CISM Information Security Program Practice Test 11 — 15 Questions

Question 1

A CISO is establishing an information security governance framework. The organization operates in multiple countries with varying data protection laws. Which of the following should be the PRIMARY consideration when developing security policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adopting the strictest regulatory requirements across all jurisdictions.. Adopting the strictest regulatory requirements across all jurisdictions is the primary consideration because it ensures compliance everywhere and provides a consistent baseline for security policies. This approach avoids the complexity of managing multiple policy sets and reduces the risk of non-compliance in any location, supporting a robust governance framework.

Answer

Implementing a single global policy that meets the minimum legal requirements.

Answer

Allowing each country to develop its own security policies independently.

Answer

Deferring to the legal department to determine policy requirements.

Question 2

A CISO is reviewing the information security program's performance measurement framework. The organization wants to ensure that the metrics used are effective in demonstrating the program's value to senior management. Which of the following are characteristics of effective security metrics? (Choose two.)

Accepted Answer

They are directly linked to business objectives.. Effective security metrics are directly linked to business objectives and are consistently measurable over time. These characteristics ensure that metrics demonstrate how security supports the organization's strategic goals and allow for trend analysis and benchmarking. They provide senior management with meaningful information to make informed decisions about the security program.

Answer

They are focused on technical vulnerabilities.

Answer

They are based on the number of security incidents.

Answer

They are updated in real time.

Question 3

A mid-sized financial services firm has a newly appointed CISO. The board has asked for assurance that the information security program aligns with the organization's strategic goals and risk appetite. The CISO needs to establish a governance structure that provides ongoing oversight and ensures security decisions are made at the right level. Which of the following should the CISO implement FIRST?

Accepted Answer

A security steering committee composed of senior business and IT leaders that meets regularly to review security strategy, risk, and performance.. Establishing a security steering committee with senior business and IT leaders is the foundational governance step. It creates a direct link between the security program and business strategy, ensures security decisions are made at the appropriate level, and provides ongoing oversight. This structure enables the CISO to align security initiatives with the organization's risk appetite and gives the board the assurance they are seeking.

Answer

A comprehensive penetration test of all external-facing applications to identify vulnerabilities.

Answer

A detailed security awareness training program for all employees to reduce human risk.

Answer

A new security incident response plan that defines roles and responsibilities for handling breaches.

Question 4

An organization is establishing an information security program. The CISO wants to ensure that the program has the necessary authority and resources. Which of the following is the MOST important to establish first?

Accepted Answer

A formal security charter approved by executive management.. A formal security charter approved by executive management is the most important first step because it establishes the program's authority, scope, and resources. It ensures that security is aligned with business objectives and provides the CISO with the mandate to implement and enforce the program. Without this foundation, other activities may lack support and effectiveness.

Answer

An incident response plan.

Answer

A security awareness training program.

Answer

A comprehensive risk assessment.

Question 5

An organization's information security program has a documented risk management process. During a review, the CISO finds that risk assessments are performed annually but do not account for changes in the threat landscape or business environment. Which of the following is the BEST recommendation to improve the program?

Accepted Answer

Implement a continuous risk assessment process integrated with change management.. Implementing a continuous risk assessment process integrated with change management is the best recommendation because it ensures that risk assessments are performed whenever significant changes occur, not just annually. This dynamic approach keeps the risk register current and enables the organization to respond to emerging threats and business changes effectively, improving overall risk management.

Answer

Outsource risk assessments to a third-party specialist.

Answer

Increase the frequency of risk assessments to quarterly.

Answer

Adopt a risk assessment framework such as OCTAVE or FAIR.

Question 6

A CISO is building a new information security program for a multinational financial services firm. The board has approved a budget but wants assurance that security investments are aligned with business objectives. Which of the following should the CISO do FIRST to establish this alignment?

