CISM Information Security Governance Practice Test 4 — 15 Questions

Question 1

Which governance model is characterized by a single, centralized security team that serves the entire organization?

Accepted Answer

Centralized. Centralized governance consolidates security resources and authority under one team, ensuring consistent policy enforcement and streamlined management.

Answer

Federated

Answer

Decentralized

Answer

Hybrid

Question 2

An organization's board of directors wants to ensure that security activities align with business objectives. Which governance practice best supports this alignment?

Accepted Answer

Developing a multi-year security roadmap tied to business strategy. A security strategy that directly references business goals ensures that security investments and initiatives support organizational priorities.

Answer

Conducting annual security awareness training

Answer

Implementing a decentralized security model

Answer

Hiring a CISO with a technical background

Question 3

A CISO reports to the CIO and provides regular security updates to the board audit committee. The CEO has delegated security accountability to the CFO. Which governance structure does this reflect?

Accepted Answer

Hybrid with executive accountability. This structure shows the CISO reporting to CIO (dotted line to board), with executive accountability assigned to CFO, typical of a tiered governance model.

Answer

Decentralized with business unit CISO

Answer

Outsourced security management

Answer

Centralized with CISO reporting to CEO

Question 4

Which capability maturity model (CMM) level indicates that security processes are measured and controlled?

Accepted Answer

Level 4: Managed. Level 4 (Managed) involves quantitative measurement and control of processes.

Answer

Level 3: Defined

Answer

Level 5: Optimizing

Answer

Level 2: Repeatable

Question 5

A security manager wants to measure the effectiveness of the security awareness program. Which metric is most relevant?

Accepted Answer

Phishing simulation click rate. Phishing simulation click rate directly measures user behavior change, a key indicator of awareness effectiveness.

Answer

Security budget variance

Answer

Mean time to detect incidents

Answer

Number of security policies updated

Question 6

During a policy exception review, the CISO identifies that multiple exceptions have been granted for the same control due to business constraints. What is the best course of action?

Accepted Answer

Revise the policy to accommodate the business need. Addressing root causes reduces reliance on exceptions and strengthens the security posture.

Answer

Escalate to the board for approval

Answer

Increase monitoring of excepted systems

Answer

Reject all future exceptions for that control

Question 7

Which regulatory requirement mandates that organizations implement data protection measures for personal data of EU citizens?

Accepted Answer

GDPR. GDPR is the primary regulation for personal data protection in the EU.

Answer

SOX

Answer

PCI DSS

Answer

HIPAA

Question 8

What is the primary purpose of a security incident near-miss reporting culture?

Accepted Answer

To identify and address security gaps proactively. Encouraging reporting of near misses helps identify weaknesses and prevent future incidents.

Answer

To increase the security budget

Answer

To reduce the number of security policies

Answer

To assign blame for potential incidents

Question 9

A company is developing a business case for a new security tool. Which metric best demonstrates the value of the investment?

Accepted Answer

Security investment vs. loss avoidance. Comparing security investment to potential loss avoidance quantifies ROI in business terms.

Answer

Number of security incidents

Answer

Percentage of budget spent on security

Answer

Time to implement the tool

Question 10

An organization's security strategy includes a goal to achieve CMM Level 3. What capability does the organization need to demonstrate?

Accepted Answer

Standardized and documented security processes. Level 3 (Defined) requires standardized, documented processes across the organization.

Answer

Ad-hoc security processes

Answer

Quantitative measurement of process effectiveness

Answer

Continuous process optimization

Question 11

Which board-level committee typically receives security reports to provide oversight?

Accepted Answer

Audit/risk committee. The audit/risk committee is responsible for oversight of risk management and control, including security.

Answer

Nominating committee

Answer

Compensation committee

Answer

Finance committee

Question 12

What is the first step in the security policy development lifecycle?

Accepted Answer

Gap analysis. Gap analysis identifies missing or inadequate controls before drafting new policies.

Answer

Legal review

Answer

Drafting the policy

Answer

Stakeholder consultation

Question 13

A CISO is presenting a security investment proposal to the board. Which two metrics are most effective for articulating the business value of the investment?

Accepted Answer

Breach cost avoidance. Breach cost avoidance directly quantifies risk reduction, and compliance cost avoidance shows regulatory value.

Answer

Mean time to patch

Answer

Number of security staff

Answer

Number of security tools deployed

Question 14

An organization is updating its security governance framework. Which three elements are essential for ensuring board-level oversight?

Accepted Answer

Board-level risk committee review of security posture. These three elements ensure the board can fulfill its oversight role effectively.

Answer

Security awareness training for board members

Answer

CISO reporting directly to the CEO

Question 15

A security manager is measuring the security culture of the organization. Which three metrics are most appropriate?

Accepted Answer

Phishing simulation click rate. These metrics directly reflect employee behavior and the effectiveness of the security culture program.

Answer

Security budget as percentage of IT budget

Answer

Number of security policies published