CISM Information Security Program Practice Test 8 — 15 Questions

Question 1

A company is implementing a new security program. The CISO wants to ensure alignment with business objectives. Which approach is best?

Accepted Answer

Use the COBIT framework. The COBIT framework (Control Objectives for Information and Related Technologies) is specifically designed to bridge the gap between IT governance and business goals, providing a comprehensive set of controls and processes that align security program objectives with enterprise strategy. Unlike other options, COBIT directly addresses governance, risk management, and performance measurement in a way that ensures the security program supports business objectives rather than operating in isolation.

Answer

Implement technical controls

Answer

Develop policies based on industry standards

Answer

Perform a risk assessment

Question 2

Which metric is most indicative of security program effectiveness?

Accepted Answer

Time to patch critical vulnerabilities. Time to patch critical vulnerabilities directly reflects the organization's ability to reduce exposure to known exploits, which is a key outcome of an effective security program. Unlike input metrics (budget, tools) or lagging indicators (incident count), this metric measures the speed of a critical risk-reduction process, aligning with CISM's focus on program governance and risk management.

Answer

Security budget spent

Answer

Number of security tools deployed

Answer

Number of security incidents

Question 3

A multinational organization needs to comply with GDPR and CCPA. What is the best approach for the information security program?

Accepted Answer

Implement a unified privacy framework covering all regulations. A unified privacy framework (e.g., ISO/IEC 27701 or NIST Privacy Framework) allows the organization to map overlapping requirements from GDPR and CCPA into a single set of controls, reducing duplication and ensuring consistent data protection across jurisdictions. This approach leverages common principles like data minimization, consent management, and breach notification, which are foundational to both regulations, while accommodating specific differences such as GDPR's 72-hour breach notification versus CCPA's broader definition of personal information.

Answer

Adopt the most restrictive requirements from any regulation

Answer

Outsource compliance to a third-party provider

Answer

Create separate security programs for each region

Question 4

During a security audit, several deviations from policy are found. What should the security manager do first?

Accepted Answer

Investigate the root cause of the deviations. The security manager must first investigate the root cause of the deviations to understand why the policy was not followed. This aligns with the corrective action phase of the incident response lifecycle, where identifying the underlying issue (e.g., misconfigured access controls, lack of awareness, or technical gaps) is essential before implementing any remediation. Without root cause analysis, subsequent actions like policy updates or disciplinary measures may address symptoms rather than the actual problem, leading to recurring non-compliance.

Answer

Accept the risk and move on

Answer

Update the policies immediately

Answer

Take disciplinary action against responsible employees

Question 5

Which is a key component of an information security program?

Accepted Answer

Security policy. A security policy is the foundational component of an information security program because it defines the organization's strategic direction, governance structure, and high-level principles for protecting information assets. Unlike specific technologies (encryption, firewalls, antivirus), the policy establishes the rules, roles, and responsibilities that drive the selection and implementation of all security controls. Without a policy, technical measures lack context, authority, and alignment with business objectives.

Answer

Encryption technology

Answer

Firewall

Answer

Antivirus software

Question 6

A security program lacks executive support. What is the best strategy to gain support?

Accepted Answer

Show risk quantification in business terms. C is correct because executive stakeholders prioritize business outcomes over technical details. By quantifying risks in financial terms (e.g., potential loss exposure, ROI of mitigation), the security manager aligns with the organization's strategic language, making the case for investment compelling and actionable. This approach directly addresses the root cause—lack of perceived business value—rather than relying on technical arguments or fear.

Answer

Hire a security consultant to advise

Answer

Implement quick-win security improvements

Answer

Threaten regulatory fines for non-compliance

Question 7

Which document should be reviewed and updated at least annually?

Accepted Answer

Incident response plan. The incident response plan must be reviewed and updated at least annually to ensure it remains effective against evolving threats and changes in the organization. Option B is correct. Vendor contracts (A), network topology diagrams (C), and user manuals (D) are typically reviewed on a different schedule or as needed, not necessarily annually.

Answer

Vendor contracts

Answer

Network topology diagram

Answer

User manuals

Question 8

An organization has multiple business units with different risk tolerances. How should the security program address this?

Accepted Answer

Develop risk-based security policies for each business unit. A is correct because risk-based security policies allow each business unit to tailor controls to its specific risk appetite, ensuring that high-risk units implement stronger safeguards (e.g., stricter access controls, enhanced logging) while low-risk units avoid unnecessary overhead. This aligns with the CISM principle that security governance must accommodate varying risk tolerances through differentiated policy frameworks rather than a one-size-fits-all approach.

Answer

Apply a single enterprise-wide security policy

Answer

Define a minimum baseline and allow units to exceed it

Answer

Decentralize security management to each unit

Question 9

Which TWO are essential elements of an information security program?

