CISM Information Security Program Practice Test 6 — 15 Questions

Question 1

A company's security program includes a policy that all employees must use strong passwords and change them every 90 days. However, the recent internal audit shows that 60% of employees have passwords that do not meet the strength requirements. What is the most effective corrective action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement technical controls to enforce password strength. The most effective corrective action is to implement technical controls to enforce password strength. This ensures that all passwords meet the policy requirements by preventing users from setting weak passwords. Technical controls are more reliable than manual audits or training because they automatically enforce compliance and reduce the risk of human error.

Answer

Conduct quarterly password audits with manual checks

Answer

Increase the frequency of security awareness training

Answer

Extend the password change interval to 180 days

Question 2

A global e-commerce company is designing its information security program. The CISO wants to implement a defense-in-depth strategy for the web application layer. Which combination of controls best achieves this objective?

Accepted Answer

WAF, input validation, and security logging. Defense-in-depth for the web application layer requires multiple overlapping controls: a WAF filters malicious HTTP traffic, input validation prevents injection attacks at the application layer, and security logging provides detection and forensic capability. Together they address prevention, detection, and response. This combination covers network, application, and monitoring layers.

Answer

SSL/TLS encryption and VPN access

Answer

Web application firewall (WAF) and intrusion detection system (IDS)

Answer

Regular patching and vulnerability scanning

Question 3

An organization has a mature security program but is experiencing an increase in successful social engineering attacks. The incident response team has confirmed that the attacks are bypassing current controls. What should the program manager do first?

Accepted Answer

Conduct a root cause analysis and update risk assessment. A root cause analysis (RCA) is the correct first step because it identifies the specific weaknesses in people, processes, or technology that allowed the social engineering attacks to bypass existing controls. Updating the risk assessment based on RCA findings ensures that remediation efforts are prioritized against actual threats, rather than applying generic fixes. This aligns with the CISM principle that program management decisions must be data-driven and risk-based.

Answer

Implement multi-factor authentication for all systems

Answer

Disable email links and attachments

Answer

Increase the frequency of security awareness training

Question 4

Which TWO of the following are essential components of a security program governance structure?

Accepted Answer

Security charter. A security charter is a foundational governance document that formally authorizes the security program, defines its scope, objectives, and assigns authority and accountability, making it an essential component of the governance structure. A security steering committee provides ongoing oversight, strategic direction, and cross-functional decision-making, which is central to governing a security program. By contrast, a vulnerability scanning schedule is an operational activity, an incident response plan is a tactical/operational document, and a help desk ticketing system is an operational tool—none of these establish the authority, oversight, or accountability mechanisms that define governance.

Answer

Vulnerability scanning schedule

Answer

Incident response plan

Answer

Help desk ticketing system

Question 5

An auditor reviews the BYOD policy and notes that mobile device management (MDM) logs show several devices without encryption. The policy has been in effect for 6 months. Which of the following is the most likely reason for this non-compliance?

Accepted Answer

MDM is not configured to enforce encryption automatically. MDM systems can enforce encryption policies automatically by requiring devices to comply before granting access to corporate resources. If the MDM is not configured to enforce encryption, devices will remain non-compliant even if the policy requires encryption. The logs showing several devices without encryption after six months strongly indicate that the MDM is not actively enforcing the encryption requirement, making D the most likely reason.

Answer

The grace period allows non-compliance for 7 days

Answer

Employees are unaware of the encryption requirement

Answer

The policy does not explicitly require encryption

Question 6

The security analyst reviews the SIEM alert and finds that the source IP is from a trusted VPN broker used by remote employees. What is the most likely explanation for the alert?

Accepted Answer

An attacker has compromised a remote employee's device and is brute-forcing the admin account. A trusted VPN broker IP address in a SIEM alert for brute-force attempts against an admin account strongly indicates that an attacker has compromised a remote employee's device and is using the established VPN tunnel to launch the attack. The VPN broker itself is not misconfigured; rather, the attacker is leveraging the legitimate VPN connection to bypass perimeter defenses and target internal systems, making the alert a valid security incident.

Answer

The VPN broker itself is misconfigured

Answer

A legitimate user forgot their password

Answer

The alert is a false positive due to SIEM rule threshold

Question 7

Based on the risk register entry, what is the primary gap in the current controls?

Accepted Answer

The policy exists but is not enforced technically. The risk register entry indicates that a mobile device management (MDM) policy exists but is not enforced through technical controls, such as device compliance checks or automated policy application. This creates a gap because the policy remains a paper-based directive without active enforcement mechanisms like certificate-based authentication or conditional access rules, leaving devices vulnerable to non-compliance and potential data breaches.

Answer

MDM is not a suitable control

Answer

The risk score is too low to require action

Answer

The likelihood of occurrence is low

Question 8

A small business is developing its first information security program. Which approach is most effective?

Accepted Answer

Conduct a risk assessment to identify key assets and threats.. Conducting a risk assessment (Option C) is the foundational step in building an information security program because it identifies the specific assets, threats, vulnerabilities, and impacts unique to the small business. Without this context, any controls or frameworks applied would be misaligned with the actual risk profile, leading to wasted resources and potential security gaps. The CISM framework emphasizes that risk assessment drives the selection of cost-effective, prioritized controls tailored to the organization's needs.

