CISM Information Security Governance Practice Test 6 — 15 Questions

Question 1

An organization is implementing a security awareness program. Which metric is MOST indicative of a positive security culture?

Accepted Answer

High near-miss reporting rate. A high near-miss reporting rate is the most indicative metric of a positive security culture because it demonstrates that employees are proactively identifying and reporting potential security issues before they escalate into incidents. This behavior reflects trust in the reporting process, psychological safety, and a collective commitment to security—key attributes of a mature security culture. Unlike lagging indicators such as incident counts or phishing click rates, near-miss reporting is a leading indicator that shows engagement and vigilance. It signals that security is integrated into daily operations rather than merely compliance-driven.

Answer

Low number of incidents caused by human error

Answer

Low phishing simulation click rate

Answer

High training completion percentage

Question 2

A multinational organization must comply with GDPR, CCPA, and PCI DSS. Which approach is MOST effective for managing these overlapping requirements?

Accepted Answer

Develop a unified compliance framework that maps controls to multiple regulations. A unified compliance framework maps common controls to multiple regulatory requirements (GDPR, CCPA, PCI DSS), eliminating duplicated effort, reducing gaps, and providing a single source of truth for auditors. This is the standard 'compliance harmonization' or 'control mapping' approach recommended by ISACA and industry frameworks such as the Unified Compliance Framework (UCF) and NIST SP 800-53 mappings. It allows one control implementation to satisfy several regulations simultaneously.

Answer

Outsource compliance management to a third-party consultant

Answer

Prioritize compliance based on the most stringent regulation

Answer

Assign separate teams to manage each regulation

Question 3

A CISO is presenting a security metrics dashboard to the board. Which TWO metrics are most appropriate for board-level reporting? (Select TWO.)

Accepted Answer

Security investment vs. loss avoidance. Option B (Security investment vs. loss avoidance) is correct because it expresses security spending in financial, risk-adjusted terms that directly map to the board's fiduciary concerns about cost-benefit and return on security investment, making it a strategic business metric rather than an operational one. Option D (Mean time to detect, MTTD) is correct because it is a key outcome-oriented metric from the NIST CSF Detect function that quantifies how quickly the organization identifies incidents, giving the board a clear view of detection capability and risk exposure over time. Option A (Number of security staff per business unit) is a resourcing/staffing ratio that is more relevant to operational capacity planning than to board-level risk and value reporting. Option C (Number of firewall rules changed) is a low-level operational change metric that reflects configuration churn, not security posture or business risk. Option E (Average patch deployment time) is a tactical vulnerability-management metric better suited to IT operations or security team dashboards than to the board.

Answer

Number of security staff per business unit

Answer

Number of firewall rules changed

Answer

Average patch deployment time

Question 4

Which TWO factors are most important when prioritizing security investments? (Select TWO.)

Accepted Answer

The level of risk reduction achieved. Option B (the level of risk reduction achieved) is correct because security investment prioritization should be driven by how much a control actually lowers identified risk, typically assessed through risk analysis that weighs likelihood and impact against the residual risk remaining after the control is applied. Option C (alignment with business objectives and strategy) is correct because security spending must support the organization's mission, compliance obligations, and strategic goals, ensuring that limited budget is directed toward protecting the assets and processes that matter most to the business. Options A, D, and E are not among the two most important factors: ease of implementation and cost are practical considerations but can lead to underinvesting in high-risk areas, and industry popularity is a weak justification since threat profiles and business contexts differ across organizations.

Answer

The ease of implementation

Answer

The cost of the security solution

Answer

The popularity of the solution in the industry

Question 5

An organization has a decentralized governance model where each business unit manages its own security team. The CISO reports to the CIO. Which of the following is the GREATEST risk associated with this structure?

Accepted Answer

Inconsistent enforcement of security policies across business units. In a decentralized governance model where each business unit runs its own security team and the CISO reports to the CIO (rather than the board or CEO), the greatest risk is inconsistent enforcement of security policies across business units. Decentralization without a strong central authority or common control framework leads to divergent interpretations, uneven risk postures, and gaps that attackers can exploit across the enterprise. This is a governance and risk aggregation issue, which outweighs cost or staffing concerns.