Accepted Answer

Security awareness training. Security awareness training is an essential element of an information security program because it directly addresses the human factor, which is often the weakest link in security. A formal, ongoing training program ensures that employees understand policies, recognize threats like phishing, and follow secure behaviors, thereby reducing risk. Without it, technical controls alone cannot prevent social engineering or user errors, making it a foundational component of any security program.

Answer

Vulnerability scanning tools

Answer

Risk management process

Answer

Network firewall

Question 10

Which THREE are key performance indicators (KPIs) for an information security program?

Accepted Answer

Percentage of employees trained. The percentage of employees trained is a key performance indicator (KPI) because it directly measures the effectiveness of the security awareness program, which is a critical control to reduce human error—the leading cause of breaches. A high training completion rate correlates with lower phishing susceptibility and improved incident reporting, making it a leading indicator of program maturity.

Answer

Number of security incidents

Answer

Budget variance

Question 11

Which THREE are components of the Plan phase in a security program lifecycle (e.g., ISO 27001 PDCA)?

Accepted Answer

Risk assessment. Risk assessment is a core component of the Plan phase in the ISO 27001 PDCA (Plan-Do-Check-Act) security program lifecycle. During this phase, the organization identifies, analyzes, and evaluates information security risks to establish the context, scope, and risk treatment criteria that will guide the selection of controls and objectives. Without a formal risk assessment, the subsequent phases lack a risk-based foundation, making the program reactive rather than proactive.

Answer

Monitoring and review

Answer

Implementation of controls

Question 12

A large healthcare organization recently experienced a ransomware attack that encrypted patient records (ePHI). The attack originated from a phishing email that bypassed the email security gateway. The security program includes annual security awareness training, but post-incident analysis reveals that employees often ignore suspicious emails. The CISO wants to revise the program to reduce the likelihood of similar incidents. Which course of action is most effective?

Accepted Answer

Increase the frequency of phishing simulations and enforce mandatory remedial training for employees who fall for them. Most effective because it directly addresses the human factor by increasing the frequency of phishing simulations and providing remedial training, which reinforces secure behavior. Option A improves technology but does not change employee behavior. Option B (next-generation email security gateway) may help block some phishing emails but does not address the root cause of employees ignoring suspicious emails. Option C (EDR) can detect ransomware after execution but does not prevent the initial phishing compromise.

Answer

Restrict users' ability to receive emails from external domains except from approved senders

Answer

Implement a next-generation email security gateway with AI-based threat detection

Answer

Deploy endpoint detection and response (EDR) on all workstations

Question 13

A multinational organization is establishing an information security program. The Chief Information Security Officer (CISO) wants to ensure the program aligns with business objectives and is accountable to senior management. Which of the following governance structures would best support this goal?

Accepted Answer

An executive steering committee with representatives from business units, legal, and IT meets quarterly to review program status.. An executive steering committee with cross-functional representation (business units, legal, IT) ensures the information security program is aligned with business objectives and provides direct accountability to senior management through regular quarterly reviews. This structure enables strategic oversight, resource allocation, and risk acceptance decisions that tie security initiatives to organizational goals, as recommended by the CISM framework for governance.

Answer

A board-level risk committee oversees the information security program without management involvement.

Answer

The CISO reports to the chief legal officer (CLO).

Answer

The information security function reports directly to the IT operations manager.

Question 14

During a security assessment, an organization discovers that its patch management process is not consistently applied across all systems. Which of the following controls would best address this deficiency as part of the information security program?

Accepted Answer

Implement a configuration management database (CMDB) linked to an automated patch deployment tool.. A configuration management database (CMDB) provides a centralized, authoritative inventory of all IT assets, including their current patch status. Linking the CMDB to an automated patch deployment tool ensures that patches are consistently and systematically applied to all systems based on their configuration records, directly addressing the inconsistency in the patch management process. This control enforces a standardized, repeatable workflow that eliminates reliance on manual, ad-hoc patching.

Answer

Require all system administrators to manually approve patches before deployment.

Answer

Increase the frequency of vulnerability scans to weekly.

Answer

Conduct additional security awareness training for system administrators.

Question 15

An organization has implemented a data classification policy but notices that employees often mark documents as 'internal use only' even when they contain personally identifiable information (PII). Which of the following is the most effective corrective action for the information security program?

Accepted Answer

Deploy a data loss prevention (DLP) system that automatically classifies documents based on content inspection.. Deploying a data loss prevention (DLP) system that automatically classifies documents based on content inspection directly addresses the root cause of misclassification by removing reliance on user judgment. Option A (policy revision) alone does not enforce compliance. Option B (audits and reprimands) is punitive and may not change behavior. Option C (training) can help but is less effective than automation for consistent classification.

Answer

Revise the data classification policy to simplify categories.

Answer

Conduct random audits and reprimand employees who misclassify data.

Answer

Increase the frequency of data classification training for all employees.