Answer

Hire an external security consultant to design the entire program.

Answer

Adopt a comprehensive framework like ISO 27001 immediately.

Answer

Purchase and deploy a next-generation firewall.

Question 9

An organization's security program has been in place for two years, but recently several security incidents occurred due to lack of user awareness. What is the most likely root cause?

Accepted Answer

The awareness program is not regularly updated or evaluated for effectiveness.. The scenario states the security program has been in place for two years, yet incidents persist due to lack of user awareness. This indicates the awareness program exists but is not being regularly updated or evaluated for effectiveness, which is a common root cause in mature programs where content becomes stale and fails to address evolving threats like phishing or social engineering.

Answer

Lack of a security awareness program.

Answer

Insufficient budget for security tools.

Answer

Insufficient firewall rules.

Question 10

A multinational corporation is designing a global information security program. Which governance structure best ensures consistent security while allowing regional flexibility?

Accepted Answer

Federated governance: global standards with local implementation and oversight.. Federated governance (Option C) is the correct choice because it establishes a global security framework with mandatory standards (e.g., ISO 27001 controls, encryption baselines like AES-256) while delegating implementation and oversight to regional units. This structure balances consistency with local legal requirements (e.g., GDPR in Europe, PIPL in China) and operational needs, avoiding the rigidity of full centralization or the fragmentation of full decentralization.

Answer

Outsource security governance to a managed security service provider (MSSP).

Answer

Fully centralized security governance with global standards enforced uniformly.

Answer

Fully decentralized security governance, each region independent.

Question 11

A security manager is tasked with building a business case for a new security program. Which metric is most persuasive to senior management?

Accepted Answer

Estimated financial exposure from unmitigated risks.. Senior management is primarily concerned with financial impact and risk exposure. Estimated financial exposure from unmitigated risks directly translates technical vulnerabilities into monetary terms, enabling informed budget decisions. This aligns with the CISM focus on aligning security programs with business objectives.

Answer

Number of security incidents detected per month.

Answer

Percentage of systems patched within 30 days.

Answer

Hours spent on security training.

Question 12

After a data breach, the CISO reviews the security program. The breach exploited a known vulnerability in a legacy system that was deemed 'acceptable risk' two years ago. What should the CISO do to improve the program?

Accepted Answer

Implement a process for periodic reassessment of accepted risks.. Risk acceptance is not a one-time decision; it must be periodically reassessed to account for changes in the threat landscape, business context, or compensating controls. The breach exploited a known vulnerability that was accepted two years ago, indicating the risk environment has shifted (e.g., new exploit code, increased attacker interest). Implementing a periodic reassessment process ensures that accepted risks are re-evaluated against current threats and vulnerabilities, allowing the organization to either renew acceptance, apply mitigations, or retire the system.

Answer

Establish a policy that legacy systems must be upgraded annually.

Answer

Disconnect the legacy system from the network immediately.

Answer

Require immediate remediation of all legacy systems.

Question 13

An organization wants to ensure that its security program aligns with business objectives. Which activity is most important?

Accepted Answer

Regularly meeting with business unit leaders to understand needs and risks.. Regularly meeting with business unit leaders to understand needs and risks is the most important activity because it ensures the security program is directly aligned with business objectives, risk appetite, and operational priorities. This engagement allows the CISO to perform a business impact analysis (BIA) and integrate security controls that support strategic goals rather than operating in isolation. Without this alignment, even technically sound security measures may be rejected or underfunded by leadership.

Answer

Conducting vulnerability scans twice a year.

Answer

Developing a security awareness campaign.

Answer

Purchasing an advanced threat detection system.

Question 14

A company's security program includes a set of controls based on a risk assessment. During an audit, several controls are found to be ineffective. What should the security manager do first?

Accepted Answer

Conduct a root cause analysis to determine why controls failed.. When controls are found ineffective, the security manager must first conduct a root cause analysis to identify why the controls failed. This aligns with the CISM's emphasis on corrective action based on understanding the underlying failure, such as misconfigured firewall rules, outdated signature databases, or improper access control lists (ACLs). Without this analysis, any subsequent remediation (like implementing compensating controls or increasing testing frequency) may address symptoms rather than the actual cause, leading to recurring failures.

Answer

Increase the frequency of control testing.

Answer

Report the findings to management and accept the risk.

Answer

Implement compensating controls immediately.

Question 15

A security program includes multiple metrics. Which metric best indicates the program's effectiveness in reducing overall risk?

Accepted Answer

Composite risk score based on threat, vulnerability, and control assessments.. A composite risk score aggregates threat, vulnerability, and control assessment data into a single metric that directly reflects the organization's residual risk posture. This metric is the most holistic indicator of program effectiveness because it quantifies how well security controls reduce the likelihood and impact of threats exploiting vulnerabilities, aligning with the CISM focus on risk management.

Answer

Number of security incidents per quarter.

Answer

Mean time to detect (MTTD) incidents.

Answer

Percentage of employees who completed security training.