CISM Information Security Program — 20 Questions

Question 1

An organization's information security program has been in place for two years. During a recent audit, several findings indicated that security controls are not consistently applied across business units. The CISO has been asked to improve the program. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a risk assessment to identify gaps and prioritize remediation.. Conducting a risk assessment first (Option C) is the correct initial step because it systematically identifies where controls are failing or missing across business units, quantifies the associated risks, and prioritizes remediation based on business impact. Without this foundational analysis, any subsequent actions—such as automation, policy updates, or new controls—would lack direction and could waste resources on low-priority areas. This aligns with the CISM program lifecycle, where risk assessment drives all other program improvements.

Answer

Automate security compliance monitoring across all business units.

Answer

Update the information security policy to mandate compliance.

Answer

Implement additional security controls across all business units.

Question 2

A multinational corporation is designing its information security program and must decide how to balance security with business agility. The company operates in highly regulated industries with varying legal requirements. Which of the following approaches BEST aligns with industry best practices for such an environment?

Accepted Answer

Develop a risk-based framework that allows for tailored controls based on local risk assessments.. Option C is correct because a risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.

Answer

Implement the strictest regulatory requirements globally to ensure compliance everywhere.

Answer

Adopt a baseline of controls that meet the lowest common denominator of all regulations.

Answer

Allow each business unit to define its own security controls based on local requirements.

Question 3

An organization is developing a new information security program and wants to ensure it aligns with business objectives. Which of the following is the MOST critical first step?

Accepted Answer

Identify business strategy and risk appetite.. Identifying business strategy and risk appetite is the most critical first step because the information security program must be designed to support the organization's objectives and operate within the risk tolerance defined by leadership. Without this alignment, subsequent security controls and investments may conflict with business goals or fail to address the risks the organization is willing to accept. This ensures that security is a business enabler rather than a technical silo.

Answer

Develop a security awareness training program.

Answer

Design the security architecture based on industry frameworks.

Answer

Conduct a comprehensive risk assessment.

Question 4

During a merger, two companies with different information security programs are being integrated. The combined entity must maintain compliance with PCI DSS and GDPR. The CISO is concerned about gaps in coverage due to differing maturity levels. Which of the following is the BEST approach to harmonize the programs?

Accepted Answer

Perform a gap analysis against the requirements and prioritize remediation.. Option D is correct because a gap analysis identifies where controls are missing or insufficient, allowing for a prioritized remediation plan. Option A is wrong because adopting the higher standard may be unnecessary and costly. Option B is wrong because merging without analysis could introduce risks. Option C is wrong because a new framework from scratch may not leverage existing investments.

Answer

Adopt the more stringent security program from the acquirer across the entire entity.

Answer

Merge the two programs by combining all controls from each.

Answer

Implement a completely new framework that meets both regulations.

Question 5

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Accepted Answer

A steering committee that includes senior management and business unit leaders.. A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Answer

An incident response plan that defines roles and procedures.

Answer

A vulnerability scanning schedule and remediation SLAs.

Answer

A firewall policy that specifies allowed and denied traffic.

Question 6

Refer to the exhibit. An analyst observes the network traffic between three internal hosts and a web server. Which of the following is the MOST likely interpretation of this traffic?

Accepted Answer

Multiple users are accessing the web server normally.. The exhibit shows multiple internal hosts (10.0.0.1, 10.0.0.2, 10.0.0.3) each establishing a normal TCP three-way handshake with the web server (192.168.1.100) on port 80, with varying source ports and no abnormal flags or packet rates. This pattern indicates legitimate concurrent user access, as each host completes the handshake and exchanges data without flooding or scanning behavior.

Answer

A SYN flood attack is in progress.

Answer

A single host is using multiple IP addresses to scan the server.

Answer

A distributed denial-of-service (DDoS) attack is occurring.

