CISM Information Security Program Practice Test 7 — 15 Questions

Question 1

Which THREE characteristics indicate a higher maturity level in a security program maturity model?

Accepted Answer

Continuous improvement. Continuous improvement (B) is a hallmark of higher maturity because it indicates the security program systematically evaluates and enhances its processes based on lessons learned, shifting from static compliance to adaptive risk management. In CISM terms, this aligns with the 'Optimizing' level (Level 5) in the Capability Maturity Model (CMM), where feedback loops drive iterative refinement of controls and policies.

Answer

Reactive approach to incidents

Answer

Ad hoc processes

Question 2

Refer to the exhibit. The dashboard shows the incident response plan test is overdue. What is the MOST immediate risk?

Accepted Answer

Increased likelihood of a successful breach due to untested procedures. An untested incident response plan may have invalidated or outdated procedures, increasing the likelihood that a real incident will succeed due to ineffective response. Option A is wrong: loss of cyber insurance coverage is a potential consequence but not the most immediate risk—testing overdue does not instantly void coverage. Option B is wrong: regulatory fines may follow non-compliance, but the immediate operational risk is higher. Option C is wrong: extended recovery time is a possible outcome, but the primary immediate risk is the increased chance of a successful breach.

Answer

Loss of cyber insurance coverage

Answer

Regulatory fines for non-compliance with testing requirements

Answer

Extended recovery time during an incident

Question 3

Refer to the exhibit. An audit reveals that 20% of privileged accounts were approved by the same manager without secondary review. Which control deficiency is MOST relevant to this finding?

Accepted Answer

Segregation of duties. The finding that 20% of privileged accounts were approved by the same manager without secondary review directly violates the principle of segregation of duties (SoD). In privileged access management (PAM), SoD requires that the approval of privileged account access be performed by a different individual than the requester or the manager who supervises the requester, to prevent a single point of failure and reduce the risk of unauthorized access or fraud. Without a secondary review, a single manager could approve accounts for themselves or their subordinates without independent oversight, undermining the control objective of preventing conflicts of interest.

Answer

Access review frequency

Answer

Provisioning delay

Answer

Audit log retention

Question 4

Refer to the exhibit. The CISO wants to improve the program. Which recommendation BEST addresses the main gap shown in the dashboard?

Accepted Answer

Implement automated patching for high-risk vulnerabilities. The dashboard shows high-risk vulnerability remediation at 88%, which is below the target. Implementing automated patching for high-risk vulnerabilities would directly address this gap by ensuring faster and more consistent remediation. Option B is incorrect because reducing the compliance target does not fix the underlying issue. Option C is incorrect because critical vulnerability remediation is already high. Option D is incorrect because increasing patch frequency for all systems may not specifically target the high-risk vulnerability gap.

Answer

Reduce the compliance target for high-risk vulnerabilities to 90 days

Answer

Focus on critical vulnerability remediation

Answer

Increase patch frequency for all systems

Question 5

A security manager is developing a new information security program for a mid-sized company. Which of the following should be the FIRST step?

Accepted Answer

Conduct a risk assessment. Conducting a risk assessment is the foundational first step in developing an information security program because it identifies and prioritizes the specific threats, vulnerabilities, and business impacts that the program must address. Without a risk assessment, any subsequent policies, controls, or tools would be based on assumptions rather than the organization's actual risk profile, leading to misallocated resources and ineffective security. This aligns with the CISM framework, which emphasizes that risk management drives the entire security program lifecycle.

Answer

Implement technical controls

Answer

Purchase security tools

Answer

Develop security policies

Question 6

An organization's security program includes a set of metrics reported quarterly to the board. Which metric best demonstrates the effectiveness of the security awareness program?

Accepted Answer

Reduction in phishing click-through rate. The phishing click-through rate directly measures behavioral change—the primary goal of security awareness training. A sustained reduction indicates that employees are applying training to recognize and avoid phishing attempts, which is a more valid effectiveness metric than completion rates or lagging indicators like incidents or violations.

Answer

Percentage of employees who completed training

Answer

Number of security incidents

Answer

Number of policy violations

Question 7

A large financial institution is updating its information security program to align with a new regulatory framework. The program currently has a decentralized governance model. Which of the following is the MOST significant risk of maintaining a decentralized model?

Accepted Answer

Inconsistent security levels across business units. Decentralized governance leads to inconsistent security levels across business units, which is a major regulatory and risk concern. Option A is possible but less critical. Option C may increase but is a consequence. Option D may be slower but inconsistent security is more fundamental.

