare risks or provide defensible evidence to regulators. For a telehealth platform processing protected health information, the organization needs consistent, auditable risk prioritization, so the lack of repeatability and comparability is the most significant limitation.

Answer

It takes significantly longer to complete than a quantitative assessment

Answer

It cannot incorporate input from clinical staff who understand patient workflows

Answer

It requires specialized statistical software that the organization may not have licensed