CISM Information Security Program Practice Test 10 — 15 Questions

Question 1

A small e-commerce company with 50 employees and limited IT budget is establishing its first formal information security program. The company processes customer payment data and must comply with PCI DSS. The CEO wants to balance security with operational costs. The IT manager proposes investing in a state-of-the-art security information and event management (SIEM) system costing $100,000 annually. The CISO, however, recommends a more phased approach. Considering the company's size, budget constraints, and compliance requirements, what should be the CISO's primary recommendation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a firewall, antivirus software, and enforce strong access controls as baseline security measures.. For a 50-person e-commerce company with limited budget and PCI DSS obligations, the CISO should recommend foundational controls first: firewall, antivirus/endpoint protection, and strong access controls. These address the PCI DSS baseline requirements (Req 1, 5, 7, 8) at a fraction of the SIEM cost and deliver immediate risk reduction. A phased approach aligns security investment with maturity and budget, which is the core of the CISO's recommendation.

Answer

Implement the SIEM system immediately to achieve real-time threat detection.

Answer

Outsource all security operations to a managed security service provider (MSSP).

Answer

Develop a custom security software solution tailored to the company's payment processing system.

Question 2

A global financial services firm operates in 30 countries and is subject to multiple data protection regulations, including GDPR, CCPA, and various financial services directives. The firm has a centralized information security program but struggles with inconsistent enforcement across regions. The CISO is under pressure to demonstrate compliance to the board while reducing costs. The compliance team suggests creating a separate security program for each regulation, while the IT audit team recommends adopting the most stringent regulation as the baseline. The CISO must decide on a strategy that balances compliance, efficiency, and cost. What is the best approach for the CISO to take?

Accepted Answer

Develop a unified set of controls that satisfy the common requirements of all regulations and map them to each regulation's specific needs.. A unified set of controls that satisfies the common requirements of all regulations and maps to each regulation's specific needs provides a single, efficient control framework while ensuring compliance with each regulation. This balances compliance, efficiency, and cost by avoiding duplication and gaps.

Answer

Adopt ISO 27001 as the single framework and map it loosely to all regulations.

Answer

Create three separate security programs, one for each major regulation (GDPR, CCPA, financial directives).

Answer

Use the most stringent regulation (e.g., GDPR) as the baseline and accept potential gaps with other regulations.

Question 3

An organization is updating its information security program to align with business objectives. Which of the following is the PRIMARY benefit of integrating security risk management into the strategic planning process?

Accepted Answer

Aligns security investments with business priorities. Integrating security risk management into strategic planning ensures that security investments are directly tied to the organization's business priorities and risk appetite. This alignment allows for optimal allocation of resources to protect the most critical assets and processes, rather than spending on generic or low-priority controls. The primary benefit is that security becomes a business enabler, not a cost center, by focusing on what matters most to the organization's objectives.

Answer

Reduces the number of security incidents

Answer

Increases employee awareness of security policies

Answer

Ensures compliance with regulatory requirements

Question 4

A multinational corporation with a decentralized information security program has recently experienced a data breach involving customer PII. The breach originated from a regional office that had not implemented the global security baseline due to local IT staff claiming 'unique operational requirements.' The CISO has tasked the security manager with revising the program to prevent recurrence. The organization has 12 regional offices, each with its own IT leadership, and a central security team. The budget is tight, and there is resistance to centralized control. Which of the following is the BEST course of action for the security manager?

Accepted Answer

Establish a mandatory global security baseline with a formal exception process requiring CISO approval for any deviation. Establishing a mandatory global security baseline with a formal exception process ensures consistency while allowing for justified deviations that are formally approved by the CISO, addressing the root cause of non-compliance. Option A is wrong because increasing audits may detect issues but does not enforce compliance without binding standards. Option B is wrong because training alone does not ensure implementation when local IT can claim unique requirements. Option C is wrong because allowing each office to maintain its own program perpetuates fragmentation and does not enforce a consistent baseline.