Accepted Answer

Conduct a comprehensive risk assessment to identify and prioritize threats to business objectives.. The correct answer is to conduct a risk assessment first. This step identifies which business objectives are at risk and prioritizes threats, enabling the CISO to align security investments with what the business values most. It provides the evidence needed to justify budget allocation and ensures that subsequent security activities are driven by business needs rather than technology or compliance alone.

Answer

Develop a security awareness training program for all employees.

Answer

Adopt an industry-recognized framework such as ISO/IEC 27001 to structure the program.

Answer

Implement a security information and event management (SIEM) system to monitor for threats.

Question 7

A CISO has implemented a security program based on ISO/IEC 27001. During a management review, the CIO asks how the program contributes to business value. Which of the following metrics would BEST demonstrate the program's contribution to business value?

Accepted Answer

Reduction in the likelihood of material breaches affecting critical business processes.. The correct answer is the reduction in likelihood of material breaches affecting critical business processes. This metric translates security efforts into business terms by focusing on risk reduction for what matters most. It demonstrates that the program is not just implementing controls but actively protecting the organization's ability to achieve its objectives, which is the essence of business value.

Answer

Number of security incidents detected and resolved within service level agreements.

Answer

Total number of security controls implemented across the enterprise.

Answer

Percentage of employees who completed security awareness training.

Question 8

A global financial services firm has a mature information security program. The CISO wants to ensure that the program's strategic objectives remain aligned with changing business goals, such as a new push into mobile banking. Which of the following is the MOST effective way to achieve this alignment?

Accepted Answer

Establish a security steering committee that includes business unit leaders to review and adjust security strategy regularly.. The most effective way to align the security program with changing business goals is to establish a governance structure that includes business stakeholders. A security steering committee facilitates ongoing communication and ensures that security strategy is adjusted in response to business shifts. This proactive approach is central to CISM's focus on aligning security with organizational objectives.

Answer

Increase the security awareness training budget for all employees.

Answer

Update the information security policy to include mobile banking security requirements.

Answer

Conduct an annual penetration test on all mobile banking applications.

Question 9

A CISO is developing a set of key performance indicators (KPIs) for the information security program to report to the board. Which of the following are appropriate KPIs for measuring the effectiveness of the security program? (Choose two.)

Accepted Answer

Percentage of critical vulnerabilities remediated within defined timeframes.. The correct answers are mean time to detect (MTTD) and percentage of critical vulnerabilities remediated within defined timeframes. Both are performance-oriented metrics that measure the speed and effectiveness of key security processes, providing insight into how well the program reduces risk. They are actionable and can be trended over time to show improvement or deterioration.

Answer

Number of security policies approved by management.

Answer

Annual security budget as a percentage of IT budget.

Answer

Total number of security tools deployed.

Question 10

A CISO is building a new information security program for a multinational corporation. The board has approved a risk appetite statement but has not yet approved a security budget. The CISO must decide which activity to perform FIRST to ensure the program aligns with business objectives. What should the CISO do first?

Accepted Answer

Translate the board's risk appetite into specific security requirements and objectives. The correct answer is to translate the board's risk appetite into specific security requirements and objectives. This step ensures the security program is aligned with business goals and provides a basis for resource allocation, prioritization, and measurement. It bridges the gap between high-level risk tolerance and operational security activities, enabling the CISO to build a program that effectively manages risk in line with the organization's strategic direction.

Answer

Conduct a comprehensive asset inventory and vulnerability assessment

Answer

Purchase and deploy an advanced endpoint detection and response (EDR) solution

Answer

Implement a security awareness training program for all employees

Question 11

A multinational corporation has a decentralized information security program. Each business unit has its own security team and budget, and they report to their respective business unit leaders. The CISO has limited authority over these teams. A recent incident revealed inconsistent security controls across business units, and the board is concerned about the overall risk posture. Which of the following should the CISO recommend to improve the program's effectiveness?