Answer

Difficulty in achieving economies of scale for security operations

Answer

Lack of skilled security personnel in some business units

Answer

Increased cost due to duplication of security tools

Question 6

A CISO is developing a multi-year security roadmap aligned with business strategy. The organization is in a highly regulated industry with frequent regulatory changes. Which of the following should be the PRIMARY driver for prioritizing security initiatives?

Accepted Answer

Alignment with current and upcoming regulatory requirements. In a highly regulated industry with frequent regulatory changes, the primary driver for prioritizing security initiatives must be alignment with current and upcoming regulatory requirements, because non-compliance creates legal, financial, and reputational risk that can halt business operations. The CISO's roadmap must map security investments to regulatory obligations first, then layer in maturity and efficiency improvements. This ensures the security program directly supports the business's ability to operate legally and competitively.

Answer

Reduction of the mean time to detect (MTTD) security incidents

Answer

Cost savings from consolidating security tools

Answer

Achieving a target capability maturity model (CMM) level

Question 7

Which of the following is the BEST example of a board-level security metric?

Accepted Answer

Security investment versus loss avoidance. Board-level metrics should reflect impact on business objectives and financial performance. Investment vs. loss avoidance directly ties security spending to business value.

Answer

Vulnerability scan completion rate

Answer

Number of firewall rules implemented

Answer

Percentage of employees who completed security training

Question 8

An organization is updating its security policy framework. The current enterprise security policy has not been reviewed in three years. What is the FIRST step in the policy development lifecycle?

Accepted Answer

Conducting a gap analysis. A gap analysis is the first step in the policy development lifecycle because it establishes the current state of the existing policy against the desired state (e.g., business objectives, regulatory requirements, industry standards). Without understanding what is missing or outdated, any drafting or review would be based on assumptions. CISM emphasizes that policy development begins with assessing the current environment and identifying gaps before making changes.

Answer

Obtaining legal review

Answer

Training employees on the updated policy

Answer

Drafting the revised policy language

Question 9

A CISO is building a business case for a new security tool. Which TWO metrics would BEST justify the investment to senior leadership?

Accepted Answer

Compliance cost avoidance. Compliance cost avoidance (A) is correct because it translates the tool's controls into avoided regulatory fines, penalties, and audit remediation expenses, which senior leadership can directly compare against the investment's price tag. Breach cost avoidance (B) is also correct because it quantifies the potential financial impact of prevented incidents—such as forensics, notification, legal, and downtime costs—making the business case in the language of risk and ROI that executives use for capital decisions. The remaining options are operational or technical metrics rather than financial justifications: MTTR improvements (C) indicate response efficiency but not the monetary value of the investment, phishing simulation click rate (D) measures user awareness program effectiveness, and number of vulnerabilities discovered (E) reflects scanning volume rather than business impact or cost savings.

Answer

Mean time to respond (MTTR) improvements

Answer

Phishing simulation click rate

Answer

Number of vulnerabilities discovered

Question 10

Which TWO components are essential for an effective information security governance framework?

Accepted Answer

Board-level oversight of security programs. Option C is correct because an effective information security governance framework requires board-level oversight, which provides strategic direction, accountability, and authority for the security program at the highest organizational level. Option D is correct because governance must align the security program with business objectives, ensuring that security investments and risk decisions directly support organizational goals and value creation. These two components reflect the core purpose of governance—direction and alignment from leadership—rather than operational or tactical activities. Option A is incorrect because an intrusion detection system is a technical control used in security operations, not a governance component. Option B is incorrect because detailed technical configuration guides are implementation artifacts, not governance elements. Option E is incorrect because daily threat intelligence feeds are operational inputs that support monitoring and response, not governance structure or oversight.

Answer

Implementation of an intrusion detection system

Answer

Detailed technical configuration guides

Answer

Daily threat intelligence feeds

Question 11

A CISO is developing a security strategy. Which THREE elements should be included in a multi-year security roadmap?

