CISM Information Security Program Practice Test 3 — 15 Questions

Question 1

Which of the following is the most important factor for ensuring the long-term success of an information security program?

Accepted Answer

Strong support from top management.. Strong support from top management is the most important factor because it ensures the information security program receives adequate budget, organizational authority, and strategic alignment with business objectives. Without executive sponsorship, even the best technical controls can be undermined by resource constraints, policy non-compliance, or lack of cross-departmental cooperation. The CISM framework emphasizes that governance and leadership commitment are foundational to sustaining a security program over time.

Answer

Deployment of advanced security technologies.

Answer

Comprehensive security awareness training.

Answer

Regular penetration testing.

Question 2

An information security manager is developing a program metric to measure the effectiveness of the security awareness training. Which metric is most appropriate?

Accepted Answer

Number of security incidents caused by human error.. The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

Answer

Percentage of employees who completed the training.

Answer

Average score on post-training tests.

Answer

Time taken to complete the training modules.

Question 3

During a review of the information security program, the security manager discovers that the program's objectives are not aligned with the organization's strategic business goals. What is the best course of action?

Accepted Answer

Revise the program objectives to align with business goals.. The CISM framework emphasizes that an information security program must be directly aligned with the organization's strategic business goals to ensure that security investments support business objectives rather than hinder them. Revising the program objectives to align with business goals (Option B) is the correct course of action because it ensures that security controls, risk appetite, and resource allocation are driven by business needs, not isolated technical requirements. This alignment is a core principle of the Information Security Program domain, as misalignment can lead to wasted resources, reduced executive support, and increased business risk.

Answer

Justify the existing objectives to management to demonstrate their value.

Answer

Implement additional security controls to compensate for the misalignment.

Answer

Escalate the issue to the board of directors without changes.

Question 4

Which of the following are essential components of an information security program governance framework? (Select TWO.)

Accepted Answer

A security steering committee with executive representation.. A security steering committee with executive representation is essential because it provides strategic oversight, aligns security initiatives with business objectives, and ensures resource allocation and governance accountability. This committee typically includes C-level executives who approve security policies, review risk posture, and enforce compliance across the organization.

Answer

A formal risk appetite statement.

Answer

An incident response plan.

Question 5

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Accepted Answer

Business impact analysis (BIA) results.. A is correct because the Business Impact Analysis (BIA) identifies critical business processes, their maximum tolerable downtime (MTD), and recovery time objectives (RTO), which directly inform the prioritization and design of security controls to ensure business continuity. Without BIA results, the security program cannot align recovery strategies with actual business needs, risking either over-investment or under-protection of key functions.

Answer

Security awareness training for all employees.

Answer

Vulnerability scanning schedules.

Question 6

Which of the following best describes the primary purpose of a security program's governance framework?

Accepted Answer

To provide oversight and alignment with business objectives. The primary purpose of a security program's governance framework is to provide oversight and ensure that security activities are aligned with business objectives, risk appetite, and regulatory requirements. It establishes the policies, roles, and accountability structures that guide decision-making, rather than directly executing technical tasks. This alignment is critical for the program to be sustainable and supported by executive management.

Answer

To implement technical security controls

Answer

To conduct vulnerability assessments

Answer

To manage security incidents

Question 7

An organization has a mature security program with documented policies and standards. However, during a recent audit, it was found that several business units are not following the mandated data classification standard. What is the MOST likely root cause?

Accepted Answer

Lack of enforcement mechanisms. A mature security program with documented policies and standards indicates that the classification rules are already defined. The audit finding that business units are not following the mandated standard points to a failure in enforcement mechanisms—such as automated Data Loss Prevention (DLP) rules, access control policies, or mandatory labeling in SharePoint—rather than a lack of awareness or outdated policy. Without enforcement (e.g., Group Policy Objects blocking unclassified data uploads or SIEM alerts for missing classification tags), even well-trained staff may bypass the standard.

Answer

Inadequate security awareness training

Answer

Outdated data classification policy

Answer

Insufficient budget for security tools

Question 8

Which document should be created FIRST when establishing an information security program?

Accepted Answer

Information security policy. The information security policy is the foundational document that establishes management's intent, direction, and support for the security program. It defines the scope, objectives, and responsibilities, and all other security documents (risk assessments, incident response plans, BCPs) derive their authority and alignment from this policy. Without an approved policy, subsequent activities lack governance and executive backing.