Answer

Increase the frequency of security audits for all regional offices

Answer

Provide additional training to regional IT staff on the importance of security baselines

Answer

Allow each regional office to maintain its own security program as long as it meets minimum standards

Question 5

A global financial services firm has a mature information security program with policies, standards, and procedures aligned to ISO/IEC 27001. The CISO is preparing for the annual management review of the program. The board has asked for assurance that the program remains effective as the threat landscape and business strategy evolve. Which activity BEST provides this assurance?

Accepted Answer

Reviewing the results of independent audits, control testing, and metrics against program objectives to evaluate effectiveness.. The board requires assurance that the program remains effective amid evolving threats and business strategy. Independent audits, control testing, and metrics provide objective, ongoing evidence of effectiveness across governance, risk, and controls. This integrated view supports informed management review and strategic decision-making, which is the core purpose of monitoring and reporting program performance.

Answer

Increasing the security awareness training frequency and tracking completion rates across all business units.

Answer

Conducting a penetration test of all externally facing applications and reporting the number of critical findings.

Answer

Updating the information security policy to reflect the latest regulatory changes and obtaining executive sign-off.

Question 6

A CISO at a financial services firm is aligning the information security program with the business strategy. The organization is pursuing a merger that will significantly expand its customer base and require integration of disparate IT environments. The board wants assurance that security risks are managed during the merger. Which of the following should the CISO do FIRST?

Accepted Answer

Conduct a security risk assessment of the target company's environment.. The correct answer is to conduct a security risk assessment of the target company's environment. This step is foundational because it identifies risks that must be managed during the merger. It enables the CISO to provide the board with a clear picture of the security landscape, ensuring that subsequent actions such as strategy updates or control implementations are based on actual risks rather than assumptions.

Answer

Update the information security strategy to include merger integration goals.

Answer

Implement security controls from the acquiring company on the target's systems.

Answer

Develop a security integration plan for post-merger activities.

Question 7

A financial services firm has completed a risk assessment and identified that its customer-facing web application has a high risk of SQL injection. The CISO must ensure the risk is treated appropriately. Which of the following should be the FIRST action?

Accepted Answer

Present the risk to the business owner and obtain a decision on risk treatment.. The correct answer is to present the risk to the business owner and obtain a decision on risk treatment. In CISM, risk management is a business responsibility, and the CISO facilitates the process. The business owner must decide whether to mitigate, transfer, avoid, or accept the risk, ensuring alignment with organizational risk appetite and objectives.

Answer

Implement a web application firewall (WAF) in front of the application.

Answer

Immediately patch the application to remove the SQL injection vulnerability.

Answer

Transfer the risk by purchasing cyber insurance.

Question 8

A healthcare organization's information security program has a risk register with several high-risk items. The CISO is allocating budget for risk treatment. Which of the following is the MOST important factor when deciding whether to mitigate, transfer, or accept a risk?

Accepted Answer

The organization's risk appetite and tolerance levels.. The organization's risk appetite and tolerance levels are the most important factor because they establish the boundaries for acceptable risk. They guide whether to mitigate, transfer, or accept a risk, ensuring that decisions align with business strategy. Other factors like cost, likelihood, and regulations inform the decision but do not override the fundamental risk appetite.

Answer

Regulatory requirements for the specific risk.

Answer

The cost of the control versus the potential financial impact of the risk.

Answer

The likelihood and impact ratings from the risk assessment.

Question 9

A multinational corporation has a decentralized information security program. Each business unit has its own security team and budget. The CISO wants to improve consistency and reduce duplication of efforts. Which of the following is the MOST effective approach?

Accepted Answer

Establish a security governance framework with common policies, standards, and a steering committee.. Establishing a security governance framework with common policies, standards, and a steering committee is the most effective approach. It provides centralized direction while allowing business units to adapt to local needs, reducing duplication and improving consistency. This balances control with flexibility, which is essential for a multinational organization.

Answer

Outsource all security operations to a managed security service provider (MSSP).

Answer

Centralize all security functions under the CISO to ensure uniform control.

Answer

Mandate that each business unit follows the same security tools and technologies.

