CISM Information Security Program — 100 Questions

Question 1

Match the following security program components with their primary purpose by dragging each component to the correct description.

Answer

Security Policy

Answer

Incident Response Plan

Answer

Risk Assessment

Answer

Describes the organization's high-level security objectives and management commitment

Answer

Provides step-by-step actions to detect, respond, and recover from security incidents

Answer

Identifies threats, vulnerabilities, and impacts to determine risk levels

Question 2

An organization has implemented a balanced scorecard to measure the effectiveness of its information security program. Which of the following metrics would be MOST appropriate for the 'internal processes' perspective?

Accepted Answer

Mean time to detect and respond to incidents. The 'internal processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of the operational workflows that deliver the security program. Mean time to detect (MTTD) and mean time to respond (MTTR) directly measure the performance of the incident response process, which is a core internal process. This metric reflects how quickly the organization can identify and contain threats, making it the most appropriate choice for this perspective.

Answer

Percentage of systems compliant with baseline

Answer

Percentage of users who completed security awareness training

Answer

Number of security incidents reported to management

Question 3

An information security manager is developing a security program for a multinational organization. Which of the following should be considered when defining the program scope? (Select THREE)

Accepted Answer

Business objectives and strategy. Business objectives and strategy (A) are foundational because the security program must align with and support the organization's mission, risk appetite, and strategic goals. Without this alignment, security controls may conflict with business operations or fail to prioritize critical assets, leading to wasted resources or increased risk exposure.

Answer

Current technology architecture

Question 4

Match each information security program component with its correct description.

Answer

Recommended practice or advisory action

Answer

High-level statement of management intent

Answer

Detailed step-by-step instructions

Answer

Mandatory requirement to support policy

Question 5

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Accepted Answer

Business impact analysis (BIA) results.. A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Answer

Security awareness training for all employees.

Answer

Vulnerability scanning schedules.

Question 6

An information security manager is developing a program metric to report to senior management. Which metric best demonstrates the effectiveness of the information security program?

Accepted Answer

Mean time to detect (MTTD) security incidents. Mean time to detect (MTTD) is a key performance indicator that directly measures how quickly the security program identifies incidents, reflecting the effectiveness of detection controls, monitoring tools, and incident response readiness. Unlike compliance-focused metrics, MTTD provides actionable insight into the program's ability to minimize dwell time and reduce potential impact, making it the most relevant metric for senior management to assess program effectiveness.

Answer

Number of security incidents reported

Answer

Percentage of systems with up-to-date patches

Answer

Number of security awareness training sessions held

Question 7

Match each information security program component to its primary focus area.

Component: 1. Risk Assessment, 2. Security Awareness Training, 3. Incident Response Plan, 4. Policy Framework

Focus Areas:
A. Human factors and behavior
B. Structured response to events
C. Identification and analysis of threats
D. Governance and compliance requirements

Drag each component to its matching focus area.

Answer

B. Structured response to events

Answer

D. Governance and compliance requirements

Answer

C. Identification and analysis of threats

Answer

A. Human factors and behavior

Question 8

Arrange the steps in order for conducting a business impact analysis (BIA) in business continuity management.

Accepted Answer

Identify critical business functions, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions, then document findings. A BIA first identifies critical functions, then determines acceptable downtime, assesses impact, prioritizes recovery, and finally documents findings.

Answer

Identify critical business functions, then assess impact of disruptions, then determine acceptable downtime, then prioritize recovery of critical functions, then document findings

Answer

Identify critical business functions, then document findings, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions

Answer

Document findings, then prioritize recovery of critical functions, then assess impact of disruptions, then determine acceptable downtime, then identify critical business functions

Question 9

Match each CISM domain to its focus area.

Accepted Answer

Information Security Governance: Establishing and maintaining a framework to ensure information security strategies are aligned with business objectives.. The CISM domains are: Governance (strategy alignment), Risk Management (risk identification and management), Program Development (design and implementation), and Incident Management (detection and response). Common confusions include swapping program development with governance and incident management with risk management.

Answer

Information Security Governance: Designing and implementing security solutions.

Answer

Information Risk Management: Responding to security incidents.

Question 10

Match each security framework to its primary purpose.

Accepted Answer

COBIT: A framework for IT governance and management.. COBIT is for IT governance, ISO 27001 for ISMS, and NIST CSF for cybersecurity risk management. The distractors swap definitions between COBIT and ISO 27001.

Answer

COBIT: A standard for information security management systems.

Answer

ISO 27001: A framework for IT governance and management.

Question 11

Match each security role to its primary responsibility.

Accepted Answer

CISO: Responsible for overall security strategy and program management.. Correct matches: CISO → overall strategy, Security Manager → daily operations, Security Architect → design, Security Auditor → evaluation. Common confusions involve swapping these responsibilities.

Answer

CISO: Evaluates security controls and ensures compliance.

Answer

Security Manager: Designs security architecture.

Question 12

A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?

Accepted Answer

NIST Cybersecurity Framework. The NIST Cybersecurity Framework (CSF) is the most appropriate choice because it is designed to be flexible and scalable, allowing small businesses with limited budget and staff to implement a risk-based information security program using a prioritized, outcome-driven approach. Unlike ISO/IEC 27001, which requires formal certification and extensive documentation, or COBIT 2019, which is geared toward enterprise IT governance, the NIST CSF provides a customizable set of core functions (Identify, Protect, Detect, Respond, Recover) that can be adopted incrementally without heavy resource investment.

