CISM Information Security Governance Practice Test 7 — 15 Questions

Question 1

A security manager is developing key performance indicators (KPIs) for the information security program. Which of the following is the MOST important characteristic of an effective KPI?

Accepted Answer

It is aligned with business objectives.. The most critical characteristic of a KPI is alignment with business objectives, as this ensures that security performance is measured in terms of its contribution to organizational goals. This alignment helps justify security investments and demonstrates value to stakeholders. Other characteristics like measurability and benchmarking are secondary to strategic relevance.

Answer

It is easy to measure and report.

Answer

It is based on industry benchmarks.

Answer

It is reviewed annually by the board.

Question 2

A financial services firm with a federated governance model is revising its information security strategy. The board has mandated that security investments must demonstrably support business objectives. The CISO is asked to define the MOST effective way to align security governance with business strategy. Which of the following should the CISO do FIRST?

Accepted Answer

Map information security objectives to the organization's strategic business goals and key performance indicators.. The board's mandate requires demonstrating that security investments support business objectives. Mapping security objectives to strategic business goals and KPIs creates a clear line of sight from security activities to business value, enabling prioritization and justification. This alignment step is foundational; technical assessments, awareness programs, and framework adoption are effective only after strategic alignment is established.

Answer

Conduct a comprehensive vulnerability assessment across all business units to identify technical gaps.

Answer

Implement a security awareness program tailored to each business unit's specific risks.

Answer

Adopt a recognized security framework such as ISO/IEC 27001 to standardize controls across the organization.

Question 3

An organization's security steering committee is reviewing the information security policy framework. The committee wants to ensure that the framework includes a document that defines the organization's overall security direction and is approved by senior management. Which document should the committee expect to find?

Accepted Answer

Information security policy. The information security policy is the foundational governance document that articulates the organization's security direction, objectives, and management commitment. It is approved by senior management and mandates the creation of supporting standards, procedures, and guidelines. This aligns with CISM's emphasis on policy as the top-level driver of the security program.

Answer

Information security standard

Answer

Information security procedure

Answer

Information security guideline

Question 4

A financial services company has a policy requiring annual risk assessments for all critical vendors. During an internal audit, it is discovered that several vendors have not been reassessed in over two years. The CISO needs to address this governance gap. Which action should be taken FIRST?

Accepted Answer

Review the vendor risk management process to identify why reassessments were not performed and implement controls to prevent recurrence.. The most effective first step is to review the vendor risk management process to determine why reassessments were not conducted and to implement corrective actions. This addresses the root cause and ensures the governance framework is strengthened. Immediate assessments or terminations may be needed later, but understanding and fixing the process is fundamental to preventing recurrence and demonstrating effective security governance.

Answer

Conduct immediate risk assessments for all overdue vendors to close the compliance gap.

Answer

Escalate the non-compliance to the board of directors and request additional budget.

Answer

Immediately terminate contracts with all vendors that are overdue for reassessment.

Question 5

A CISO is updating the organization's information security strategy to address emerging risks from cloud adoption and remote work. Which of the following should be the FIRST step in this process?

Accepted Answer

Conduct a risk assessment to identify new threats and vulnerabilities.. The first step in updating the security strategy is to conduct a risk assessment, as it provides the necessary understanding of new risks introduced by cloud adoption and remote work. This risk-based approach ensures that subsequent decisions on controls, training, and investments are prioritized according to business impact and risk appetite.

Answer

Implement a cloud access security broker (CASB) solution.

Answer

Revise the security awareness training program.

Answer

Benchmark the organization's security posture against industry peers.

Question 6

A CISO at a healthcare insurer is revising the information security strategy after a merger with a smaller regional provider. The board has asked how security will support the combined company's growth targets while protecting patient data. Which action BEST aligns the security strategy with the business objectives?

