CISM Information Security Program Practice Test 6 — 15 Questions

Question 1

A security program includes multiple metrics. Which metric best indicates the program's effectiveness in reducing overall risk?

Accepted Answer

Composite risk score based on threat, vulnerability, and control assessments.. A composite risk score aggregates threat, vulnerability, and control assessment data into a single metric that directly reflects the organization's residual risk posture. This metric is the most holistic indicator of program effectiveness because it quantifies how well security controls reduce the likelihood and impact of threats exploiting vulnerabilities, aligning with the CISM focus on risk management.

Answer

Number of security incidents per quarter.

Answer

Mean time to detect (MTTD) incidents.

Answer

Percentage of employees who completed security training.

Question 2

Which THREE of the following are critical success factors for implementing an information security program?

Accepted Answer

Risk-based approach to prioritize controls.. A risk-based approach (B) is critical because it ensures that security controls are prioritized based on the actual threats and vulnerabilities facing the organization, rather than applying controls uniformly. This aligns resources with the highest risks, optimizing the cost-benefit ratio of the security program and directly supporting business resilience.

Answer

Compliance as the primary driver.

Answer

Deployment of the latest security technology.

Question 3

Based on the exhibit, which of the following is true about traffic from the internet to the internal network 10.0.0.0/8?

Accepted Answer

All traffic from the internet to the internal network is denied.. The exhibit shows an access control list (ACL) that denies all traffic from any source to the 10.0.0.0/8 network. Since the ACL is applied inbound on the internet-facing interface, any traffic originating from the internet destined for the internal network 10.0.0.0/8 is implicitly denied by the explicit deny statement. Therefore, option B is correct: all traffic from the internet to the internal network is denied.

Answer

Internet traffic to 10.0.0.5 is permitted only if from 192.168.1.0/24.

Answer

Traffic from the internet to 10.0.0.5 port 80 is permitted.

Answer

Traffic from 192.168.1.0/24 to 10.0.0.5 port 80 is permitted.

Question 4

Based on the exhibit, what is the most significant security gap in this configuration?

Accepted Answer

The intrusion detection system is set to alert-only, so it cannot block attacks.. The intrusion detection system (IDS) is configured in alert-only mode, meaning it can only generate alerts and cannot take action to block or drop malicious traffic. This is a significant security gap because, unlike an intrusion prevention system (IPS), an IDS operates out-of-band and relies on manual intervention or separate security controls to stop attacks, leaving the network vulnerable during the response delay.

Answer

The vendor baseline is CIS Level 1, which may be too permissive.

Answer

The firewall allows inbound HTTPS from any source to web servers.

Answer

The database port 3306 is exposed to web servers without encryption.

Question 5

Based on the exhibit, what is the most likely vulnerability that an attacker could exploit?

Accepted Answer

An attacker could use SQL injection on the web server to extract data directly from the database via the permitted MySQL traffic.. The exhibit shows that MySQL traffic is permitted from the web server to the database server. An attacker who compromises the web server (e.g., via SQL injection) can use that allowed MySQL connection to extract sensitive data directly from the database, bypassing other network controls. This is a classic example of a trust-based vulnerability where internal database access is not sufficiently restricted.

Answer

An attacker could perform a DDoS attack on the external interface to disrupt email services.

Answer

An attacker could exploit the SMTP service to send spam.

Answer

An attacker could sniff traffic on the DMZ segment to capture LDAP credentials.

Question 6

A company is implementing an information security program. Which of the following is the PRIMARY reason to align the program with business objectives?

Accepted Answer

To gain management buy-in and support. Aligning the information security program with business objectives is primarily aimed at gaining management buy-in and support. When security initiatives are directly tied to business goals, management is more likely to understand their value and provide the necessary resources and authority. Regulatory compliance (A) is a requirement but not the primary reason; technical controls (B) are a means to an end; cost reduction (C) may be a secondary benefit but not the main driver.

Answer

To ensure regulatory compliance

Answer

To improve technical controls

Answer

To reduce overall security costs

Question 7

An organization's security program includes a risk assessment process. Which step should be performed FIRST?

Accepted Answer

Establish the risk assessment context. Establishing the risk assessment context (C) is the first step because it defines the scope, objectives, and criteria for the assessment, ensuring alignment with organizational goals and risk appetite. Without this foundational step, subsequent activities like asset identification or risk calculation lack direction and may produce irrelevant or misleading results. In the CISM framework, context setting precedes all technical analysis to ensure the assessment is meaningful and actionable.

Answer

Identify assets and their value

Answer

Calculate the level of risk

Answer

Determine the likelihood of threats

Question 8

After a data breach, the CISO is updating the incident response plan. Which of the following is MOST critical to include?