Answer

ISO/IEC 27001

Answer

COBIT 2019

Answer

PCI DSS

Question 13

A company's security program includes a policy that prohibits the use of personal devices for work. However, the CISO discovers that several executives are using personal tablets to access corporate email. What is the most appropriate action for the CISO to take?

Accepted Answer

Update the policy to allow personal devices under strict controls. The CISO must align security controls with business reality. Rather than enforcing an unworkable policy that executives are already circumventing, the CISO should update the policy to incorporate a mobile device management (MDM) solution that enforces device encryption, remote wipe, and conditional access via Microsoft Entra ID or similar identity provider. This approach reduces risk by bringing personal devices under formal governance while maintaining executive productivity.

Answer

Block all personal devices from the network

Answer

Continue monitoring but take no action

Answer

Discipline the executives for policy violation

Question 14

Which of the following best describes the primary purpose of an information security program?

Accepted Answer

To manage security risks in alignment with business strategy. The primary purpose of an information security program is to manage security risks in alignment with business strategy, ensuring that security controls and investments support organizational objectives while balancing risk acceptance, mitigation, transfer, and avoidance. This aligns with the CISM framework, which emphasizes that security is a business enabler, not a technical silo. A program that fails to align with business strategy may over-prioritize technical controls, leading to wasted resources or misaligned risk tolerance levels.

Answer

To ensure 100% system availability

Answer

To eliminate all security risks

Answer

To achieve compliance with all applicable regulations

Question 15

Which TWO of the following are key performance indicators (KPIs) that demonstrate the effectiveness of a security awareness program?

Accepted Answer

Percentage of employees who correctly identify a phishing email in simulations. Option A is correct because the percentage of employees who correctly identify a phishing email in simulations is a direct, measurable outcome that shows whether the awareness program has improved employees' ability to recognize real phishing threats. Option E is correct because a reduction in security incidents caused by human error demonstrates the ultimate business impact of the awareness program, showing that learned behaviors are translating into fewer real-world breaches. The unmarked options do not belong because they measure activity or effort rather than effectiveness: B (number of employees who report suspicious emails) can be a useful metric but is not by itself a definitive KPI of program effectiveness, C (frequency of phishing simulation tests) measures how often testing occurs, not how well employees perform, and D (number of training sessions completed per quarter) measures training volume or compliance rather than actual security behavior or risk reduction.

Answer

Number of employees who report suspicious emails

Answer

Frequency of phishing simulation tests

Answer

Number of training sessions completed per quarter

Question 16

Which THREE of the following are typically included in an information security program budget?

Accepted Answer

Incident response retainer. Options A, B, and C are correct as they are common line items in an information security program budget. Incident response retainers cover external support for security incidents, security awareness training materials are essential for educating employees, and vulnerability assessment tools are used to identify weaknesses. Option D (marketing) is not a security cost, and Option E (employee salaries) is typically part of operational budgets, not the specific security program budget.

Answer

Marketing and advertising campaigns

Answer

Employee salaries

Question 17

Which of the following is the primary purpose of an information security program?

Accepted Answer

Protect the confidentiality, integrity, and availability of information assets.. The primary purpose of an information security program is to safeguard the confidentiality, integrity, and availability (CIA) of information assets. This aligns with the core definition of information security as defined in standards like ISO/IEC 27001 and NIST SP 800-53, which frame security controls around protecting these three attributes. A program must be risk-based and business-aligned, not just a collection of tools or compliance checklists.

Answer

Implement firewalls and antivirus software.

Answer

Achieve compliance with regulations only.

Answer

Eliminate all security risks.

Question 18

Which THREE of the following are critical success factors for implementing an information security program?

Accepted Answer

Risk-based approach to prioritize controls.. A risk-based approach (B) is critical because it ensures that security controls are prioritized based on the actual threats and vulnerabilities facing the organization, rather than applying controls uniformly. This aligns resources with the highest risks, optimizing the cost-benefit ratio of the security program and directly supporting business resilience.

Answer

Compliance as the primary driver.

Answer

Deployment of the latest security technology.

Question 19

Based on the exhibit, what is the most likely vulnerability that an attacker could exploit?

Accepted Answer

An attacker could use SQL injection on the web server to extract data directly from the database via the permitted MySQL traffic.. The exhibit shows that MySQL traffic is permitted from the web server to the database server. An attacker who compromises the web server (e.g., via SQL injection) can use that allowed MySQL connection to extract sensitive data directly from the database, bypassing other network controls. This is a classic example of a trust-based vulnerability where internal database access is not sufficiently restricted.

Answer

An attacker could perform a DDoS attack on the external interface to disrupt email services.

Answer

An attacker could exploit the SMTP service to send spam.

Answer

An attacker could sniff traffic on the DMZ segment to capture LDAP credentials.

Question 20

A company is implementing an information security program. Which of the following is the PRIMARY reason to align the program with business objectives?

Accepted Answer

To gain management buy-in and support. Aligning the information security program with business objectives is primarily aimed at gaining management buy-in and support. When security initiatives are directly tied to business goals, management is more likely to understand their value and provide the necessary resources and authority. Regulatory compliance (A) is a requirement but not the primary reason; technical controls (B) are a means to an end; cost reduction (C) may be a secondary benefit but not the main driver.

Answer

To ensure regulatory compliance

Answer

To improve technical controls

Answer

To reduce overall security costs