CISM Information Security Governance — 20 Questions

Question 1

Which of the following is the PRIMARY responsibility of the board of directors regarding information security governance?

Accepted Answer

Setting the strategic direction and oversight of the security programme. The board is responsible for ensuring that information security is aligned with business objectives and that adequate resources are allocated.

Answer

Performing technical vulnerability assessments

Answer

Approving specific security tools and technologies

Answer

Conducting daily security monitoring activities

Question 2

An organization has a decentralized governance model where each business unit manages its own security. What is a key challenge of this model?

Accepted Answer

Inconsistent security policies and controls across units. Decentralized models often lead to inconsistent security practices and lack of standardization across the organization.

Answer

Lower cost due to elimination of central security team

Answer

Rapid decision-making due to fewer layers

Answer

Increased central control and uniformity

Question 3

A CISO is developing a multi-year security roadmap. Which of the following should be the PRIMARY driver for prioritizing initiatives?

Accepted Answer

Alignment with business strategy and risk appetite. The roadmap must align security initiatives with the organization's strategic business objectives to ensure relevance and support.

Answer

Ease of implementation

Answer

Availability of new technology

Answer

Cost of the initiative

Question 4

Which capability maturity model (CMM) level indicates that security processes are proactively measured and optimized?

Accepted Answer

Level 5 (Optimizing). Level 5 (Optimizing) focuses on continuous improvement through quantitative measurement.

Answer

Level 4 (Managed)

Answer

Level 2 (Repeatable)

Answer

Level 3 (Defined)

Question 5

An organization is implementing a new security policy. Which step should occur AFTER the policy is approved?

Accepted Answer

Training and communication. After approval, training and awareness are essential to ensure employees understand and comply with the policy.

Answer

Stakeholder consultation

Answer

Gap analysis

Answer

Legal review

Question 6

Which board-level metric is MOST useful for measuring the effectiveness of the incident response process?

Accepted Answer

Mean time to respond (MTTR). Mean time to respond (MTTR) directly measures how quickly incidents are contained and remediated.

Answer

Patch compliance percentage

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 7

A CISO is building a business case for a new security tool. Which approach BEST articulates the return on investment (ROI) to the board?

Accepted Answer

Risk reduction value minus total cost of ownership. Risk reduction value quantifies the expected reduction in loss, which directly ties to business value.

Answer

Total cost of ownership (TCO) compared to competitors

Answer

Compliance with industry standards

Answer

Number of alerts the tool will generate

Question 8

An organization is subject to GDPR, PCI DSS, and SOX. What is the BEST approach to manage compliance with multiple regulations?

Accepted Answer

Develop a control framework that maps to all regulations. A unified compliance framework that maps common controls to multiple regulations reduces duplication and cost.

Answer

Assign each regulation to a separate compliance team

Answer

Implement the most stringent requirements for all

Answer

Focus only on the regulation with the highest fines

Question 9

A security awareness programme is being evaluated. Which metric BEST indicates a positive security culture?

Accepted Answer

Number of security incidents reported. The best metric for indicating a positive security culture is the number of security incidents reported. A high number of reported incidents demonstrates employee engagement, vigilance, and trust in the reporting process. This proactive behavior is a stronger indicator of a positive culture than metrics like phishing click rates, which primarily measure specific awareness effectiveness.

Answer

Number of policy violations

Answer

Percentage of employees who completed training

Answer

Phishing simulation click rate

Question 10

Which of the following is the PRIMARY benefit of having a formal policy exception management process?

Accepted Answer

Ensuring consistent treatment of exceptions with proper risk acceptance. A formal process ensures that exceptions are documented, reviewed, and approved, reducing uncontrolled risk.

Answer

Eliminating all security risks

Answer

Reducing the number of security policies

Answer

Automating policy enforcement

Question 11

An organization is deciding whether to adopt a centralized or hybrid security governance model. Which factor MOST strongly favors a hybrid model?

Accepted Answer

High degree of autonomy needed by business units with diverse needs. A hybrid model allows business units to maintain some autonomy while benefiting from central standards and oversight.

Answer

Minimal security budget

Answer

Low regulatory requirements

Answer

Uniform security across all business units

Question 12

Which of the following is the PRIMARY responsibility of the CISO in an organization?

Accepted Answer

Owning the information security strategy and programme. The CISO is accountable for developing and maintaining the information security strategy and programme.

Answer

Managing the IT infrastructure

Answer

Auditing security controls

Answer

Performing day-to-day security operations

Question 13

A CISO is reporting to the board on the effectiveness of the security programme. Which TWO metrics are MOST appropriate for board-level reporting? (Select TWO)

Accepted Answer

Mean time to detect (MTTD) and mean time to respond (MTTR). Board-level metrics should focus on strategic impact, such as overall risk posture and financial implications.

Answer

Number of firewall rules changed

Answer

Number of employees who completed security training

Answer

Patch compliance percentage

Question 14

An organization is updating its information security strategy. Which THREE elements should be included to ensure alignment with business objectives? (Select THREE)

Accepted Answer

Risk appetite and tolerance levels defined by the board. Strategy must be driven by business needs, risk appetite, and regulatory requirements.

Answer

Daily monitoring schedule for security operations center

Answer

A detailed list of firewall ports to block

Question 15

A security policy is being developed. Which THREE steps are part of the policy development lifecycle? (Select THREE)

Accepted Answer

Drafting the policy based on input. The lifecycle includes analysis, consultation, drafting, review, approval, training, and monitoring.

Answer

Conducting penetration testing

Answer

Implementing the policy in firewalls

Question 16

Which of the following is the primary responsibility of the board of directors in information security governance?

Accepted Answer

Setting risk appetite and overseeing security governance. The board is responsible for oversight, ensuring security aligns with business strategy and risk appetite.

Answer

Implementing day-to-day security operations

Answer

Conducting vulnerability assessments

Answer

Writing security policies

Question 17

An organization is implementing a hybrid governance model for information security. Which statement best describes this approach?

Accepted Answer

A central security team sets policies and provides oversight, while business units execute security operations. Hybrid combines centralized oversight with decentralized execution within business units.

Answer

All security decisions are made by a central security team

Answer

Each business unit has full autonomy over security without central coordination

Answer

Security is outsourced to a third-party provider

Question 18

A CISO is developing a multi-year security roadmap. Which approach best ensures the roadmap aligns with business strategy?

Accepted Answer

Align security initiatives with the organization's strategic business objectives. Roadmaps should be derived from business objectives to ensure relevance and executive support.

Answer

Prioritize initiatives based on security team capacity

Answer

Base the roadmap on the latest industry threat intelligence

Answer

Create the roadmap based on compliance requirements only

Question 19

Which capability maturity model (CMM) level is characterized by security processes being standardized and documented across the organization?

Accepted Answer

Level 3 - Defined. CMM Level 3 (Defined) involves standardized, documented processes.

Answer

Level 4 - Managed

Answer

Level 1 - Initial

Answer

Level 2 - Repeatable

Question 20

A security metrics program should include key performance indicators (KPIs) for board reporting. Which metric is most appropriate for executive oversight?

Accepted Answer

Mean time to detect (MTTD) incidents. Mean time to detect is a high-level metric that reflects security effectiveness.

Answer

Number of firewall rules configured

Answer

Daily log volume

Answer

Patch management tool version