CISM Information Security Program Practice Test 7 — 15 Questions

Question 1

Which TWO of the following are essential components of an information security program charter?

Accepted Answer

Roles and responsibilities of key stakeholders.. The information security program charter is a high-level document that establishes the authority, scope, and governance of the security program. Roles and responsibilities of key stakeholders (Option B) are essential because they define accountability and decision-making authority, ensuring the program has clear ownership and oversight. Program scope and objectives (Option D) are equally essential as they set the boundaries and goals of the security program, aligning it with business strategy and risk appetite.

Answer

List of specific security tools to be deployed.

Answer

Vendor selection criteria.

Answer

Detailed budget allocation.

Question 2

Which THREE of the following are key performance indicators (KPIs) for an information security program?

Accepted Answer

Number of security awareness training completions per quarter.. The number of security awareness training completions per quarter directly measures the reach and effectiveness of the human-centric security program, which is a key driver for reducing phishing and social engineering risks. This KPI aligns with the NIST SP 800-50 framework for security awareness and training metrics, as it tracks behavioral adoption rather than just policy existence.

Answer

Total number of security staff.

Answer

Average number of firewall rules per device.

Question 3

Based on the exhibit, which of the following is true about traffic from the internet to the internal network 10.0.0.0/8?

Accepted Answer

All traffic from the internet to the internal network is denied.. The exhibit shows an access control list (ACL) that denies all traffic from any source to the 10.0.0.0/8 network. Since the ACL is applied inbound on the internet-facing interface, any traffic originating from the internet destined for the internal network 10.0.0.0/8 is implicitly denied by the explicit deny statement. Therefore, option B is correct: all traffic from the internet to the internal network is denied.

Answer

Internet traffic to 10.0.0.5 is permitted only if from 192.168.1.0/24.

Answer

Traffic from the internet to 10.0.0.5 port 80 is permitted.

Answer

Traffic from 192.168.1.0/24 to 10.0.0.5 port 80 is permitted.

Question 4

Based on the exhibit, what is the most significant security gap in this configuration?

Accepted Answer

The intrusion detection system is set to alert-only, so it cannot block attacks.. The intrusion detection system (IDS) is configured in alert-only mode, meaning it can only generate alerts and cannot take action to block or drop malicious traffic. This is a significant security gap because, unlike an intrusion prevention system (IPS), an IDS operates out-of-band and relies on manual intervention or separate security controls to stop attacks, leaving the network vulnerable during the response delay.

Answer

The vendor baseline is CIS Level 1, which may be too permissive.

Answer

The firewall allows inbound HTTPS from any source to web servers.

Answer

The database port 3306 is exposed to web servers without encryption.

Question 5

An organization's security program includes a risk assessment process. Which step should be performed FIRST?

Accepted Answer

Establish the risk assessment context. Establishing the risk assessment context (C) is the first step because it defines the scope, objectives, and criteria for the assessment, ensuring alignment with organizational goals and risk appetite. Without this foundational step, subsequent activities like asset identification or risk calculation lack direction and may produce irrelevant or misleading results. In the CISM framework, context setting precedes all technical analysis to ensure the assessment is meaningful and actionable.

Answer

Identify assets and their value

Answer

Calculate the level of risk

Answer

Determine the likelihood of threats

Question 6

The security team is designing a security awareness program. Which topic should be prioritized FIRST?

Accepted Answer

Phishing recognition and reporting. Phishing remains the leading initial access vector in real-world breaches, and humans are the primary target. A security awareness program should prioritize phishing recognition and reporting because it directly addresses the most exploited attack surface and produces measurable reductions in successful compromises. Teaching users to spot and report suspicious emails creates a human sensor network that feeds the SOC with early threat intelligence.

Answer

Password creation and management

Answer

Incident reporting procedures

Answer

Data classification and handling

Question 7

A financial institution's security program must comply with PCI DSS, GDPR, and SOX. Which approach is MOST efficient to manage overlapping compliance requirements?

Accepted Answer

Implement a single control set mapped to all applicable regulations. Implementing a single control set mapped to all applicable regulations (PCI DSS, GDPR, SOX) leverages common controls to satisfy overlapping requirements efficiently. This approach reduces duplication of effort, simplifies audit preparation, and ensures consistent security posture across the organization. For example, access control requirements under PCI DSS 7.1, GDPR Article 32, and SOX Section 404 can be addressed by a unified identity and access management (IAM) policy with role-based access controls (RBAC) and logging.

Answer

Develop three separate control sets for each regulation

Answer

Focus only on the requirements of the strictest regulation

Answer

Engage external auditors to manage compliance for each regulation

Question 8

An organization's security program includes metrics to measure performance. Which metric BEST indicates the effectiveness of the vulnerability management process?

