CISM Information Security Program Practice Test 4 — 15 Questions

Question 1

A multinational corporation is implementing a new information security program. The program manager needs to ensure that security requirements are integrated into the procurement process for third-party services. Which of the following is the most effective approach?

Accepted Answer

Embed security clauses in request for proposals (RFPs). Option C is correct because integrating security requirements into the procurement lifecycle ensures that contractual obligations are legally binding. Option A is wrong because post-contract negotiations are less effective and may face resistance. Option B is wrong because periodic reviews are reactive. Option D is wrong because it shifts responsibility without proper integration.

Answer

Include security requirements after contract signing

Answer

Require third parties to self-attest compliance

Answer

Conduct periodic security audits of third parties

Question 2

A financial institution is developing an information security program based on the COBIT framework. The board has requested a balanced scorecard to communicate program effectiveness. Which of the following metric categories would best align with the 'Internal Processes' perspective?

Accepted Answer

Percentage of security incidents detected within defined SLAs. Option A is correct because the Internal Processes perspective focuses on operational efficiency and effectiveness of security processes. Option B is wrong as it relates to Customer perspective. Option C is wrong as it relates to Learning and Growth. Option D is wrong as it relates to Financial.

Answer

Cost of security incidents as a percentage of revenue

Answer

Number of security training hours per employee

Answer

Customer satisfaction survey scores on data protection

Question 3

An organization has just completed a risk assessment and identified several high-risk vulnerabilities. The security program manager needs to prioritize remediation efforts. Which of the following should be the primary factor in determining priority?

Accepted Answer

Risk level (likelihood × impact). Option C is correct because risk level combines likelihood and impact, aligning with risk management principles. Option A is wrong as ease of remediation without considering risk leads to misallocation. Option B is wrong because it ignores impact. Option D is wrong as regulatory requirements are important but should be integrated into risk assessment.

Answer

Regulatory requirements only

Answer

Likelihood of exploitation

Answer

Ease of remediation

Question 4

A company's security program includes a policy that all employees must use strong passwords and change them every 90 days. However, the recent internal audit shows that 60% of employees have passwords that do not meet the strength requirements. What is the most effective corrective action?

Accepted Answer

Implement technical controls to enforce password strength. Option D is correct because automated enforcement ensures policy compliance without relying on user behavior change. Option A is wrong as training alone is insufficient. Option B is wrong because it reduces security and does not address the root cause. Option C is wrong as audits detect but do not prevent non-compliance.

Answer

Conduct quarterly password audits with manual checks

Answer

Increase the frequency of security awareness training

Answer

Extend the password change interval to 180 days

Question 5

A global e-commerce company is designing its information security program. The CISO wants to implement a defense-in-depth strategy for the web application layer. Which combination of controls best achieves this objective?

Accepted Answer

WAF, input validation, and security logging. Option B is correct because defense-in-depth requires multiple layers of controls: detection (WAF), prevention (input validation), and response (monitoring). Option A is wrong as IDS alone is detection only. Option C is wrong as patching is a single layer. Option D is wrong as encryption provides confidentiality but not attack prevention.

Answer

SSL/TLS encryption and VPN access

Answer

Web application firewall (WAF) and intrusion detection system (IDS)

Answer

Regular patching and vulnerability scanning

Question 6

A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?

Accepted Answer

NIST Cybersecurity Framework. Option C is correct because NIST CSF is scalable, risk-based, and suitable for organizations of all sizes. Option A is wrong as ISO 27001 is comprehensive but resource-intensive. Option B is wrong as COBIT is focused on IT governance, not specifically security. Option D is wrong as PCI DSS applies only to credit card data.

Answer

ISO/IEC 27001

Answer

COBIT 2019

Answer

PCI DSS

Question 7

An organization has a mature security program but is experiencing an increase in successful social engineering attacks. The incident response team has confirmed that the attacks are bypassing current controls. What should the program manager do first?

Accepted Answer

Conduct a root cause analysis and update risk assessment. Option D is correct because the first step in continuous improvement is to analyze the root cause and update the risk assessment. Option A is wrong as increasing training without understanding the gap may be inefficient. Option B is wrong as it only addresses future incidents, not current vulnerabilities. Option C is premature without analysis.

Answer

Implement multi-factor authentication for all systems

Answer

Disable email links and attachments

Answer

Increase the frequency of security awareness training

Question 8

A company's security program includes a policy that prohibits the use of personal devices for work. However, the CISO discovers that several executives are using personal tablets to access corporate email. What is the most appropriate action for the CISO to take?