Answer

Slower incident response

Answer

Higher cost of compliance

Answer

Duplication of controls

Question 8

Which of the following is the PRIMARY purpose of a security program's key performance indicators (KPIs)?

Accepted Answer

To measure the effectiveness of security controls. KPIs are designed to provide measurable evidence of how well the security program is achieving its objectives, specifically by quantifying the effectiveness of security controls. For example, a KPI like 'mean time to detect (MTTD)' directly measures the performance of detection controls, enabling data-driven decisions on control improvements. This aligns with the CISM focus on governance and performance management, not just compliance or budgeting.

Answer

To ensure compliance with regulations

Answer

To assign accountability to individuals

Answer

To track the budget for security initiatives

Question 9

An organization has implemented a new security policy requiring multi-factor authentication for all remote access. Several users complain about the inconvenience. What is the BEST course of action for the security manager?

Accepted Answer

Provide training on the importance of MFA. Providing training helps users understand the necessity of MFA for security, addressing their concerns and gaining buy-in. Allowing exceptions (A) weakens security, delaying implementation (B) postpones protection, and revoking access (C) is too punitive as a first step.

Answer

Allow exceptions for senior executives

Answer

Delay implementation until user acceptance improves

Answer

Revoke remote access for non-compliant users

Question 10

A security program manager is reviewing the results of a recent internal audit that identified several security gaps. The manager must prioritize remediation efforts. Which factor should be given the MOST weight?

Accepted Answer

Business impact of the vulnerability. In the context of information security program management, the primary driver for prioritizing remediation efforts is the business impact of the vulnerability. While likelihood, compensating controls, and cost are relevant factors, the CISM framework emphasizes that risk is ultimately a function of impact. A vulnerability with high business impact—such as one affecting a critical financial transaction system or protected health information (PHI)—demands immediate attention regardless of its exploitation likelihood, because the potential damage to revenue, compliance, and reputation is unacceptable.

Answer

Likelihood of exploitation

Answer

Availability of compensating controls

Answer

Cost of remediation

Question 11

An organization wants to ensure its information security program is aligned with business objectives. Which of the following is the BEST approach?

Accepted Answer

Involve business stakeholders in the security steering committee. Involving business stakeholders in the security steering committee ensures that security initiatives are directly aligned with business objectives, as stakeholders provide input on risk tolerance, regulatory requirements, and strategic goals. This collaborative governance model allows the security program to prioritize resources and controls based on business impact, rather than operating in isolation. It is the most effective approach because it integrates security decision-making with business planning, which is a core principle of the CISM framework.

Answer

Implement a security incident response plan

Answer

Perform regular vulnerability scans

Answer

Conduct annual security awareness training

Question 12

A security manager is designing a metrics dashboard for executive management. Which of the following metrics is MOST useful for demonstrating the value of the security program?

Accepted Answer

Mean time to detect incidents. Mean time to detect (MTTD) incidents is a direct measure of the security program's effectiveness in identifying threats, which demonstrates its value by showing how quickly the organization can respond to potential breaches. Metrics like budget percentage (A), patches applied (B), or policies created (C) are operational or input-focused and do not reflect the program's outcome or business impact.

Answer

Percentage of budget spent on security

Answer

Number of security patches applied

Answer

Number of security policies created

Question 13

During a merger, the acquiring company's security program must integrate with the target company's program. What is the HIGHEST priority action?

Accepted Answer

Conduct a comprehensive risk assessment of the target. A comprehensive risk assessment of the target company's environment identifies integration risks and informs the integration plan. Option A is premature without understanding risks. Option C and D are tactical steps that should follow risk assessment.

Answer

Consolidate all security tools

Answer

Merge the security teams into one reporting structure

Answer

Standardize security policies immediately

Question 14

A security program manager is selecting metrics to report to the board. Which THREE metrics provide the BEST indication of the program's effectiveness?

Accepted Answer

Percentage of systems compliant with baseline. Percentage of systems compliant with baseline (Option C) directly measures the organization's adherence to security configuration standards, which is a leading indicator of control effectiveness. A high compliance rate reduces the attack surface and demonstrates that foundational security controls are properly implemented, making it a key metric for board-level reporting on program success.

Answer

Number of security incidents

Answer

Budget spent on security tools

Question 15

When establishing an information security program, which TWO of the following are key components of governance?

Accepted Answer

Steering committee. A steering committee is a key governance component because it provides executive oversight, strategic direction, and resource allocation for the information security program. It ensures that security initiatives align with business objectives and that decisions are made at the appropriate authority level, which is essential for effective governance.

Answer

Security awareness training

Answer

Vulnerability management

Answer

Incident response plan