CISM Information Security Governance Practice Test 5 — 15 Questions

Question 1

Which of the following is the PRIMARY reason for aligning the information security program with business objectives?

Accepted Answer

To demonstrate the value of security to the business and gain executive support. Aligning security with business objectives ensures that security investments support business goals and demonstrate value to stakeholders.

Answer

To reduce the cost of security operations

Answer

To comply with regulatory requirements

Answer

To ensure security initiatives receive adequate funding

Question 2

An organization has a decentralized governance model with security teams embedded in each business unit. The CISO is concerned about inconsistent security controls across the enterprise. What is the BEST recommendation to address this?

Accepted Answer

Adopt a hybrid governance model with enterprise-wide standards and local execution. A hybrid model combines the benefits of centralized oversight with decentralized execution, ensuring consistency while maintaining business unit flexibility.

Answer

Conduct a risk assessment to prioritize controls

Answer

Implement a centralized security operations center (SOC) to monitor all units

Answer

Move to a fully centralized governance model

Question 3

A CISO is preparing a multi-year security roadmap. Which of the following is the MOST critical factor for ensuring the roadmap aligns with business strategy?

Accepted Answer

Understanding the organization's strategic business objectives and risk appetite. Understanding business objectives first ensures that security initiatives support the organization's goals and are prioritized accordingly.

Answer

Benchmarking against industry peers

Answer

Assessing current security maturity level

Answer

Reviewing recent security incidents and lessons learned

Question 4

In a Capability Maturity Model (CMM) for information security processes, which level is characterized by processes being measured and controlled?

Accepted Answer

Level 4 (Managed). Level 4 (Managed) involves quantitative measurement and control of processes.

Answer

Level 5 (Optimizing)

Answer

Level 2 (Repeatable)

Answer

Level 3 (Defined)

Question 5

The board of directors has requested a security metrics dashboard. Which metric would BEST demonstrate the effectiveness of the incident response process?

Accepted Answer

Mean Time to Respond (MTTR). Mean Time to Respond (MTTR) directly measures the speed and effectiveness of incident response.

Answer

Percentage of users trained

Answer

Number of security incidents

Answer

Patch compliance percentage

Question 6

An organization is developing a security policy for remote access. According to the policy hierarchy, where should this policy fit?

Accepted Answer

Domain-specific standard. Enterprise security policy is high-level; domain-specific standards provide mandatory requirements for specific areas like remote access.

Answer

Procedure

Answer

Guideline

Answer

Enterprise security policy

Question 7

A CISO is building a business case for a new security tool. Which of the following approaches is MOST effective for justifying the investment?

Accepted Answer

Demonstrating how the tool reduces the likelihood and impact of a potential breach, translating to expected loss avoidance. Quantifying risk reduction in monetary terms directly links security investment to business value and risk management.

Answer

Highlighting that competitors are using the same tool

Answer

Comparing the tool's cost to industry averages for similar tools

Answer

Emphasizing the tool's advanced features and technical capabilities

Question 8

Which of the following is the PRIMARY role of the board of directors in information security governance?

Accepted Answer

Providing oversight and ensuring security is aligned with business strategy. The board sets the tone from the top and ensures security is integrated into organizational strategy and risk management.

Answer

Conducting daily security operations

Answer

Developing detailed security policies

Answer

Approving specific security technologies

Question 9

Which of the following best describes a key benefit of a centralized information security governance model?

Accepted Answer

Consistent enforcement of security policies and standards. Centralized models provide consistent application of controls and policies across the organization.

Answer

Greater autonomy for business units

Answer

Reduced need for executive oversight

Answer

Faster adaptation to local business needs

Question 10

An organization is implementing a security awareness program. Which metric is MOST indicative of a positive security culture?

Accepted Answer

High near-miss reporting rate. A high near-miss reporting rate indicates that employees are vigilant and willing to report potential issues without fear of blame.

Answer

Low number of incidents caused by human error

Answer

Low phishing simulation click rate

Answer

High training completion percentage

Question 11

A multinational organization must comply with GDPR, CCPA, and PCI DSS. Which approach is MOST effective for managing these overlapping requirements?

Accepted Answer

Develop a unified compliance framework that maps controls to multiple regulations. A unified compliance framework reduces duplication and ensures consistent control application across regulations.

Answer

Outsource compliance management to a third-party consultant

Answer

Prioritize compliance based on the most stringent regulation

Answer

Assign separate teams to manage each regulation

Question 12

Which of the following is the FIRST step in the security policy development lifecycle?

Accepted Answer

Gap analysis. A gap analysis identifies current state vs. desired state, which is necessary before drafting policy.

Answer

Legal review

Answer

Stakeholder consultation

Answer

Drafting the policy

Question 13

A CISO is presenting a security metrics dashboard to the board. Which TWO metrics are most appropriate for board-level reporting? (Select TWO.)

Accepted Answer

Security investment vs. loss avoidance. Board-level metrics should focus on strategic outcomes such as incident response and financial impact.

Answer

Number of security staff per business unit

Answer

Number of firewall rules changed

Answer

Average patch deployment time

Question 14

An organization is implementing a policy exception management process. Which THREE elements are essential for effective exception handling? (Select THREE.)

Accepted Answer

Periodic review and renewal of exceptions. Effective exception management requires documentation, approval, and periodic review to prevent exceptions from becoming permanent risks.

Answer

Publicizing the exception to all employees

Answer

Automatic expiration of the exception after a defined period

Question 15

Which TWO factors are most important when prioritizing security investments? (Select TWO.)

Accepted Answer

The level of risk reduction achieved. Risk reduction and alignment with business strategy ensure investments address the most critical needs and support organizational goals.

Answer

The ease of implementation

Answer

The cost of the security solution

Answer

The popularity of the solution in the industry