CISM Information Security Program Practice Test 8 — 15 Questions

Question 1

An organization's security program includes a set of metrics reported quarterly to the board. Which metric best demonstrates the effectiveness of the security awareness program?

Accepted Answer

Reduction in phishing click-through rate. The phishing click-through rate directly measures behavioral change—the primary goal of security awareness training. A sustained reduction indicates that employees are applying training to recognize and avoid phishing attempts, which is a more valid effectiveness metric than completion rates or lagging indicators like incidents or violations.

Answer

Percentage of employees who completed training

Answer

Number of security incidents

Answer

Number of policy violations

Question 2

A large financial institution is updating its information security program to align with a new regulatory framework. The program currently has a decentralized governance model. Which of the following is the MOST significant risk of maintaining a decentralized model?

Accepted Answer

Inconsistent security levels across business units. In a decentralized governance model, each business unit may implement its own security controls, leading to inconsistent security levels across the organization. This is the most significant risk because it creates gaps and vulnerabilities that can be exploited, especially in a regulated financial institution. While other risks exist, inconsistency directly undermines the overall security posture.

Answer

Slower incident response

Answer

Higher cost of compliance

Answer

Duplication of controls

Question 3

Which of the following is the PRIMARY purpose of a security program's key performance indicators (KPIs)?

Accepted Answer

To measure the effectiveness of security controls. KPIs are designed to provide measurable evidence of how well the security program is achieving its objectives, specifically by quantifying the effectiveness of security controls. For example, a KPI like 'mean time to detect (MTTD)' directly measures the performance of detection controls, enabling data-driven decisions on control improvements. This aligns with the CISM focus on governance and performance management, not just compliance or budgeting.

Answer

To ensure compliance with regulations

Answer

To assign accountability to individuals

Answer

To track the budget for security initiatives

Question 4

An organization has implemented a new security policy requiring multi-factor authentication for all remote access. Several users complain about the inconvenience. What is the BEST course of action for the security manager?

Accepted Answer

Provide training on the importance of MFA. Providing training helps users understand the necessity of MFA for security, addressing their concerns and gaining buy-in. Allowing exceptions (A) weakens security, delaying implementation (B) postpones protection, and revoking access (C) is too punitive as a first step.

Answer

Allow exceptions for senior executives

Answer

Delay implementation until user acceptance improves

Answer

Revoke remote access for non-compliant users

Question 5

An organization wants to ensure its information security program is aligned with business objectives. Which of the following is the BEST approach?

Accepted Answer

Involve business stakeholders in the security steering committee. Involving business stakeholders in the security steering committee ensures that security initiatives are directly aligned with business objectives, as stakeholders provide input on risk tolerance, regulatory requirements, and strategic goals. This collaborative governance model allows the security program to prioritize resources and controls based on business impact, rather than operating in isolation. It is the most effective approach because it integrates security decision-making with business planning, which is a core principle of the CISM framework.

Answer

Implement a security incident response plan

Answer

Perform regular vulnerability scans

Answer

Conduct annual security awareness training

Question 6

A security manager is designing a metrics dashboard for executive management. Which of the following metrics is MOST useful for demonstrating the value of the security program?

Accepted Answer

Mean time to detect incidents. Mean time to detect (MTTD) incidents directly measures how quickly the security program identifies threats, which is a core outcome executives care about — reduced exposure window and improved resilience. It demonstrates program effectiveness in a business-relevant way rather than just activity or spend.

Answer

Percentage of budget spent on security

Answer

Number of security patches applied

Answer

Number of security policies created

Question 7

During a merger, the acquiring company's security program must integrate with the target company's program. What is the HIGHEST priority action?

Accepted Answer

Conduct a comprehensive risk assessment of the target. Conducting a comprehensive risk assessment of the target company is the highest priority because it identifies vulnerabilities, gaps, and threats that must be understood before any integration decisions are made. Without this assessment, consolidating tools, merging teams, or standardizing policies could introduce unacceptable risk or overlook critical exposures. Risk assessment informs all subsequent integration actions and ensures the acquiring company's security posture is not weakened.

Answer

Consolidate all security tools

Answer

Merge the security teams into one reporting structure

Answer

Standardize security policies immediately

Question 8

An information security program must include elements to ensure continuous improvement. Which TWO of the following are MOST essential for continuous improvement?