Question 7

You are the CISO of a mid-sized financial services firm that processes credit card transactions. The company has recently expanded its operations to include a mobile payment application that stores payment credentials in the cloud. The current information security program was designed primarily for the on-premises environment and has not been updated to address cloud-specific risks. The internal audit team has identified that the cloud service provider (CSP) does not have an independent third-party audit report (e.g., SOC 2) available for review. Additionally, the mobile app development team has been deploying code without formal security review, citing the need for rapid releases to compete in the market. The CEO has expressed concern about the potential for a data breach and has asked you to recommend immediate actions to strengthen the security program while minimizing business disruption. Which of the following should you recommend as the FIRST course of action?

Accepted Answer

Conduct a detailed security assessment of the cloud service provider's controls and contractually require an annual SOC 2 Type II report.. Option C is the correct first course of action because the absence of an independent third-party audit report (e.g., SOC 2 Type II) means the organization has no verified assurance that the cloud service provider (CSP) has adequate security controls in place. As CISO, you must immediately assess the CSP's security posture and contractually mandate a SOC 2 Type II report to gain visibility into the effectiveness of the CSP's controls over time, which is foundational before implementing any compensating technical controls. This aligns with the CISM domain of Information Security Program governance, where vendor risk management and due diligence are critical first steps when expanding into cloud environments.

Answer

Encrypt all data in transit and at rest using the organization's own encryption keys.

Answer

Implement compensating controls such as tokenization for all cardholder data stored in the cloud.

Answer

Require the mobile app development team to undergo formal security training and implement a peer review process for all code deployments.

Question 8

An information security program is being developed for a multinational organization. Which of the following is the PRIMARY driver for aligning the security program with business objectives?

Accepted Answer

Achieving the organization's strategic goals. The primary driver for aligning the security program with business objectives is to ensure that security initiatives directly support and enable the organization's strategic goals. Without this alignment, security becomes a cost center rather than a business enabler, and resources may be misallocated to activities that do not advance the enterprise's mission. CISM emphasizes that security governance must be integrated with business strategy to justify investment and demonstrate value to stakeholders.

Answer

Compliance with industry regulations

Answer

Reducing information security costs

Answer

Implementing the latest security technologies

Question 9

After a major security incident, the board of directors requests a review of the information security program. Which of the following metrics would be MOST useful to demonstrate the effectiveness of the program over the past year?

Accepted Answer

Number of security incidents detected and contained within defined SLAs. The number of incidents detected and contained within defined SLAs directly measures the program's ability to detect and respond to threats, which is a key indicator of operational effectiveness. Other metrics may be useful but do not directly measure the program's performance in protecting the organization.

Answer

Percentage of employees who completed security awareness training

Answer

Total cost of security investments compared to industry benchmarks

Answer

Number of vulnerabilities identified in the latest penetration test

Question 10

An information security manager is designing a program for a healthcare organization. Which of the following should be the FIRST step in establishing the program?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment is the foundational first step because it identifies and prioritizes the specific threats and vulnerabilities facing the healthcare organization's sensitive data (e.g., PHI under HIPAA). Without this baseline understanding, any subsequent policies, controls, or metrics would be misaligned with actual risk exposure, leading to ineffective or wasteful security investments.

Answer

Develop information security policies and procedures

Answer

Select and implement security controls

Answer

Define security metrics and reporting

Question 11

An organization's information security program includes a formal exception process. When reviewing an exception request to bypass a critical control, what is the MOST important factor for the information security manager to consider?

Accepted Answer

The residual risk after compensating controls. The most important factor when reviewing an exception request to bypass a critical control is the residual risk after compensating controls. This ensures that the organization's risk appetite is not exceeded and that the compensating controls adequately mitigate the risk to an acceptable level, as required by frameworks like ISO 27001 and NIST SP 800-53.

Answer

The cost of implementing the control

Answer

The number of users affected by the exception

Answer

The duration of the exception

Question 12

Which of the following are key components of an effective information security program? (Select TWO.)

Accepted Answer

A risk management framework. A risk management framework is a key component because it provides a structured, repeatable process for identifying, assessing, and mitigating information security risks. It ensures that security investments and controls are aligned with business objectives and risk appetite, rather than being ad hoc or technology-driven. Without a risk management framework, an information security program lacks the foundational governance to prioritize threats and allocate resources effectively.

