CISM Information Security Program Practice Test 9 — 15 Questions

Question 1

An organization has multiple business units with different risk tolerances. How should the security program address this?

Accepted Answer

Develop risk-based security policies for each business unit. A is correct because risk-based security policies allow each business unit to tailor controls to its specific risk appetite, ensuring that high-risk units implement stronger safeguards (e.g., stricter access controls, enhanced logging) while low-risk units avoid unnecessary overhead. This aligns with the CISM principle that security governance must accommodate varying risk tolerances through differentiated policy frameworks rather than a one-size-fits-all approach.

Answer

Apply a single enterprise-wide security policy

Answer

Define a minimum baseline and allow units to exceed it

Answer

Decentralize security management to each unit

Question 2

Which THREE are components of the Plan phase in a security program lifecycle (e.g., ISO 27001 PDCA)?

Accepted Answer

Risk assessment. Risk assessment is a core component of the Plan phase in the ISO 27001 PDCA (Plan-Do-Check-Act) security program lifecycle. During this phase, the organization identifies, analyzes, and evaluates information security risks to establish the context, scope, and risk treatment criteria that will guide the selection of controls and objectives. Without a formal risk assessment, the subsequent phases lack a risk-based foundation, making the program reactive rather than proactive.

Answer

Monitoring and review

Answer

Implementation of controls

Question 3

A large healthcare organization recently experienced a ransomware attack that encrypted patient records (ePHI). The attack originated from a phishing email that bypassed the email security gateway. The security program includes annual security awareness training, but post-incident analysis reveals that employees often ignore suspicious emails. The CISO wants to revise the program to reduce the likelihood of similar incidents. Which course of action is most effective?

Accepted Answer

Increase the frequency of phishing simulations and enforce mandatory remedial training for employees who fall for them. The root cause is human behaviour — employees ignore suspicious emails despite annual training. Increasing the frequency of phishing simulations with mandatory remedial training directly targets that behaviour through continuous reinforcement and consequence, which is the most effective way to reduce click rates. It addresses the actual gap (behaviour) rather than adding more technology layers.

Answer

Restrict users' ability to receive emails from external domains except from approved senders

Answer

Implement a next-generation email security gateway with AI-based threat detection

Answer

Deploy endpoint detection and response (EDR) on all workstations

Question 4

A multinational organization is establishing an information security program. The Chief Information Security Officer (CISO) wants to ensure the program aligns with business objectives and is accountable to senior management. Which of the following governance structures would best support this goal?

Accepted Answer

An executive steering committee with representatives from business units, legal, and IT meets quarterly to review program status.. An executive steering committee with cross-functional representation (business units, legal, IT) ensures the information security program is aligned with business objectives and provides direct accountability to senior management through regular quarterly reviews. This structure enables strategic oversight, resource allocation, and risk acceptance decisions that tie security initiatives to organizational goals, as recommended by the CISM framework for governance.

Answer

A board-level risk committee oversees the information security program without management involvement.

Answer

The CISO reports to the chief legal officer (CLO).

Answer

The information security function reports directly to the IT operations manager.

Question 5

During a security assessment, an organization discovers that its patch management process is not consistently applied across all systems. Which of the following controls would best address this deficiency as part of the information security program?

Accepted Answer

Implement a configuration management database (CMDB) linked to an automated patch deployment tool.. A configuration management database (CMDB) provides a centralized, authoritative inventory of all IT assets, including their current patch status. Linking the CMDB to an automated patch deployment tool ensures that patches are consistently and systematically applied to all systems based on their configuration records, directly addressing the inconsistency in the patch management process. This control enforces a standardized, repeatable workflow that eliminates reliance on manual, ad-hoc patching.

Answer

Require all system administrators to manually approve patches before deployment.

Answer

Increase the frequency of vulnerability scans to weekly.

Answer

Conduct additional security awareness training for system administrators.

Question 6

An organization has implemented a data classification policy but notices that employees often mark documents as 'internal use only' even when they contain personally identifiable information (PII). Which of the following is the most effective corrective action for the information security program?

Accepted Answer

Deploy a data loss prevention (DLP) system that automatically classifies documents based on content inspection.. Deploying a data loss prevention (DLP) system that automatically classifies documents based on content inspection directly addresses the root cause of misclassification by removing reliance on user judgment. Option A (policy revision) alone does not enforce compliance. Option B (audits and reprimands) is punitive and may not change behavior. Option C (training) can help but is less effective than automation for consistent classification.

