CISM Information Security Governance Practice Test 3 — 15 Questions

Question 1

Which governance structure is characterized by a single security team that serves the entire organization?

Accepted Answer

Centralized. A centralized governance model consolidates security responsibilities under one team, ensuring consistent policy enforcement and resource allocation.

Answer

Matrix

Answer

Hybrid

Answer

Decentralized

Question 2

An organization is developing an information security strategy aligned with business objectives. Which of the following is the BEST approach to prioritize security investments?

Accepted Answer

Use a risk-based approach aligned to business impact. A risk-based approach aligns security investments with the organization's risk appetite, ensuring resources are directed to the most critical areas.

Answer

Follow industry benchmarks without adjustment

Answer

Prioritize based on the cost of security controls

Answer

Allocate budget equally across all security domains

Question 3

A CISO is reporting to the board of directors. Which metric would BEST demonstrate the effectiveness of the security program in reducing business impact?

Accepted Answer

Security investment vs. loss avoidance. Security investment vs. loss avoidance directly links spending to prevented losses, demonstrating ROI and program effectiveness to the board.

Answer

Number of security incidents

Answer

Patch compliance percentage

Answer

Mean time to detect (MTTD)

Question 4

Which of the following is the FIRST step in the security policy development lifecycle?

Accepted Answer

Gap analysis. The lifecycle begins with gap analysis to identify missing or outdated policies before drafting or approval.

Answer

Legal review

Answer

Approval

Answer

Stakeholder consultation

Question 5

A policy exception management process allows a business unit to temporarily deviate from a security policy. What is the MOST important requirement for such an exception?

Accepted Answer

Implementation of compensating controls. Compensating controls are essential to mitigate the risk of the exception, ensuring the organization's risk posture is acceptable.

Answer

Documentation of the exception

Answer

Approval by the CISO only

Answer

A fixed expiration date

Question 6

An organization's board of directors wants to improve security culture. Which initiative would have the GREATEST impact?

Accepted Answer

Establishing executive sponsorship of security. Executive sponsorship from the board demonstrates top-down commitment, which is critical for driving cultural change.

Answer

Increasing the security awareness training budget

Answer

Implementing a near-miss reporting system

Answer

Conducting monthly phishing simulations

Question 7

A multinational organization must comply with GDPR, CCPA, and PCI DSS. The security manager is designing a compliance monitoring program. Which approach is MOST efficient?

Accepted Answer

Map common controls to multiple regulations. Mapping controls to multiple regulations reduces duplication and ensures comprehensive coverage across requirements.

Answer

Create separate monitoring programs for each regulation

Answer

Outsource compliance to a third-party

Answer

Focus only on the strictest regulation

Question 8

In which reporting model does the CISO have a direct reporting line to the CEO while also reporting to the CIO on operational matters?

Accepted Answer

Solid line to CEO, dotted line to CIO. A dotted line reporting to the CIO and solid line to the CEO gives the CISO strategic authority while maintaining operational alignment.

Answer

Solid line to CIO, dotted line to CEO

Answer

Dotted line to both CEO and CIO

Answer

Solid line to both CEO and CIO

Question 9

Which capability maturity model (CMM) level indicates that security processes are managed and measured using quantitative metrics?

Accepted Answer

Level 4: Managed. Level 4 (Managed) is characterized by quantitative management of processes.

Answer

Level 3: Defined

Answer

Level 2: Repeatable

Answer

Level 5: Optimizing

Question 10

A CISO is building a business case for a new security tool. Which approach BEST quantifies the value of the investment?

Accepted Answer

Risk reduction value and breach cost avoidance. Comparing the cost of the tool against the average cost of a data breach (e.g., $4.35M) provides a clear financial justification.

Answer

Industry analyst recommendations

Answer

Number of features compared to competitors

Answer

Total cost of ownership (TCO) analysis

Question 11

Which of the following is the BEST metric for the board to assess the security program's effectiveness in detecting threats?

Accepted Answer

Mean time to detect (MTTD). Mean time to detect (MTTD) directly measures the speed of threat detection, a key indicator of detection capability.

Answer

Patch compliance percentage

Answer

Number of security incidents

Answer

Phishing simulation click rate

Question 12

An organization is updating its security policies. After drafting the policy, which step should occur NEXT?

Accepted Answer

Legal review. Legal review ensures the policy complies with applicable laws and regulations before seeking approval.

Answer

Stakeholder consultation

Answer

Training and awareness

Answer

Approval by management

Question 13

A CISO is designing a security metrics program for the board. Which TWO metrics are MOST appropriate for board-level reporting?

Accepted Answer

Security investment vs. loss avoidance. Mean time to respond (MTTR) and security investment vs. loss avoidance are strategic metrics that inform risk management and resource allocation.

Answer

Phishing simulation click rate

Answer

Average patch deployment time

Answer

Number of firewall rules

Question 14

A financial services firm is subject to SOX, PCI DSS, and GDPR. The CISO needs to implement a regulatory change management process. Which THREE steps are essential?

Accepted Answer

Assess impact on existing controls. Monitoring regulatory changes, assessing impact, and updating controls are critical to maintaining compliance.

Answer

Immediately enforce all changes regardless of cost

Answer

Outsource compliance to a single vendor

Question 15

Which TWO elements are key components of a security culture measurement program?

Accepted Answer

Phishing simulation click rates. Phishing simulation click rates and training completion rates are common quantitative measures of security culture.

Answer

Number of security policies

Answer

Vulnerability scan frequency

Answer

Firewall log size