Answer

State-of-the-art security tools and technologies

Answer

A large security operations center

Answer

Compliance with all applicable laws

Question 13

An information security manager is evaluating the maturity of the organization's security program. Which of the following indicators suggest a high level of maturity? (Select TWO.)

Accepted Answer

Security metrics are included in regular executive reports. Option B is correct because including security metrics in regular executive reports demonstrates that security performance is being measured, tracked, and communicated to leadership as part of ongoing governance. This aligns with a mature security program where security is integrated into business decision-making, not treated as a siloed technical function.

Answer

All security incidents are resolved within 24 hours

Answer

The program uses the latest encryption standards

Answer

The security team conducts annual penetration tests

Question 14

Match the following security program components with their primary purpose by dragging each component to the correct description.

Answer

Security Policy

Answer

Incident Response Plan

Answer

Risk Assessment

Answer

Describes the organization's high-level security objectives and management commitment

Answer

Provides step-by-step actions to detect, respond, and recover from security incidents

Answer

Identifies threats, vulnerabilities, and impacts to determine risk levels

Question 15

Which of the following is the PRIMARY responsibility of a steering committee in an information security program?

Accepted Answer

Providing strategic direction and oversight. The steering committee's primary role is to provide strategic direction and oversight for the information security program, ensuring alignment with business objectives and risk appetite. This includes approving the overall security strategy, budget, and major initiatives, rather than engaging in operational tasks like policy drafting or technical assessments.

Answer

Approving individual security policies

Answer

Conducting vulnerability assessments

Answer

Implementing security controls

Question 16

An organization's information security program is based on a risk management framework. Which of the following BEST describes the role of the information security manager in this context?

Accepted Answer

Designing and managing the security program. The information security manager is responsible for designing and managing the security program based on the risk management framework. This includes translating risk assessment results into security controls, policies, and procedures, and ensuring the program aligns with the organization's risk posture. The manager does not set risk appetite (that is a board-level decision) nor own all risks (risk owners are business process owners).

Answer

Setting the organization's risk appetite

Answer

Owning all information security risks

Answer

Conducting internal audits of controls

Question 17

An organization has implemented a balanced scorecard to measure the effectiveness of its information security program. Which of the following metrics would be MOST appropriate for the 'internal processes' perspective?

Accepted Answer

Mean time to detect and respond to incidents. The 'internal processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of the operational workflows that deliver the security program. Mean time to detect (MTTD) and mean time to respond (MTTR) directly measure the performance of the incident response process, which is a core internal process. This metric reflects how quickly the organization can identify and contain threats, making it the most appropriate choice for this perspective.

Answer

Percentage of systems compliant with baseline

Answer

Percentage of users who completed security awareness training

Answer

Number of security incidents reported to management

Question 18

Which of the following are key components of an information security program? (Select TWO)

Accepted Answer

A set of security policies and standards. A set of security policies and standards is a key component because it establishes the governance framework that defines acceptable use, access control, and compliance requirements for the entire organization. Without documented policies and standards, the security program lacks the authoritative baseline to enforce controls or measure effectiveness. These documents are the foundation for all other security activities, including training, audits, and incident response.

Answer

A network architecture diagram

Answer

An incident response log

Question 19

An information security manager is developing a security program for a multinational organization. Which of the following should be considered when defining the program scope? (Select THREE)

Accepted Answer

Business objectives and strategy. Business objectives and strategy (A) are foundational because the security program must align with and support the organization's mission, risk appetite, and strategic goals. Without this alignment, security controls may conflict with business operations or fail to prioritize critical assets, leading to wasted resources or increased risk exposure.

Answer

Current technology architecture

Question 20

Match each information security program component with its correct description.

Answer

Recommended practice or advisory action

Answer

High-level statement of management intent

Answer

Detailed step-by-step instructions

Answer

Mandatory requirement to support policy