CISM Information Security Program Practice Test 4 — 15 Questions

Question 1

An information security program is being developed for a multinational organization. Which of the following is the PRIMARY driver for aligning the security program with business objectives?

Accepted Answer

Achieving the organization's strategic goals. The primary driver for aligning the security program with business objectives is to ensure that security initiatives directly support and enable the organization's strategic goals. Without this alignment, security becomes a cost center rather than a business enabler, and resources may be misallocated to activities that do not advance the enterprise's mission. CISM emphasizes that security governance must be integrated with business strategy to justify investment and demonstrate value to stakeholders.

Answer

Compliance with industry regulations

Answer

Reducing information security costs

Answer

Implementing the latest security technologies

Question 2

After a major security incident, the board of directors requests a review of the information security program. Which of the following metrics would be MOST useful to demonstrate the effectiveness of the program over the past year?

Accepted Answer

Number of security incidents detected and contained within defined SLAs. The most useful metric to demonstrate the effectiveness of an information security program is the number of security incidents detected and contained within defined SLAs. This metric directly measures the program's ability to detect and respond to incidents in a timely manner, which is a key indicator of operational effectiveness. It shows how well the program is performing in real-world scenarios.

Answer

Percentage of employees who completed security awareness training

Answer

Total cost of security investments compared to industry benchmarks

Answer

Number of vulnerabilities identified in the latest penetration test

Question 3

An information security manager is designing a program for a healthcare organization. Which of the following should be the FIRST step in establishing the program?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment is the foundational first step because it identifies and prioritizes the specific threats and vulnerabilities facing the healthcare organization's sensitive data (e.g., PHI under HIPAA). Without this baseline understanding, any subsequent policies, controls, or metrics would be misaligned with actual risk exposure, leading to ineffective or wasteful security investments.

Answer

Develop information security policies and procedures

Answer

Select and implement security controls

Answer

Define security metrics and reporting

Question 4

An organization's information security program includes a formal exception process. When reviewing an exception request to bypass a critical control, what is the MOST important factor for the information security manager to consider?

Accepted Answer

The residual risk after compensating controls. The most important factor when reviewing an exception request to bypass a critical control is the residual risk after compensating controls. This ensures that the organization's risk appetite is not exceeded and that the compensating controls adequately mitigate the risk to an acceptable level, as required by frameworks like ISO 27001 and NIST SP 800-53.

Answer

The cost of implementing the control

Answer

The number of users affected by the exception

Answer

The duration of the exception

Question 5

Which of the following are key components of an effective information security program? (Select TWO.)

Accepted Answer

A risk management framework. A risk management framework is a key component because it provides a structured, repeatable process for identifying, assessing, and mitigating information security risks. It ensures that security investments and controls are aligned with business objectives and risk appetite, rather than being ad hoc or technology-driven. Without a risk management framework, an information security program lacks the foundational governance to prioritize threats and allocate resources effectively.

Answer

State-of-the-art security tools and technologies

Answer

A large security operations center

Answer

Compliance with all applicable laws

Question 6

An information security manager is evaluating the maturity of the organization's security program. Which of the following indicators suggest a high level of maturity? (Select TWO.)

Accepted Answer

Security metrics are included in regular executive reports. Including security metrics in regular executive reports demonstrates that security performance is being measured, tracked, and communicated to leadership as part of ongoing governance. This aligns with a mature security program where security is integrated into business decision-making, not treated as a siloed technical function.

Answer

All security incidents are resolved within 24 hours

Answer

The program uses the latest encryption standards

Answer

The security team conducts annual penetration tests

Question 7

Which of the following is the PRIMARY responsibility of a steering committee in an information security program?

Accepted Answer

Providing strategic direction and oversight. The steering committee's primary role is to provide strategic direction and oversight for the information security program, ensuring alignment with business objectives and risk appetite. This includes approving the overall security strategy, budget, and major initiatives, rather than engaging in operational tasks like policy drafting or technical assessments.

Answer

Approving individual security policies

Answer

Conducting vulnerability assessments

Answer

Implementing security controls

Question 8

An organization's information security program is based on a risk management framework. Which of the following BEST describes the role of the information security manager in this context?