Accepted Answer

Communication templates for stakeholders. After a data breach, the incident response plan must prioritize clear, consistent communication to manage stakeholder expectations, regulatory notifications, and legal repercussions. Communication templates ensure that notifications to customers, regulators, and executives are accurate, timely, and compliant with breach notification laws (e.g., GDPR Article 33, state-specific 72-hour requirements). Without predefined templates, the response team risks delays or inconsistent messaging, which can exacerbate reputational damage and legal liability.

Answer

Technical forensic procedures

Answer

Root cause analysis methodology

Answer

Legal hold instructions for data preservation

Question 9

An organization is developing an information security program for a new subsidiary. Which approach BEST ensures that the subsidiary's program complements the parent's?

Accepted Answer

Adopt a recognized international standard such as ISO 27001. Adopting a recognized international standard such as ISO 27001 ensures that the subsidiary's information security program is built on a globally accepted framework, which inherently aligns with the parent's program through common controls, terminology, and audit criteria. This approach provides a structured, risk-based methodology that complements the parent's program without requiring exact replication, which may not fit the subsidiary's unique operational context. ISO 27001's Annex A controls and Plan-Do-Check-Act (PDCA) cycle facilitate interoperability and consistent governance across entities.

Answer

Replicate the parent's policies exactly

Answer

Perform a separate risk assessment for the subsidiary

Answer

Outsource security management to a third party

Question 10

The security team is designing a security awareness program. Which topic should be prioritized FIRST?

Accepted Answer

Phishing recognition and reporting. Phishing is a common initial attack vector, and training users to recognize it can immediately reduce risk. Option B is wrong password policies are important but often covered later. Option C is wrong incident reporting is critical but follows awareness of threats. Option D is wrong data classification is more advanced.

Answer

Password creation and management

Answer

Incident reporting procedures

Answer

Data classification and handling

Question 11

A financial institution's security program must comply with PCI DSS, GDPR, and SOX. Which approach is MOST efficient to manage overlapping compliance requirements?

Accepted Answer

Implement a single control set mapped to all applicable regulations. Implementing a single control set mapped to all applicable regulations (PCI DSS, GDPR, SOX) leverages common controls to satisfy overlapping requirements efficiently. This approach reduces duplication of effort, simplifies audit preparation, and ensures consistent security posture across the organization. For example, access control requirements under PCI DSS 7.1, GDPR Article 32, and SOX Section 404 can be addressed by a unified identity and access management (IAM) policy with role-based access controls (RBAC) and logging.

Answer

Develop three separate control sets for each regulation

Answer

Focus only on the requirements of the strictest regulation

Answer

Engage external auditors to manage compliance for each regulation

Question 12

An organization's security program includes metrics to measure performance. Which metric BEST indicates the effectiveness of the vulnerability management process?

Accepted Answer

Mean time to remediate (MTTR) vulnerabilities. Mean time to remediate (MTTR) directly measures how quickly the organization closes the window of exposure after a vulnerability is identified. A lower MTTR indicates a more effective vulnerability management process because it reduces the risk window, whereas raw counts of vulnerabilities or patches do not reflect the timeliness or completeness of remediation.

Answer

Number of vulnerabilities identified

Answer

Number of patches deployed per month

Answer

Percentage of systems scanned weekly

Question 13

A company has a small security team and limited budget. Which initial investment provides the MOST value for building an effective security program?

Accepted Answer

Conduct security awareness training for all employees. Security awareness training is the most cost-effective initial investment because human error remains the leading cause of security incidents, especially in resource-constrained environments. By educating employees on phishing, social engineering, and safe data handling, the organization reduces the attack surface without requiring expensive tools or specialized staff. This foundational control directly addresses the most common threat vector—user behavior—which automated systems alone cannot fully mitigate.

Answer

Implement an automated policy enforcement system

Answer

Deploy an asset inventory management tool

Answer

Perform a comprehensive penetration test

Question 14

During a security program review, the auditor finds that incident response procedures have not been tested in over two years. What is the MOST significant risk arising from this finding?

Accepted Answer

Ineffective response leading to greater damage during an incident. Untested incident response procedures may be ineffective or outdated, leading to a failed response during an actual incident, which can result in greater damage. This is the most significant risk because it directly impacts the organization's ability to contain and mitigate incidents. Option A (non-compliance) is possible but not the most significant risk. Option B (higher costs) is a secondary consequence. Option C (increased recovery time) is a symptom of ineffective response but not as severe as the potential for greater damage.

Answer

Non-compliance with regulatory requirements

Answer

Higher financial costs due to inefficiencies

Answer

Increased recovery time after an incident

Question 15

Which TWO of the following are primary objectives of a security awareness program?

Accepted Answer

Reduce the number of security incidents. A primary objective of a security awareness program is to reduce the number of security incidents by educating employees on threats like phishing, social engineering, and unsafe practices. By raising awareness, employees are less likely to fall for attacks that could lead to data breaches or malware infections, directly lowering incident frequency.

Answer

Improve password sharing practices

Answer

Increase the security budget

Answer

Ensure compliance with regulations