CISM Information Security Governance Practice Test 8 — 15 Questions

Question 1

A multinational corporation operates in multiple jurisdictions with varying data protection laws. The CISO is establishing a governance structure to manage compliance with these laws while maintaining a consistent security posture. Which of the following is the MOST effective approach for the CISO to take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Develop a common governance framework with baseline controls, supplemented by local addenda to address specific regulatory requirements.. The most effective approach is a common governance framework with baseline controls and local addenda. This ensures a consistent global security posture while allowing for compliance with varying local laws. It provides centralized oversight and scalability, avoiding the pitfalls of a one-size-fits-all policy or full decentralization. This hybrid model is a recognized best practice for multinational governance.

Answer

Delegate compliance responsibility entirely to local business units to tailor security controls to each jurisdiction.

Answer

Adopt the regulatory requirements of the headquarters country as the global standard for all locations.

Answer

Implement a single global security policy that meets the strictest regulatory requirements across all jurisdictions.

Question 2

A newly appointed CISO at a healthcare payer discovers that business units independently purchase security tools, resulting in overlapping capabilities and no central oversight. The CISO wants to establish a governance structure that ensures security investments align with enterprise risk appetite. Which action should the CISO take FIRST?

Accepted Answer

Create an information security steering committee with business unit representation to prioritize and approve security initiatives.. Establishing an information security steering committee is the foundational governance action because it creates a formal, cross-functional body responsible for aligning security investments with enterprise risk appetite. This committee provides the authority and structure to prioritize initiatives, resolve conflicts, and ensure ongoing oversight. Other actions, such as centralizing budgets or conducting assessments, are either tactical or lack the collaborative governance needed to sustain alignment.

Answer

Develop a security metrics dashboard that reports tool utilization and spending to the board of directors.

Answer

Conduct a gap assessment of all existing security tools against the NIST Cybersecurity Framework to identify redundancies.

Answer

Implement a centralized security budget and require all business units to submit purchase requests to the CISO for approval.

Question 3

A global retail company is establishing an information security governance framework. The CISO wants to ensure that the framework effectively supports business objectives while managing risk. Which TWO of the following are essential components of an effective security governance framework? (Choose two.)

Accepted Answer

A clear definition of security roles and responsibilities across the organization.. An effective security governance framework must include clear roles and responsibilities to ensure accountability, and a process for regularly updating policies to adapt to changes. These components provide the structure and adaptability needed to align security with business objectives and manage risk. Advanced technologies, centralized decision-making, and operational centers are not core governance elements; they are tactical or operational considerations that support the framework.

Answer

The use of advanced security technologies such as AI-based threat detection.

Answer

A requirement that all security decisions be made by the CISO without business input.

Answer

The implementation of a security operations center (SOC) to monitor for threats 24/7.

Question 4

A CISO is updating the enterprise information security strategy. The organization's business strategy now emphasizes rapid expansion into cloud-based services and third-party partnerships. Which of the following should be the CISO's FIRST action to ensure the security strategy remains aligned with the business strategy?

Accepted Answer

Map the current security program objectives to the new business drivers and identify gaps.. The correct answer is to map current security program objectives to the new business drivers and identify gaps. This step ensures the security strategy is directly aligned with the organization's cloud expansion and partnership goals. It provides a factual basis for adjusting policies, budgets, and controls, and it demonstrates to stakeholders that security is a business enabler. Without this mapping, subsequent actions risk being disconnected from strategic intent.

Answer

Immediately update the security policy to include cloud and third-party requirements.

Answer

Present the current security budget to the board for approval.

Answer

Conduct a penetration test of the existing cloud environments.

Question 5

A CISO is reviewing the organization's risk management process. The board has asked how the CISO ensures that security risks are managed within the organization's risk appetite. Which activity BEST demonstrates this?

Accepted Answer

Defining risk appetite and tolerance levels, and monitoring key risk indicators against them.. The correct answer is defining risk appetite and tolerance levels and monitoring key risk indicators against them. In CISM, risk appetite is set by the board and communicated to management. The CISO ensures that security risks are managed within that appetite by establishing tolerance thresholds and monitoring KRIs. This provides continuous assurance that risks are within acceptable limits and that treatment decisions are aligned with business objectives.

