CISM Information Security Program Practice Test 4 — 15 Questions

Question 1

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Accepted Answer

Legal and regulatory requirements across jurisdictions. Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Answer

Current technology architecture

Question 2

Arrange the steps in order for conducting a business impact analysis (BIA) in business continuity management.

Accepted Answer

Identify critical business functions, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions, then document findings. A BIA first identifies critical functions, then determines acceptable downtime, assesses impact, prioritizes recovery, and finally documents findings.

Answer

Identify critical business functions, then assess impact of disruptions, then determine acceptable downtime, then prioritize recovery of critical functions, then document findings

Answer

Identify critical business functions, then document findings, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions

Answer

Document findings, then prioritize recovery of critical functions, then assess impact of disruptions, then determine acceptable downtime, then identify critical business functions

Question 3

Arrange the steps for implementing a new firewall rule in an enterprise environment.

Accepted Answer

Identify requirement, Submit change request, Test in staging, Implement on production, Verify rule operation. Firewall changes require clear objectives, change control, testing, implementation, and verification.

Answer

Test in staging, Implement on production, Identify requirement, Submit change request, Verify rule operation

Answer

Submit change request, Identify requirement, Test in staging, Implement on production, Verify rule operation

Answer

Identify requirement, Test in staging, Implement on production, Submit change request, Verify rule operation

Question 4

Arrange the steps for performing a vulnerability scan on a network segment.

Accepted Answer

Obtain authorization, configure scan parameters, execute scan, analyze results, prioritize findings. Vulnerability scanning requires authorization, configuration, execution, analysis, and prioritization.

Answer

Configure scan parameters, obtain authorization, execute scan, analyze results, prioritize findings

Answer

Obtain authorization, execute scan, configure scan parameters, analyze results, prioritize findings

Answer

Obtain authorization, configure scan parameters, analyze results, execute scan, prioritize findings

Question 5

Match each CISM domain to its focus area.

Accepted Answer

Information Security Governance: Establishing and maintaining a framework to ensure information security strategies are aligned with business objectives.. The CISM domains are: Governance (strategy alignment), Risk Management (risk identification and management), Program Development (design and implementation), and Incident Management (detection and response). Common confusions include swapping program development with governance and incident management with risk management.

Answer

Information Security Governance: Designing and implementing security solutions.

Answer

Information Risk Management: Responding to security incidents.

Question 6

Match each security framework to its primary purpose.

Accepted Answer

COBIT: A framework for IT governance and management.. COBIT is for IT governance, ISO 27001 for ISMS, and NIST CSF for cybersecurity risk management. The distractors swap definitions between COBIT and ISO 27001.

Answer

COBIT: A standard for information security management systems.

Answer

ISO 27001: A framework for IT governance and management.

Question 7

Match each security role to its primary responsibility.

Accepted Answer

CISO: Responsible for overall security strategy and program management.. Correct matches: CISO → overall strategy, Security Manager → daily operations, Security Architect → design, Security Auditor → evaluation. Common confusions involve swapping these responsibilities.

Answer

CISO: Evaluates security controls and ensures compliance.

Answer

Security Manager: Designs security architecture.

Question 8

A multinational corporation is implementing a new information security program. The program manager needs to ensure that security requirements are integrated into the procurement process for third-party services. Which of the following is the most effective approach?

Accepted Answer

Embed security clauses in request for proposals (RFPs). Embedding security clauses in RFPs ensures that security requirements are formally communicated to potential vendors before any contractual agreement, making them a mandatory part of the procurement process. This proactive approach aligns with the CISM principle of integrating security into business processes from the outset, rather than retrofitting controls after contracts are signed. By specifying requirements such as encryption standards (e.g., AES-256), incident response SLAs, and compliance with frameworks like ISO 27001 in the RFP, the organization can evaluate vendor capabilities upfront and avoid costly renegotiations.

Answer

Include security requirements after contract signing

Answer

Require third parties to self-attest compliance

Answer

Conduct periodic security audits of third parties

Question 9

A financial institution is developing an information security program based on the COBIT framework. The board has requested a balanced scorecard to communicate program effectiveness. Which of the following metric categories would best align with the 'Internal Processes' perspective?

Accepted Answer

Percentage of security incidents detected within defined SLAs. The 'Internal Processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of internal operational processes. The percentage of security incidents detected within defined SLAs directly measures the performance of the security monitoring and incident response processes, which are core internal processes in a COBIT-based information security program.

