CISM Information Security Program Practice Test 5 — 15 Questions

Question 1

Which of the following best describes the primary purpose of an information security program?

Accepted Answer

To manage security risks in alignment with business strategy. The primary purpose of an information security program is to manage security risks in alignment with business strategy, ensuring that security controls and investments support organizational objectives while balancing risk acceptance, mitigation, transfer, and avoidance. This aligns with the CISM framework, which emphasizes that security is a business enabler, not a technical silo. A program that fails to align with business strategy may over-prioritize technical controls, leading to wasted resources or misaligned risk tolerance levels.

Answer

To ensure 100% system availability

Answer

To eliminate all security risks

Answer

To achieve compliance with all applicable regulations

Question 2

Which TWO of the following are essential components of a security program governance structure?

Accepted Answer

Security charter. Options A and C are correct. A security charter establishes the authority and scope of the security program, forming a foundational governance document. A security steering committee provides oversight and strategic direction, ensuring alignment with business objectives. Option B (vulnerability scanning schedule) is an operational activity, not part of governance. Option D (incident response plan) is an operational plan, not a governance component. Option E (help desk ticketing system) is a tool for operational support, not governance.

Answer

Vulnerability scanning schedule

Answer

Incident response plan

Answer

Help desk ticketing system

Question 3

Which TWO of the following are key performance indicators (KPIs) that demonstrate the effectiveness of a security awareness program?

Accepted Answer

Percentage of employees who correctly identify a phishing email in simulations. The percentage of employees who correctly identify a phishing email in simulations directly measures the behavioral outcome of the awareness program. A high detection rate indicates that employees are applying the training to recognize social engineering tactics, such as spoofed sender addresses or malicious links, which is a key performance indicator (KPI) for program effectiveness.

Answer

Number of employees who report suspicious emails

Answer

Frequency of phishing simulation tests

Answer

Number of training sessions completed per quarter

Question 4

Which THREE of the following are typically included in an information security program budget?

Accepted Answer

Incident response retainer. Options A, B, and C are correct as they are common line items in an information security program budget. Incident response retainers cover external support for security incidents, security awareness training materials are essential for educating employees, and vulnerability assessment tools are used to identify weaknesses. Option D (marketing) is not a security cost, and Option E (employee salaries) is typically part of operational budgets, not the specific security program budget.

Answer

Marketing and advertising campaigns

Answer

Employee salaries

Question 5

An auditor reviews the BYOD policy and notes that mobile device management (MDM) logs show several devices without encryption. The policy has been in effect for 6 months. Which of the following is the most likely reason for this non-compliance?

Accepted Answer

MDM is not configured to enforce encryption automatically. MDM systems can enforce encryption policies automatically by requiring devices to comply before granting access to corporate resources. If the MDM is not configured to enforce encryption, devices will remain non-compliant even if the policy requires encryption. The logs showing several devices without encryption after six months strongly indicate that the MDM is not actively enforcing the encryption requirement, making D the most likely reason.

Answer

The grace period allows non-compliance for 7 days

Answer

Employees are unaware of the encryption requirement

Answer

The policy does not explicitly require encryption

Question 6

The security analyst reviews the SIEM alert and finds that the source IP is from a trusted VPN broker used by remote employees. What is the most likely explanation for the alert?

Accepted Answer

An attacker has compromised a remote employee's device and is brute-forcing the admin account. A trusted VPN broker IP address in a SIEM alert for brute-force attempts against an admin account strongly indicates that an attacker has compromised a remote employee's device and is using the established VPN tunnel to launch the attack. The VPN broker itself is not misconfigured; rather, the attacker is leveraging the legitimate VPN connection to bypass perimeter defenses and target internal systems, making the alert a valid security incident.

Answer

The VPN broker itself is misconfigured

Answer

A legitimate user forgot their password

Answer

The alert is a false positive due to SIEM rule threshold

Question 7

Based on the risk register entry, what is the primary gap in the current controls?

Accepted Answer

The policy exists but is not enforced technically. The risk register entry indicates that a mobile device management (MDM) policy exists but is not enforced through technical controls, such as device compliance checks or automated policy application. This creates a gap because the policy remains a paper-based directive without active enforcement mechanisms like certificate-based authentication or conditional access rules, leaving devices vulnerable to non-compliance and potential data breaches.

Answer

MDM is not a suitable control

Answer

The risk score is too low to require action

Answer

The likelihood of occurrence is low

Question 8

A small business is developing its first information security program. Which approach is most effective?

Accepted Answer

Conduct a risk assessment to identify key assets and threats.. Conducting a risk assessment (Option C) is the foundational step in building an information security program because it identifies the specific assets, threats, vulnerabilities, and impacts unique to the small business. Without this context, any controls or frameworks applied would be misaligned with the actual risk profile, leading to wasted resources and potential security gaps. The CISM framework emphasizes that risk assessment drives the selection of cost-effective, prioritized controls tailored to the organization's needs.