Accepted Answer

Milestones for achieving target capability maturity levels. A multi-year security roadmap must define measurable progress, so option A is correct: milestones tied to target capability maturity levels (for example, moving from CMMI level 2 to level 3 in specific domains) give the roadmap verifiable checkpoints over its multi-year horizon. Option D is correct because a roadmap is only executable if it specifies resource allocation—budget, headcount, and technology investments—for each initiative across the planning years. Option E is correct because the roadmap must align with business strategic goals so security investments directly support organizational objectives and priorities rather than existing as an isolated technical plan. Option B does not belong because current vulnerability scan results are point-in-time operational data that inform tactical remediation, not multi-year strategic planning elements. Option C does not belong because detailed network architecture diagrams are technical documentation artifacts used for design and troubleshooting, not roadmap components.

Answer

Current vulnerability scan results

Answer

Detailed network architecture diagrams

Question 12

An organization is designing a policy exception management process. Which THREE elements are critical for this process to be effective?

Accepted Answer

Approval by the CISO or designated authority. Option A is correct because an exception to a security policy must be authorized by the CISO or another designated authority who owns the risk, ensuring accountability and preventing unauthorized deviations from the baseline. Option C is correct because formal documentation of the exception request captures the justification, scope, risk assessment, compensating controls, and approver, providing an auditable record for compliance and future review. Option E is correct because every exception should carry an expiration date so it is time-bound and automatically reviewed or revoked, preventing permanent, unmanaged risk acceptance. Option B is incorrect because automatic approval after 24 hours of silence would grant exceptions without any risk review or authorization, which is the opposite of effective governance. Option D is incorrect because allowing any employee to request an exception is not itself a critical control; the process must define who is authorized to request and, more importantly, who can approve, so unrestricted requesting does not make the process effective.

Answer

Automatic approval if no response within 24 hours

Answer

Ability for any employee to request an exception

Question 13

Which TWO regulations are MOST likely to impact an organization that processes credit card payments and handles personal data of EU residents?

Accepted Answer

GDPR. Option C (GDPR) is correct because the organization handles personal data of EU residents, and the EU General Data Protection Regulation imposes requirements on any entity processing that data regardless of where the organization is located, covering lawful processing, data subject rights, breach notification, and cross-border transfers. Option E (PCI DSS) is correct because the organization processes credit card payments, and the Payment Card Industry Data Security Standard mandates controls for protecting cardholder data, including encryption, access control, and network segmentation. Option A (HIPAA) does not apply because it governs protected health information in the US healthcare context, which is not described here. Option B (SOX) does not apply because it concerns financial reporting and internal controls for publicly traded US companies, not payment card or EU personal data. Option D (CCPA) is not the best fit because it addresses California consumers' personal information, whereas the scenario specifically involves EU residents, making GDPR the relevant privacy regulation.

Answer

HIPAA

Answer

SOX

Answer

CCPA

Question 14

A CISO is reviewing the information security strategy and needs to ensure that security investments are justified in business terms. The CFO has requested that each security initiative be tied to a financial metric that reflects potential loss from cyber events. Which approach is MOST appropriate for the CISO to use?

Accepted Answer

Calculate the annualized loss expectancy (ALE) for each initiative based on risk assessment data.. Using annualized loss expectancy translates risk into monetary terms, enabling direct comparison of security initiatives against expected financial loss. This aligns security governance with business objectives and provides the CFO with a quantifiable basis for investment decisions, which is a core CISM principle for integrating security into business strategy.

Answer

Benchmark the organization's security budget against industry peers.

Answer

Track the percentage of employees who completed security awareness training.

Answer

Report the number of security incidents detected per quarter.

Question 15

A global financial services firm is aligning its information security program with the COBIT framework. The board wants assurance that IT risks are governed effectively. Which COBIT component is MOST directly responsible for ensuring that IT risk management activities are aligned with enterprise risk management?

Accepted Answer

EDM03 Ensured Risk Optimization. EDM03 is part of the governance domain in COBIT and specifically ensures that IT risk management is integrated with enterprise risk management, including setting risk appetite and tolerance. This directly addresses the board's need for assurance that IT risks are governed effectively and aligned with overall enterprise risk.

Answer

MEA03 Managed Compliance with External Requirements

Answer

DSS05 Managed Security Services

Answer

APO12 Managed Risk