Answer

Cost of security incidents as a percentage of revenue

Answer

Number of security training hours per employee

Answer

Customer satisfaction survey scores on data protection

Question 10

An organization has just completed a risk assessment and identified several high-risk vulnerabilities. The security program manager needs to prioritize remediation efforts. Which of the following should be the primary factor in determining priority?

Accepted Answer

Risk level (likelihood × impact). Risk level, calculated as likelihood multiplied by impact, is the primary factor for prioritizing remediation because it quantifies the overall exposure to the organization. While regulatory requirements, likelihood alone, or ease of remediation are important considerations, they do not capture the combined effect of both probability and consequence, which is essential for effective risk management in an information security program.

Answer

Regulatory requirements only

Answer

Likelihood of exploitation

Answer

Ease of remediation

Question 11

A company's security program includes a policy that all employees must use strong passwords and change them every 90 days. However, the recent internal audit shows that 60% of employees have passwords that do not meet the strength requirements. What is the most effective corrective action?

Accepted Answer

Implement technical controls to enforce password strength. Implementing technical controls, such as password complexity requirements and automated enforcement, ensures compliance without relying solely on user behavior. Option A is wrong because manual audits detect non-compliance but do not prevent it. Option B is wrong because training alone is insufficient to enforce policy. Option D is wrong because extending the password change interval does not address the root cause of weak passwords.

Answer

Conduct quarterly password audits with manual checks

Answer

Increase the frequency of security awareness training

Answer

Extend the password change interval to 180 days

Question 12

A global e-commerce company is designing its information security program. The CISO wants to implement a defense-in-depth strategy for the web application layer. Which combination of controls best achieves this objective?

Accepted Answer

WAF, input validation, and security logging. Defense-in-depth at the web application layer requires overlapping controls: prevention (input validation), detection (WAF), and monitoring/response (security logging). Option A (SSL/TLS and VPN) provides encryption but does not prevent application-layer attacks. Option B (WAF and IDS) misses a preventive control like input validation. Option D (patching and scanning) addresses vulnerabilities but lacks real-time detection and response.

Answer

SSL/TLS encryption and VPN access

Answer

Web application firewall (WAF) and intrusion detection system (IDS)

Answer

Regular patching and vulnerability scanning

Question 13

A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?

Accepted Answer

NIST Cybersecurity Framework. The NIST Cybersecurity Framework (CSF) is the most appropriate choice because it is designed to be flexible and scalable, allowing small businesses with limited budget and staff to implement a risk-based information security program using a prioritized, outcome-driven approach. Unlike ISO/IEC 27001, which requires formal certification and extensive documentation, or COBIT 2019, which is geared toward enterprise IT governance, the NIST CSF provides a customizable set of core functions (Identify, Protect, Detect, Respond, Recover) that can be adopted incrementally without heavy resource investment.

Answer

ISO/IEC 27001

Answer

COBIT 2019

Answer

PCI DSS

Question 14

An organization has a mature security program but is experiencing an increase in successful social engineering attacks. The incident response team has confirmed that the attacks are bypassing current controls. What should the program manager do first?

Accepted Answer

Conduct a root cause analysis and update risk assessment. A root cause analysis (RCA) is the correct first step because it identifies the specific weaknesses in people, processes, or technology that allowed the social engineering attacks to bypass existing controls. Updating the risk assessment based on RCA findings ensures that remediation efforts are prioritized against actual threats, rather than applying generic fixes. This aligns with the CISM principle that program management decisions must be data-driven and risk-based.

Answer

Implement multi-factor authentication for all systems

Answer

Disable email links and attachments

Answer

Increase the frequency of security awareness training

Question 15

A company's security program includes a policy that prohibits the use of personal devices for work. However, the CISO discovers that several executives are using personal tablets to access corporate email. What is the most appropriate action for the CISO to take?

Accepted Answer

Update the policy to allow personal devices under strict controls. The CISO must align security controls with business reality. Rather than enforcing an unworkable policy that executives are already circumventing, the CISO should update the policy to incorporate a mobile device management (MDM) solution that enforces device encryption, remote wipe, and conditional access via Azure AD or similar identity provider. This approach reduces risk by bringing personal devices under formal governance while maintaining executive productivity.

Answer

Block all personal devices from the network

Answer

Continue monitoring but take no action

Answer

Discipline the executives for policy violation