Answer

Purchasing cyber insurance to transfer residual risks that exceed the organization's tolerance.

Answer

Implementing a risk register that lists all identified risks and their owners.

Answer

Conducting an annual risk assessment and presenting the results to the board.

Question 6

An organization is updating its information security policy framework. The CISO wants to ensure that the policies are effectively communicated and understood by all employees. Which of the following is the MOST effective method to achieve this?

Accepted Answer

Conduct regular, role-based training sessions that include practical examples and quizzes to reinforce policy concepts.. Role-based training with practical examples and quizzes is the most effective method because it actively engages employees, tailors content to their responsibilities, and measures comprehension. It ensures that policies are not just distributed but understood and applied, which is essential for effective security governance.

Answer

Publish the policies on the corporate intranet and send an email announcement to all staff.

Answer

Include a summary of the policies in the employee handbook provided at hire.

Answer

Require all employees to sign an acknowledgment form after reading the policies.

Question 7

A CISO is presenting the information security program's value to the board. The board is particularly concerned about the organization's ability to detect and respond to advanced threats. Which of the following metrics would BEST demonstrate the program's effectiveness in this area?

Accepted Answer

The mean time to detect (MTTD) and mean time to respond (MTTR) to advanced threats.. Mean time to detect (MTTD) and mean time to respond (MTTR) are outcome-based metrics that directly reflect the program's ability to detect and respond to threats. They are meaningful to the board because they quantify operational effectiveness and can be benchmarked. Other metrics like incident counts or control counts do not provide the same level of assurance regarding detection and response capabilities.

Answer

The percentage of critical assets covered by continuous monitoring.

Answer

The number of security incidents detected per quarter.

Answer

The total number of security controls implemented across the enterprise.

Question 8

A global retailer is expanding into new markets and must comply with varying data protection laws. The CISO is revising the information security strategy to ensure it remains aligned with the changing business environment. Which approach BEST ensures ongoing alignment between the security strategy and business objectives?

Accepted Answer

Integrate security strategy reviews into the enterprise strategic planning cycle and adjust based on business changes.. Integrating security strategy reviews into the enterprise strategic planning cycle ensures that security is continuously aligned with business objectives, especially as the retailer enters new markets with different regulations. This approach makes alignment a proactive, recurring process rather than a one-off or reactive activity. It enables the CISO to adjust security initiatives in response to business changes, which is critical for effective governance and risk management.

Answer

Delegate strategy updates to the security operations team based on emerging threats.

Answer

Conduct an annual penetration test and use the results to update the security strategy.

Answer

Adopt a widely recognized security framework and mandate compliance with its controls.

Question 9

A healthcare organization is developing its information security strategy. The CISO is considering how to best align the strategy with the organization's overall business strategy. Which of the following approaches would be MOST effective?

Accepted Answer

Integrate security objectives into the business strategy planning process and participate in business strategy discussions.. The most effective approach to align security strategy with business strategy is to integrate security objectives into the business strategy planning process and participate in business strategy discussions. This ensures that security is a core consideration in business decisions, enabling the organization to achieve its goals while managing risk. Other approaches, such as independent development or exclusive focus on compliance, can lead to misalignment and missed opportunities.

Answer

Focus the security strategy primarily on compliance with healthcare regulations such as HIPAA.

Answer

Ensure the security strategy is developed independently by the security team to avoid business influence.

Answer

Adopt a widely recognized security framework and tailor it to the organization's needs.

Question 10

A security manager is reviewing the organization's information security governance framework. The board has expressed concern that security decisions are not consistently aligned with the organization's risk appetite. Which of the following would BEST address this concern?

Accepted Answer

Define and document risk appetite and tolerance levels, and integrate them into the security decision-making processes.. The most effective way to address the board's concern is to formally define risk appetite and tolerance levels and integrate them into security decision-making. This ensures that every security initiative is assessed against the organization's willingness to accept risk, providing consistency and a clear basis for decisions. Other measures, such as committees or dashboards, support this but do not replace the need for explicit risk appetite integration.