Accepted Answer

Update the policy to allow personal devices under strict controls. Option B is correct because the program should be risk-based: allow the behavior but enforce security controls like MDM and data encryption. Option A is wrong as ignoring policy undermines the program. Option C is wrong as blanket prohibition may be bypassed. Option D is wrong as security should enable business while managing risk.

Answer

Block all personal devices from the network

Answer

Continue monitoring but take no action

Answer

Discipline the executives for policy violation

Question 9

Which of the following best describes the primary purpose of an information security program?

Accepted Answer

To manage security risks in alignment with business strategy. Option C is correct because the program's goal is to align security with business objectives and manage risk to an acceptable level. Option A is wrong as availability is one aspect of CIA triad, not the primary purpose. Option B is wrong as security is an enabler, not an absolute obstacle. Option D is wrong as legal compliance is a component, not the overarching goal.

Answer

To ensure 100% system availability

Answer

To eliminate all security risks

Answer

To achieve compliance with all applicable regulations

Question 10

Which TWO of the following are essential components of a security program governance structure?

Accepted Answer

Security charter. Options A and D are correct because a steering committee provides oversight and a security charter defines authority. Option B is wrong as a help desk is operational. Option C is wrong as vulnerability scanning is a technical control, not governance. Option E is wrong as an incident response plan is operational.

Answer

Vulnerability scanning schedule

Answer

Incident response plan

Answer

Help desk ticketing system

Question 11

Which TWO of the following are key performance indicators (KPIs) that demonstrate the effectiveness of a security awareness program?

Accepted Answer

Percentage of employees who correctly identify a phishing email in simulations. Options A and D are correct because they measure behavior change and reduced incidents. Option B is wrong as training completion is an input metric, not outcome. Option C is wrong as phishing simulation results are a specific test, but frequency alone is not a KPI of effectiveness. Option E is wrong as number of reported phishing emails can be positive, but it's an activity metric, not a direct outcome.

Answer

Number of employees who report suspicious emails

Answer

Frequency of phishing simulation tests

Answer

Number of training sessions completed per quarter

Question 12

Which THREE of the following are typically included in an information security program budget?

Accepted Answer

Incident response retainer. Options A, C, and E are correct as they are common security program costs. Option B is wrong as marketing is generally not security-related. Option D is wrong as employee salaries are operational expenses, but typically budgeted separately.

Answer

Marketing and advertising campaigns

Answer

Employee salaries

Question 13

An auditor reviews the BYOD policy and notes that mobile device management (MDM) logs show several devices without encryption. The policy has been in effect for 6 months. Which of the following is the most likely reason for this non-compliance?

Accepted Answer

MDM is not configured to enforce encryption automatically. Option D is correct because the policy lacks automated enforcement of encryption; MDM can enforce encryption if the policy requires it, but the exhibit does not mention automated enforcement. Option A is wrong because there is a clear requirement for encryption. Option B is wrong because the grace period applies to OS updates, not encryption. Option C is wrong because encryption is explicitly required; the gap is in technical enforcement.

Answer

The grace period allows non-compliance for 7 days

Answer

Employees are unaware of the encryption requirement

Answer

The policy does not explicitly require encryption

Question 14

The security analyst reviews the SIEM alert and finds that the source IP is from a trusted VPN broker used by remote employees. What is the most likely explanation for the alert?

Accepted Answer

An attacker has compromised a remote employee's device and is brute-forcing the admin account. Option B is correct because a brute force attack could originate from a compromised VPN endpoint. Option A is wrong because the alert indicates failed attempts, not successful authentication. Option C is wrong because failed attempts are likely malicious, not mistaken. Option D is wrong as the alert is not false positive given the pattern.

Answer

The VPN broker itself is misconfigured

Answer

A legitimate user forgot their password

Answer

The alert is a false positive due to SIEM rule threshold

Question 15

Based on the risk register entry, what is the primary gap in the current controls?

Accepted Answer

The policy exists but is not enforced technically. Option D is correct because the current control is a policy without enforcement, leaving the risk unmitigated. Option A is wrong because the risk score is 15, not low. Option B is wrong as likelihood is medium, not low. Option C is wrong because MDM is proposed but not implemented.

Answer

MDM is not a suitable control

Answer

The risk score is too low to require action

Answer

The likelihood of occurrence is low