Accepted Answer

Annual risk assessment. Annual risk assessments are essential for continuous improvement because they systematically identify, evaluate, and prioritize changes in the threat landscape, business objectives, and regulatory requirements. This process ensures the information security program adapts to new risks and aligns with organizational goals, driving iterative enhancements. Without a periodic risk assessment, the program would lack a data-driven foundation for prioritizing improvements.

Answer

Quarterly board meetings

Answer

Monthly patching

Answer

Regular security awareness training

Question 9

A company is implementing a new security program. The CISO wants to ensure alignment with business objectives. Which approach is best?

Accepted Answer

Use the COBIT framework. The COBIT framework (Control Objectives for Information and Related Technologies) is specifically designed to bridge the gap between IT governance and business goals, providing a comprehensive set of controls and processes that align security program objectives with enterprise strategy. Unlike other options, COBIT directly addresses governance, risk management, and performance measurement in a way that ensures the security program supports business objectives rather than operating in isolation.

Answer

Implement technical controls

Answer

Develop policies based on industry standards

Answer

Perform a risk assessment

Question 10

Which metric is most indicative of security program effectiveness?

Accepted Answer

Time to patch critical vulnerabilities. Time to patch critical vulnerabilities directly reflects the organization's ability to reduce exposure to known exploits, which is a key outcome of an effective security program. Unlike input metrics (budget, tools) or lagging indicators (incident count), this metric measures the speed of a critical risk-reduction process, aligning with CISM's focus on program governance and risk management.

Answer

Security budget spent

Answer

Number of security tools deployed

Answer

Number of security incidents

Question 11

A multinational organization needs to comply with GDPR and CCPA. What is the best approach for the information security program?

Accepted Answer

Implement a unified privacy framework covering all regulations. A unified privacy framework (e.g., ISO/IEC 27701 or NIST Privacy Framework) allows the organization to map overlapping requirements from GDPR and CCPA into a single set of controls, reducing duplication and ensuring consistent data protection across jurisdictions. This approach leverages common principles like data minimization, consent management, and breach notification, which are foundational to both regulations, while accommodating specific differences such as GDPR's 72-hour breach notification versus CCPA's broader definition of personal information.

Answer

Adopt the most restrictive requirements from any regulation

Answer

Outsource compliance to a third-party provider

Answer

Create separate security programs for each region

Question 12

During a security audit, several deviations from policy are found. What should the security manager do first?

Accepted Answer

Investigate the root cause of the deviations. The security manager must first investigate the root cause of the deviations to understand why the policy was not followed. This aligns with the corrective action phase of the incident response lifecycle, where identifying the underlying issue (e.g., misconfigured access controls, lack of awareness, or technical gaps) is essential before implementing any remediation. Without root cause analysis, subsequent actions like policy updates or disciplinary measures may address symptoms rather than the actual problem, leading to recurring non-compliance.

Answer

Accept the risk and move on

Answer

Update the policies immediately

Answer

Take disciplinary action against responsible employees

Question 13

Which is a key component of an information security program?

Accepted Answer

Security policy. A security policy is the foundational component of an information security program because it defines the organization's strategic direction, governance structure, and high-level principles for protecting information assets. Unlike specific technologies (encryption, firewalls, antivirus), the policy establishes the rules, roles, and responsibilities that drive the selection and implementation of all security controls. Without a policy, technical measures lack context, authority, and alignment with business objectives.

Answer

Encryption technology

Answer

Firewall

Answer

Antivirus software

Question 14

A security program lacks executive support. What is the best strategy to gain support?

Accepted Answer

Show risk quantification in business terms. C is correct because executive stakeholders prioritize business outcomes over technical details. By quantifying risks in financial terms (e.g., potential loss exposure, ROI of mitigation), the security manager aligns with the organization's strategic language, making the case for investment compelling and actionable. This approach directly addresses the root cause—lack of perceived business value—rather than relying on technical arguments or fear.

Answer

Hire a security consultant to advise

Answer

Implement quick-win security improvements

Answer

Threaten regulatory fines for non-compliance

Question 15

Which document should be reviewed and updated at least annually?

Accepted Answer

Incident response plan. The incident response plan is a living document that must be reviewed and updated at least annually to reflect changes in the organization's environment, threat landscape, and lessons learned from incidents. Regular updates ensure that contact information, escalation procedures, and response strategies remain current and effective. This annual review is a core requirement of frameworks like NIST SP 800-61 and ISO 27001.

Answer

Vendor contracts

Answer

Network topology diagram

Answer

User manuals