Accepted Answer

Map security initiatives to the business goals and regulatory obligations of the merged entity, then validate them with executive stakeholders.. The correct answer is the one that maps security initiatives to business goals and regulatory obligations and validates them with executives. In CISM, information security governance requires that security strategy be aligned with business objectives and driven by top management. After a merger, the business context changes, so the CISO must ensure the strategy supports the new goals while meeting compliance requirements. Executive validation ensures the strategy is owned at the right level.

Answer

Adopt the stricter of the two pre-merger security policies and enforce it across both organizations immediately.

Answer

Delegate the development of a new security strategy to the IT operations team, since they understand the technical infrastructure.

Answer

Benchmark the merged company's security program against industry peers and adopt their best practices.

Question 7

A global retailer is establishing an information security governance framework. The CISO must ensure that the framework addresses both internal and external requirements. Which THREE of the following are essential components of an effective information security governance framework? (Choose three.)

Accepted Answer

A defined risk appetite statement approved by senior management.. An effective governance framework must include strategic elements: a risk appetite statement approved by senior management, clearly assigned roles and responsibilities, and a compliance monitoring process. These components provide direction, accountability, and assurance. Operational tools like asset inventories and incident dashboards are important but do not constitute governance; they support execution under the framework.

Answer

A real-time security incident dashboard for the security operations center.

Answer

A detailed inventory of all hardware assets with firmware versions.

Question 8

An organization's information security strategy is being updated to align with the business goal of expanding into new markets. The CISO must ensure that the strategy addresses the varying legal and regulatory requirements of these markets. Which of the following should be the PRIMARY consideration when updating the strategy?

Accepted Answer

The potential impact of regulatory non-compliance on the organization's reputation and ability to operate.. When updating the security strategy to support business expansion, the primary consideration is the impact of regulatory non-compliance, as it directly affects the organization's ability to operate in new markets and its reputation. This ensures that the strategy is aligned with business objectives and prioritizes risk management. Other factors like cost, resources, and framework extensibility are important but secondary to understanding and mitigating compliance risks.

Answer

The cost of implementing additional security controls required by new regulations.

Answer

The existing security control framework's ability to be extended to cover new requirements.

Answer

The availability of security personnel with expertise in the new markets' regulations.

Question 9

A CISO is developing a set of key risk indicators (KRIs) to monitor information security governance effectiveness. The CISO wants to ensure that the KRIs are actionable and aligned with business objectives. Which two characteristics are MOST important for effective KRIs? (Choose two.)

Accepted Answer

They are measurable and quantifiable.. Effective KRIs are measurable and quantifiable, enabling objective tracking, and are directly tied to business objectives and risk appetite, ensuring relevance to strategic goals. These characteristics allow the CISO to monitor governance effectiveness and make informed decisions that align security with business needs.

Answer

They are updated on an annual basis to reduce reporting overhead.

Answer

They are based solely on industry benchmarks.

Answer

They are kept confidential and shared only with the security team.

Question 10

A global retailer's CISO is establishing an information security governance framework. The company operates in 20 countries, each with different privacy laws. The board wants assurance that security investments are justified and risks are managed consistently. Which governance mechanism BEST provides this assurance?

Accepted Answer

A security steering committee with representatives from each region, chaired by the CISO, that reviews risks and approves investments.. The correct answer is the security steering committee with regional representation. In CISM, governance is about directing and controlling the organization's security activities to achieve objectives. A steering committee provides the structure for oversight, decision-making, and accountability. It ensures that security investments are justified by business needs and risk, and that risks are managed consistently across diverse regions. This mechanism directly addresses the board's need for assurance.

Answer

A centralized security operations center (SOC) that monitors all countries 24/7.

Answer

A dashboard that reports security metrics to the board on a quarterly basis.

Answer

An annual penetration test conducted by an external firm across all locations.

Question 11

A newly appointed CISO is establishing an information security governance framework. The organization has a complex structure with multiple business units, each with its own IT function. The CISO wants to ensure that security decisions are made with input from all relevant stakeholders and that security risks are managed consistently across the enterprise. Which of the following should be the CISO's FIRST step in establishing this framework?