Accepted Answer

Establish a federated security model with a central governance framework and common standards, while allowing business units to implement controls tailored to their specific risks.. A federated security model with central governance and common standards addresses the inconsistency while respecting the decentralized structure. It allows the CISO to set minimum requirements and oversight without stripping business units of their autonomy. This approach is practical given the CISO's limited authority and the need for tailored controls based on specific business unit risks.

Answer

Implement a security awareness program across all business units to improve adherence to policies.

Answer

Outsource all security operations to a managed security service provider (MSSP) to achieve uniform controls.

Answer

Centralize all security functions under the CISO to ensure consistent implementation of controls.

Question 12

A healthcare organization has a security program that relies on a risk assessment conducted three years ago. Since then, the organization has adopted cloud services and telehealth, and new privacy regulations have been enacted. The CISO is concerned that the current security controls may not adequately address the new risks. Which of the following should the CISO do FIRST to ensure the program remains effective?

Accepted Answer

Perform a new risk assessment that includes the cloud and telehealth environments.. The CISO should first perform a new risk assessment because significant changes such as cloud adoption, telehealth, and new regulations alter the risk landscape. A current risk assessment identifies new threats, vulnerabilities, and regulatory requirements, enabling the organization to update controls and policies effectively. This aligns with CISM's emphasis on continuous risk management as the core of an information security program.

Answer

Conduct a security awareness campaign focused on telehealth and cloud security.

Answer

Implement additional security controls for cloud and telehealth based on industry best practices.

Answer

Update the information security policy to include cloud and telehealth security requirements.

Question 13

A financial services firm has a mature information security program. The Chief Information Security Officer (CISO) is asked by the board to demonstrate that the program is aligned with the organization's strategic objectives. Which of the following is the MOST effective way for the CISO to provide this assurance?

Accepted Answer

Map security program objectives and metrics to specific business goals and report on their contribution.. The board wants assurance that security is not a siloed function but is integrated with business strategy. Mapping security objectives and metrics to business goals provides that assurance by showing how security enables business outcomes. Other options focus on compliance, technical posture, or incident history, which do not directly address strategic alignment. The CISO should use business language and measurable contributions to demonstrate value.

Answer

Present the results of the latest penetration test and vulnerability remediation statistics.

Answer

Conduct a gap analysis against ISO/IEC 27001:2022 and present the results to the board.

Answer

Provide a summary of security incidents and the associated financial losses over the past year.

Question 14

A newly appointed CISO is reviewing the existing information security program. The program has many documented policies and procedures, but the CISO notices that they have not been updated in over three years. What should the CISO do FIRST?

Accepted Answer

Conduct a gap analysis to determine which policies are outdated and need revision.. The correct answer is to conduct a gap analysis first. This step identifies which policies are outdated or missing, allowing the CISO to prioritize updates based on risk and business impact. It ensures that subsequent efforts are targeted and justified, rather than a blanket rewrite that could waste resources and still miss critical issues.

Answer

Schedule a management review to approve the existing policies as they are.

Answer

Immediately rewrite all policies to reflect current best practices.

Answer

Delegate the policy update task to the security team without further direction.

Question 15

A multinational corporation's information security program is decentralized, with each business unit managing its own security controls. The CISO wants to implement a federated governance model to improve consistency while respecting business unit autonomy. Which of the following is the MOST critical factor for the success of this model?

Accepted Answer

Defining clear roles, responsibilities, and decision rights between central and business unit security teams.. A federated governance model balances central oversight with business unit autonomy. The most critical factor is defining clear roles, responsibilities, and decision rights, which prevents confusion and ensures consistent application of security policies while allowing local flexibility. Other options focus on technology, compliance, or centralization, which do not address the core governance challenge. Without clear decision rights, federated models often stall.

Answer

Requiring each business unit to achieve ISO/IEC 27001 certification within one year.

Answer

Establishing a central security operations center (SOC) that monitors all business units.

Answer

Implementing a single security toolset across all business units to ensure uniformity.