Answer

Risk assessment report

Answer

Incident response plan

Answer

Business continuity plan

Question 9

An information security manager is designing a metrics program to report to the board. Which of the following metrics would be MOST meaningful to the board?

Accepted Answer

Percentage of systems with critical vulnerabilities. The board is primarily concerned with strategic risk posture and business impact. Percentage of systems with critical vulnerabilities directly quantifies the organization's exposure to high-severity threats, enabling informed risk acceptance or remediation decisions. This metric aligns with the board's fiduciary duty to oversee risk management, unlike operational details such as incident counts or training completions.

Answer

Number of security incidents reported

Answer

Average patch deployment time

Answer

Number of security awareness training completions

Question 10

An organization has a security program that is aligned with ISO 27001. During an internal audit, it is discovered that several controls are not being applied consistently across all departments. The MOST effective corrective action is to:

Accepted Answer

Establish a centralized security oversight function. The core issue is inconsistent control application across departments, which indicates a lack of governance and oversight rather than a policy or awareness deficiency. Establishing a centralized security oversight function directly addresses this by creating a single authority to enforce, monitor, and standardize control implementation, ensuring alignment with ISO 27001 requirements for management commitment and resource allocation (Clause 5.1 and 7.1). This corrective action provides the necessary organizational structure to drive consistent execution, which is the most effective long-term solution.

Answer

Update the information security policy

Answer

Increase security awareness training frequency

Answer

Conduct a risk assessment for each department

Question 11

Which of the following are key components of an information security program's strategic plan? (Select two.)

Accepted Answer

Security program vision and objectives. The strategic plan for an information security program defines the long-term direction and governance framework. The security program vision and objectives (B) establish the overarching goals and alignment with business strategy, while the roadmap for security initiatives (D) provides the phased implementation plan to achieve those objectives. These are foundational components of strategic planning, not operational or tactical elements.

Answer

Annual budget allocation

Answer

Incident response procedures

Question 12

A security manager is evaluating the effectiveness of the security program. Which of the following would be valid indicators of a mature program? (Select two.)

Accepted Answer

Risk management integrated into business processes. Risk management integrated into business processes (B) is a key indicator of a mature security program because it demonstrates that security is not a siloed function but is embedded in strategic decision-making, resource allocation, and operational workflows. This alignment ensures that security controls and investments are directly tied to business objectives and risk appetite, which is a hallmark of maturity as defined by frameworks like the CMMI and the ISACA CISM model.

Answer

Number of security tools deployed

Answer

Low number of security incidents

Question 13

Which of the following is the primary purpose of an Information Security Program?

Accepted Answer

To align security with business objectives and manage risk. The primary purpose of an Information Security Program is to align security initiatives with business objectives and manage risk to an acceptable level. While technology implementation, compliance, and risk elimination are components, they are means to the end of supporting the organization's mission and risk appetite. A program that does not align with business goals will lack executive support and fail to prioritize resources effectively.

Answer

To implement the latest security technologies

Answer

To comply with all applicable regulations

Answer

To eliminate all security risks

Question 14

An information security manager is developing a program metric to report to senior management. Which metric best demonstrates the effectiveness of the information security program?

Accepted Answer

Mean time to detect (MTTD) security incidents. Mean time to detect (MTTD) is a key performance indicator that directly measures how quickly the security program identifies incidents, reflecting the effectiveness of detection controls, monitoring tools, and incident response readiness. Unlike compliance-focused metrics, MTTD provides actionable insight into the program's ability to minimize dwell time and reduce potential impact, making it the most relevant metric for senior management to assess program effectiveness.

Answer

Number of security incidents reported

Answer

Percentage of systems with up-to-date patches

Answer

Number of security awareness training sessions held

Question 15

Which of the following are key components of a mature information security program? (Select 2)

Accepted Answer

Comprehensive risk management process. A comprehensive risk management process is a foundational component of a mature information security program because it ensures that security controls are aligned with business objectives through systematic identification, assessment, and treatment of risks. This process, often guided by frameworks like ISO 31000 or NIST SP 800-39, enables prioritization of resources based on risk appetite and tolerance, rather than relying on ad-hoc or reactive measures. Without this, the program lacks the structured governance needed to adapt to evolving threats and regulatory requirements.

Answer

Adoption of cloud security tools

Answer

Single point of failure for security decisions