Accepted Answer

Create a security steering committee composed of senior leaders from each business unit and key corporate functions.. Establishing a security steering committee is the foundational step for governance because it creates the decision-making body that aligns security with business strategy, ensures cross-functional representation, and provides oversight for risk management. Without this structure, subsequent activities like risk assessment, policy development, and awareness training may lack coordination and strategic alignment.

Answer

Implement a security awareness training program for all employees to build a security culture.

Answer

Conduct a comprehensive security risk assessment to identify all vulnerabilities and threats.

Answer

Develop a detailed information security policy manual that mandates compliance from all business units.

Question 12

A CISO is developing a set of information security policies for a healthcare organization. The organization must comply with HIPAA and internal privacy requirements. Which of the following should be the PRIMARY consideration when drafting the security policy framework?

Accepted Answer

Alignment with the organization's mission, goals, and regulatory obligations.. Security policies must first align with the organization's mission, goals, and regulatory obligations to ensure they support business objectives and comply with laws like HIPAA. Cost, technical feasibility, and IT preferences are secondary considerations that influence implementation but should not dictate policy content. This alignment ensures policies are relevant, enforceable, and legally sound.

Answer

The preferences of the IT department regarding policy structure and wording.

Answer

The technical feasibility of enforcing each policy with existing tools.

Answer

The cost of implementing each policy control across the organization.

Question 13

A newly appointed CISO is reviewing the organization's information security governance framework. The CISO finds that security responsibilities are not clearly defined across business units, leading to gaps and overlaps. Which of the following should the CISO do FIRST to address this issue?

Accepted Answer

Develop a RACI chart to clarify roles and responsibilities for security activities.. The first step to address unclear security responsibilities is to develop a RACI chart. This tool clearly defines roles and responsibilities for specific security activities, eliminating gaps and overlaps. It provides a practical framework that can be used immediately to improve governance. Other actions like awareness, risk assessment, and policy revision are important but should follow after roles are clarified to ensure they are effective.

Answer

Conduct a risk assessment to identify critical assets and threats.

Answer

Revise the information security policy to include detailed role descriptions.

Answer

Implement a security awareness program to educate employees on their security responsibilities.

Question 14

A financial services company is updating its information security policies to reflect a new regulation. The CISO must ensure the policies are effectively communicated and enforced. Which action is MOST important to achieve this?

Accepted Answer

Obtain executive management approval and communicate the policies with mandatory training and acknowledgment.. The correct answer is to obtain executive approval and communicate with mandatory training and acknowledgment. In CISM, policy governance requires that policies are authorized at the highest level and then effectively communicated. Training ensures employees understand their responsibilities, and acknowledgment provides evidence of compliance. This approach ensures the policies are enforced and can be audited, which is essential for regulatory compliance.

Answer

Include the policies in the employee handbook and require new hires to sign them during onboarding.

Answer

Ask department managers to verbally brief their teams on the policy changes during staff meetings.

Answer

Publish the updated policies on the corporate intranet and send an email announcement to all staff.

Question 15

A global financial services firm is revising its information security governance framework. The board of directors has expressed concern that the current security strategy is not adequately aligned with the firm's business objectives and regulatory obligations. The CISO is tasked with improving this alignment. Which of the following actions would BEST address the board's concern?

Accepted Answer

Integrate security risk considerations into the enterprise risk management (ERM) process and report on them alongside other business risks.. Integrating security risk into the enterprise risk management process ensures that security is managed as a business risk, aligning it with business objectives and regulatory requirements. This approach provides the board with a comprehensive view of risk and demonstrates that security is not a standalone function but an integral part of the organization's risk posture.

Answer

Increase the security budget to hire more security staff and purchase advanced security tools.

Answer

Implement a balanced scorecard for security that tracks technical metrics such as patch compliance and antivirus coverage.

Answer

Conduct an annual penetration test and present the results to the board to demonstrate security effectiveness.