Question 10

A CISO is establishing an information security governance framework to ensure that security activities are aligned with business strategy. The organization has multiple business units, each with its own IT and security staff. Which of the following is the MOST effective way to ensure ongoing alignment?

Accepted Answer

Create a security steering committee composed of business unit leaders and the CISO.. A security steering committee that includes business unit leaders and the CISO provides a governance structure where security decisions are made collaboratively and aligned with business strategy. It ensures that security is not an isolated IT function but an integral part of business operations, enabling continuous alignment and effective risk management.

Answer

Conduct an annual penetration test to identify and prioritize vulnerabilities.

Answer

Delegate all security decisions to the IT department to ensure technical consistency.

Answer

Implement a monthly security awareness training program for all employees.

Question 11

An organization's information security program is being developed. The CISO needs to ensure that the program's objectives are aligned with the organization's strategic goals. Which of the following is the BEST source of input for defining the security program's objectives?

Accepted Answer

The organization's business strategy and objectives.. The organization's business strategy and objectives are the best source of input. The security program must be aligned with the business to ensure it supports and enables the achievement of strategic goals. This alignment ensures that security investments are justified and prioritized based on business risk and value.

Answer

The results of the most recent vulnerability assessment.

Answer

Regulatory compliance requirements applicable to the industry.

Answer

Industry best practices and standards such as ISO 27001.

Question 12

An organization's information security program has a risk management process that identifies and assesses risks. However, the CISO notices that risk treatment decisions are often delayed, and some high-risk items remain unaddressed for months. Which of the following is the MOST likely root cause?

Accepted Answer

Risk treatment responsibilities and decision authorities are not clearly defined.. The most likely root cause is that risk treatment responsibilities and decision authorities are not clearly defined. Effective risk management requires that each risk has an owner who is accountable for treatment decisions, and that decision-making authority is established. Without this clarity, risks may be assessed but not acted upon, causing delays and leaving high-risk items unaddressed.

Answer

The risk assessment methodology is not quantitative.

Answer

The organization lacks a formal risk register.

Answer

Senior management does not review the risk assessment results.

Question 13

A CISO is reviewing the organization's information security program and wants to improve its maturity. Which of the following are characteristics of a mature information security program? (Choose two.)

Accepted Answer

Risk management processes are integrated into business decision-making.. The two characteristics are: security metrics aligned with business objectives and reported to executive management, and risk management processes integrated into business decision-making. These indicate that security is governed at the highest level, aligned with business strategy, and embedded in organizational processes, which are key aspects of maturity.

Answer

The security team operates independently without interaction with other business units.

Answer

Security awareness training is conducted annually for all employees.

Answer

Security controls are implemented based solely on regulatory requirements.

Question 14

A CISO is developing a business case for a new security initiative. The organization's executives are focused on cost reduction and operational efficiency. Which of the following approaches is BEST to gain executive support?

Accepted Answer

Present the initiative in terms of risk reduction and its impact on business objectives.. Presenting the initiative in terms of risk reduction and its impact on business objectives is most effective because it speaks the language of executives. It demonstrates how security contributes to the organization's strategic goals, such as protecting revenue, enabling growth, and reducing potential financial losses, thereby making a compelling business case.

Answer

Provide a detailed list of vulnerabilities that the initiative will address.

Answer

Emphasize the technical superiority of the proposed security controls.

Answer

Highlight compliance requirements that mandate the security controls.

Question 15

A global organization has a policy that requires all employees to complete security awareness training within 30 days of hire and annually thereafter. During an audit, it was found that only 60% of employees completed the annual training. The CISO needs to address this non-compliance. Which of the following should be the FIRST step?

Accepted Answer

Conduct a root cause analysis to determine why employees are not completing the training.. Conducting a root cause analysis is the essential first step. It identifies why employees are not completing the training, allowing the CISO to implement targeted and effective solutions. This approach is consistent with continuous improvement and ensures that resources are used efficiently.

Answer

Report the non-compliance to the board of directors and request their intervention.

Answer

Revise the policy to extend the training deadline to 60 days to improve compliance.

Answer

Implement a technical control that blocks network access for employees who have not completed training.