Accepted Answer

Mean time to remediate (MTTR) vulnerabilities. Mean time to remediate (MTTR) directly measures how quickly the organization closes the window of exposure after a vulnerability is identified. A lower MTTR indicates a more effective vulnerability management process because it reduces the risk window, whereas raw counts of vulnerabilities or patches do not reflect the timeliness or completeness of remediation.

Answer

Number of vulnerabilities identified

Answer

Number of patches deployed per month

Answer

Percentage of systems scanned weekly

Question 9

A company has a small security team and limited budget. Which initial investment provides the MOST value for building an effective security program?

Accepted Answer

Conduct security awareness training for all employees. Security awareness training is the most cost-effective initial investment because human error remains the leading cause of security incidents, especially in resource-constrained environments. By educating employees on phishing, social engineering, and safe data handling, the organization reduces the attack surface without requiring expensive tools or specialized staff. This foundational control directly addresses the most common threat vector—user behavior—which automated systems alone cannot fully mitigate.

Answer

Implement an automated policy enforcement system

Answer

Deploy an asset inventory management tool

Answer

Perform a comprehensive penetration test

Question 10

During a security program review, the auditor finds that incident response procedures have not been tested in over two years. What is the MOST significant risk arising from this finding?

Accepted Answer

Ineffective response leading to greater damage during an incident. The most significant risk of not testing incident response procedures for over two years is that the response will be ineffective when a real incident occurs, leading to greater damage, longer downtime, and potentially uncontrolled escalation. Untested procedures may contain outdated contacts, incorrect escalation paths, or missing steps, so the organization cannot rely on them. While compliance and cost are concerns, the primary security risk is the inability to contain and recover effectively, which directly increases business impact.

Answer

Non-compliance with regulatory requirements

Answer

Higher financial costs due to inefficiencies

Answer

Increased recovery time after an incident

Question 11

Which TWO of the following are primary objectives of a security awareness program?

Accepted Answer

Reduce the number of security incidents. A primary objective of a security awareness program is to reduce the number of security incidents by educating employees on threats like phishing, social engineering, and unsafe practices. By raising awareness, employees are less likely to fall for attacks that could lead to data breaches or malware infections, directly lowering incident frequency.

Answer

Improve password sharing practices

Answer

Increase the security budget

Answer

Ensure compliance with regulations

Question 12

Which THREE elements are essential for an effective information security governance framework?

Accepted Answer

Clear accountability structure. A clear accountability structure is essential because it defines who is responsible for specific security decisions and actions, ensuring that no critical task falls through the cracks. Without defined roles, security gaps emerge, and incident response becomes chaotic. This aligns with the CISM principle that governance requires unambiguous ownership of security outcomes.

Answer

Free and open-source security tools

Answer

Formal risk appetite statement

Question 13

Which THREE characteristics indicate a higher maturity level in a security program maturity model?

Accepted Answer

Continuous improvement. Continuous improvement (B) is a hallmark of higher maturity because it indicates the security program systematically evaluates and enhances its processes based on lessons learned, shifting from static compliance to adaptive risk management. In CISM terms, this aligns with the 'Optimizing' level (Level 5) in the Capability Maturity Model (CMM), where feedback loops drive iterative refinement of controls and policies.

Answer

Reactive approach to incidents

Answer

Ad hoc processes

Question 14

Refer to the exhibit. An audit reveals that 20% of privileged accounts were approved by the same manager without secondary review. Which control deficiency is MOST relevant to this finding?

Accepted Answer

Segregation of duties. The finding that 20% of privileged accounts were approved by the same manager without secondary review directly violates the principle of segregation of duties (SoD). In privileged access management (PAM), SoD requires that the approval of privileged account access be performed by a different individual than the requester or the manager who supervises the requester, to prevent a single point of failure and reduce the risk of unauthorized access or fraud. Without a secondary review, a single manager could approve accounts for themselves or their subordinates without independent oversight, undermining the control objective of preventing conflicts of interest.

Answer

Access review frequency

Answer

Provisioning delay

Answer

Audit log retention

Question 15

A security manager is developing a new information security program for a mid-sized company. Which of the following should be the FIRST step?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment is the foundational first step in developing an information security program because it identifies and prioritizes the specific threats, vulnerabilities, and business impacts that the program must address. Without a risk assessment, any subsequent policies, controls, or tools would be based on assumptions rather than the organization's actual risk profile, leading to misallocated resources and ineffective security. This aligns with the CISM framework, which emphasizes that risk management drives the entire security program lifecycle.

Answer

Implement technical controls

Answer

Purchase security tools

Answer

Develop security policies