Accepted Answer

Designing and managing the security program. The information security manager is responsible for designing and managing the security program based on the risk management framework. This includes translating risk assessment results into security controls, policies, and procedures, and ensuring the program aligns with the organization's risk posture. The manager does not set risk appetite (that is a board-level decision) nor own all risks (risk owners are business process owners).

Answer

Setting the organization's risk appetite

Answer

Owning all information security risks

Answer

Conducting internal audits of controls

Question 9

Which of the following are key components of an information security program? (Select TWO)

Accepted Answer

A set of security policies and standards. A set of security policies and standards is a key component because it establishes the governance framework that defines acceptable use, access control, and compliance requirements for the entire organization. Without documented policies and standards, the security program lacks the authoritative baseline to enforce controls or measure effectiveness. These documents are the foundation for all other security activities, including training, audits, and incident response.

Answer

A network architecture diagram

Answer

An incident response log

Question 10

Which of the following best describes the primary purpose of an Information Security Program?

Accepted Answer

To align security efforts with business objectives and manage risk.. The primary purpose of an Information Security Program is to align security efforts with business objectives and manage risk to an acceptable level. This ensures that security investments and activities directly support the organization's mission, rather than operating in isolation. A program focused solely on compliance or technical controls may fail to address the dynamic risk landscape and business needs.

Answer

To reduce the number of security incidents to zero.

Answer

To ensure compliance with all relevant laws and regulations.

Answer

To implement technical security controls across all systems.

Question 11

An organization's information security program has been operational for two years. The security manager is asked to propose changes to improve effectiveness. Which approach should the manager take first?

Accepted Answer

Conduct a maturity assessment of the current program.. Before making any changes, the security manager must first understand the current state of the program. A maturity assessment (e.g., using the CMMI or COBIT framework) evaluates the effectiveness, gaps, and capability levels of existing processes and controls. This baseline ensures that subsequent improvements are targeted and justified, rather than arbitrary or misaligned with the organization's actual needs.

Answer

Implement new security controls based on industry best practices.

Answer

Increase the security awareness training budget.

Answer

Revise the information security policy.

Question 12

Which of the following is the most important factor for ensuring the long-term success of an information security program?

Accepted Answer

Strong support from top management.. Strong support from top management is the most important factor because it ensures the information security program receives adequate budget, organizational authority, and strategic alignment with business objectives. Without executive sponsorship, even the best technical controls can be undermined by resource constraints, policy non-compliance, or lack of cross-departmental cooperation. The CISM framework emphasizes that governance and leadership commitment are foundational to sustaining a security program over time.

Answer

Deployment of advanced security technologies.

Answer

Comprehensive security awareness training.

Answer

Regular penetration testing.

Question 13

An information security manager is developing a program metric to measure the effectiveness of the security awareness training. Which metric is most appropriate?

Accepted Answer

Number of security incidents caused by human error.. The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

Answer

Percentage of employees who completed the training.

Answer

Average score on post-training tests.

Answer

Time taken to complete the training modules.

Question 14

During a review of the information security program, the security manager discovers that the program's objectives are not aligned with the organization's strategic business goals. What is the best course of action?

Accepted Answer

Revise the program objectives to align with business goals.. The CISM framework emphasizes that an information security program must be directly aligned with the organization's strategic business goals to ensure that security investments support business objectives rather than hinder them. Revising the program objectives to align with business goals (Option B) is the correct course of action because it ensures that security controls, risk appetite, and resource allocation are driven by business needs, not isolated technical requirements. This alignment is a core principle of the Information Security Program domain, as misalignment can lead to wasted resources, reduced executive support, and increased business risk.

Answer

Justify the existing objectives to management to demonstrate their value.

Answer

Implement additional security controls to compensate for the misalignment.

Answer

Escalate the issue to the board of directors without changes.

Question 15

Which of the following are essential components of an information security program governance framework? (Select TWO.)

Accepted Answer

A security steering committee with executive representation.. A security steering committee with executive representation is essential because it provides strategic oversight, aligns security initiatives with business objectives, and ensures resource allocation and governance accountability. This committee typically includes C-level executives who approve security policies, review risk posture, and enforce compliance across the organization.

Answer

A formal risk appetite statement.

Answer

An incident response plan.