Answer

Hire an external security consultant to design the entire program.

Answer

Adopt a comprehensive framework like ISO 27001 immediately.

Answer

Purchase and deploy a next-generation firewall.

Question 9

An organization's security program has been in place for two years, but recently several security incidents occurred due to lack of user awareness. What is the most likely root cause?

Accepted Answer

The awareness program is not regularly updated or evaluated for effectiveness.. The scenario states the security program has been in place for two years, yet incidents persist due to lack of user awareness. This indicates the awareness program exists but is not being regularly updated or evaluated for effectiveness, which is a common root cause in mature programs where content becomes stale and fails to address evolving threats like phishing or social engineering.

Answer

Lack of a security awareness program.

Answer

Insufficient budget for security tools.

Answer

Insufficient firewall rules.

Question 10

A multinational corporation is designing a global information security program. Which governance structure best ensures consistent security while allowing regional flexibility?

Accepted Answer

Federated governance: global standards with local implementation and oversight.. Federated governance (Option C) is the correct choice because it establishes a global security framework with mandatory standards (e.g., ISO 27001 controls, encryption baselines like AES-256) while delegating implementation and oversight to regional units. This structure balances consistency with local legal requirements (e.g., GDPR in Europe, PIPL in China) and operational needs, avoiding the rigidity of full centralization or the fragmentation of full decentralization.

Answer

Outsource security governance to a managed security service provider (MSSP).

Answer

Fully centralized security governance with global standards enforced uniformly.

Answer

Fully decentralized security governance, each region independent.

Question 11

Which of the following is the primary purpose of an information security program?

Accepted Answer

Protect the confidentiality, integrity, and availability of information assets.. The primary purpose of an information security program is to safeguard the confidentiality, integrity, and availability (CIA) of information assets. This aligns with the core definition of information security as defined in standards like ISO/IEC 27001 and NIST SP 800-53, which frame security controls around protecting these three attributes. A program must be risk-based and business-aligned, not just a collection of tools or compliance checklists.

Answer

Implement firewalls and antivirus software.

Answer

Achieve compliance with regulations only.

Answer

Eliminate all security risks.

Question 12

A security manager is tasked with building a business case for a new security program. Which metric is most persuasive to senior management?

Accepted Answer

Estimated financial exposure from unmitigated risks.. Senior management is primarily concerned with financial impact and risk exposure. Estimated financial exposure from unmitigated risks directly translates technical vulnerabilities into monetary terms, enabling informed budget decisions. This aligns with the CISM focus on aligning security programs with business objectives.

Answer

Number of security incidents detected per month.

Answer

Percentage of systems patched within 30 days.

Answer

Hours spent on security training.

Question 13

After a data breach, the CISO reviews the security program. The breach exploited a known vulnerability in a legacy system that was deemed 'acceptable risk' two years ago. What should the CISO do to improve the program?

Accepted Answer

Implement a process for periodic reassessment of accepted risks.. Risk acceptance is not a one-time decision; it must be periodically reassessed to account for changes in the threat landscape, business context, or compensating controls. The breach exploited a known vulnerability that was accepted two years ago, indicating the risk environment has shifted (e.g., new exploit code, increased attacker interest). Implementing a periodic reassessment process ensures that accepted risks are re-evaluated against current threats and vulnerabilities, allowing the organization to either renew acceptance, apply mitigations, or retire the system.

Answer

Establish a policy that legacy systems must be upgraded annually.

Answer

Disconnect the legacy system from the network immediately.

Answer

Require immediate remediation of all legacy systems.

Question 14

An organization wants to ensure that its security program aligns with business objectives. Which activity is most important?

Accepted Answer

Regularly meeting with business unit leaders to understand needs and risks.. Regularly meeting with business unit leaders to understand needs and risks is the most important activity because it ensures the security program is directly aligned with business objectives, risk appetite, and operational priorities. This engagement allows the CISO to perform a business impact analysis (BIA) and integrate security controls that support strategic goals rather than operating in isolation. Without this alignment, even technically sound security measures may be rejected or underfunded by leadership.

Answer

Conducting vulnerability scans twice a year.

Answer

Developing a security awareness campaign.

Answer

Purchasing an advanced threat detection system.

Question 15

A company's security program includes a set of controls based on a risk assessment. During an audit, several controls are found to be ineffective. What should the security manager do first?

Accepted Answer

Conduct a root cause analysis to determine why controls failed.. When controls are found ineffective, the security manager must first conduct a root cause analysis to identify why the controls failed. This aligns with the CISM's emphasis on corrective action based on understanding the underlying failure, such as misconfigured firewall rules, outdated signature databases, or improper access control lists (ACLs). Without this analysis, any subsequent remediation (like implementing compensating controls or increasing testing frequency) may address symptoms rather than the actual cause, leading to recurring failures.

Answer

Increase the frequency of control testing.

Answer

Report the findings to management and accept the risk.

Answer

Implement compensating controls immediately.