Answer

Conduct an annual security awareness training for all employees to reinforce risk management principles.

Answer

Establish a security steering committee that includes business unit leaders to review and approve security initiatives.

Answer

Implement a security metrics dashboard that reports the number of security incidents to the board quarterly.

Question 11

A CISO is establishing an information security governance framework for a financial services firm. The board has asked for assurance that security risks are managed effectively and that the program aligns with regulatory requirements. Which TWO elements are MOST critical for the CISO to define as part of this governance framework? (Choose two.)

Accepted Answer

A process for reporting security metrics and risk posture to the board on a regular basis.. Defining security roles and responsibilities and establishing a regular reporting process are the most critical elements of a governance framework because they establish accountability and provide the board with the necessary information for oversight. Roles ensure that decision-making authority is clear, while reporting enables the board to monitor risk and compliance. Together, they form the foundation for effective governance and assurance.

Answer

A list of all security tools deployed across the enterprise with their versions and patch levels.

Answer

The annual security budget with line-item allocations for each department.

Answer

Detailed technical procedures for incident response and disaster recovery.

Question 12

A CISO is designing a security governance framework for a multinational corporation. The framework must address the need for clear accountability, alignment with business strategy, and effective risk management across diverse business units. Which TWO of the following are essential components of such a governance framework? (Choose two.)

Accepted Answer

A process for regularly reviewing and updating security policies to reflect changes in the threat landscape and business environment.. A defined security organizational structure and a process for regularly reviewing policies are essential governance components. The structure ensures accountability and clear roles, while the policy review process ensures ongoing alignment with business strategy and emerging risks. These elements provide the foundation for effective decision-making and oversight.

Answer

A comprehensive set of technical security controls, such as firewalls and intrusion detection systems.

Answer

A centralized security operations center (SOC) that monitors all security events 24/7.

Answer

An annual penetration test to validate the effectiveness of security controls.

Question 13

An organization's information security strategy is being developed. The CISO wants to ensure that the strategy supports business objectives while managing risk. Which of the following should be the PRIMARY input to the strategy development process?

Accepted Answer

The organization's business strategy and objectives.. The primary input to security strategy development must be the organization's business strategy and objectives. This ensures that security efforts are directly tied to what the business is trying to achieve, enabling risk management that supports rather than hinders business goals. Other inputs, such as frameworks or technical reports, are secondary and should be used to inform implementation once the business direction is clear.

Answer

Industry best practice frameworks such as ISO/IEC 27001.

Answer

The IT department's technology roadmap.

Answer

The latest vulnerability scan reports.

Question 14

A CISO is updating the organization's information security policy to reflect a new regulatory requirement. The policy must be approved before it can be communicated to employees. Who is MOST appropriate to approve the updated policy?

Accepted Answer

The executive management committee or a designated senior executive, such as the CIO or COO.. Executive management or a designated senior executive is the most appropriate approver for an updated security policy because they have the authority to enforce it across the organization and ensure it aligns with business strategy. While the board is accountable and legal should review, operational policy approval is typically delegated to executives to enable timely updates and practical implementation.

Answer

The board of directors, because they have ultimate accountability for regulatory compliance.

Answer

The chief information security officer (CISO), as the owner of the security program.

Answer

The legal department, because the policy is driven by a regulatory requirement.

Question 15

An organization has recently experienced a data breach that resulted in the loss of customer personally identifiable information (PII). The board of directors is concerned about the effectiveness of the information security governance program. Which of the following should the CISO recommend as the MOST important action to improve governance?

Accepted Answer

Conduct a post-incident review to identify root causes and update security policies and controls accordingly.. Conducting a post-incident review is the most important action because it systematically identifies what went wrong and how to improve policies, controls, and governance. It provides the board with assurance that the organization is learning from the incident and taking concrete steps to prevent recurrence, which is a key aspect of effective governance.

Answer

Implement a new security awareness training program for all employees.

Answer

Terminate the employees responsible for the breach to demonstrate accountability.

Answer

Increase the security budget to purchase additional security technologies.