Answer

Revise the data classification policy to simplify categories.

Answer

Conduct random audits and reprimand employees who misclassify data.

Answer

Increase the frequency of data classification training for all employees.

Question 7

A company is designing its information security program and wants to ensure that it meets regulatory requirements across multiple jurisdictions. Which of the following approaches is most appropriate?

Accepted Answer

Implement a regulatory compliance framework that maps controls to applicable laws and standards.. A regulatory compliance framework that maps controls to applicable laws and standards provides a structured, auditable method to address multiple, sometimes conflicting, jurisdictional requirements. This approach ensures that each control is explicitly linked to a specific legal or regulatory obligation, facilitating compliance verification and reducing the risk of oversight. It is the most comprehensive and adaptable method for a multi-jurisdictional environment, as it allows the organization to manage overlapping and unique requirements without relying on a single standard or external review alone.

Answer

Adopt ISO 27001 as the sole framework for the program.

Answer

Comply with the strictest regulation and ignore others.

Answer

Engage external legal counsel to review policies quarterly.

Question 8

A large financial institution is maturing its information security program and wants to move from a reactive to a proactive posture. Which of the following initiatives would best support this transition?

Accepted Answer

Establish a threat intelligence unit that analyzes adversary tactics and shares indicators across the organization.. Establishing a threat intelligence unit directly supports a proactive posture by enabling the organization to anticipate and prepare for emerging threats based on adversary tactics, techniques, and procedures (TTPs). Unlike reactive measures, this initiative shifts focus from responding to incidents to preventing them by sharing actionable indicators across the enterprise, aligning with the CISM goal of maturing the security program toward proactive risk management.

Answer

Deploy an automated compliance monitoring tool.

Answer

Implement a bug bounty program to uncover vulnerabilities.

Answer

Increase the number of security operations center (SOC) analysts.

Question 9

Which TWO of the following are key performance indicators (KPIs) for measuring the effectiveness of an information security program?

Accepted Answer

Mean time to detect (MTTD) security incidents.. Option B is correct because Mean Time to Detect (MTTD) is a recognized operational security KPI that quantifies how quickly an organization identifies security incidents, directly reflecting the effectiveness of monitoring, SIEM, and detection capabilities. Option D is correct because the percentage of critical systems patched within 30 days is a vulnerability-management KPI that measures how promptly known vulnerabilities are remediated, a core indicator of an information security program's preventive effectiveness. Option A is not a true effectiveness KPI because counting approved policies measures documentation activity, not whether controls actually reduce risk or improve security outcomes. Option C is unrelated to security program performance, as employee satisfaction is an HR metric rather than a security indicator. Option E is a budgeting/spending ratio that describes resource allocation, not the effectiveness of the security program's controls or outcomes.

Answer

Number of security policies approved.

Answer

Employee satisfaction score from annual survey.

Answer

Percentage of security budget spent on tools.

Question 10

Which THREE of the following are common challenges in implementing an information security program across a large enterprise?

Accepted Answer

Cultural resistance to security controls from business units.. Cultural resistance to security controls from business units is a common challenge because security teams must balance risk mitigation with operational efficiency. Business units often perceive controls like mandatory encryption or access restrictions as hindrances to productivity, leading to shadow IT or workarounds that undermine the program's effectiveness.

Answer

Overreliance on automated security tools.

Answer

Lack of security awareness training for end users.

Question 11

You are the CISO of a mid-sized manufacturing company. The company has grown rapidly through acquisitions, and each subsidiary has its own information security program. There is no centralized governance, and recent security incidents have occurred due to inconsistent policies. The board has asked you to create a unified information security program that balances flexibility with control. Each subsidiary has unique operational processes and varying levels of security maturity. You have limited budget and cannot replace all local security teams. Which approach should you take?

Accepted Answer

Develop a minimum security standard (MSS) and a phased implementation roadmap based on risk.. Correct answer is B because developing a minimum security standard (MSS) and a phased implementation roadmap based on risk allows each subsidiary to implement controls based on their unique risk profiles while ensuring a common baseline. This approach balances flexibility with control, respects varying maturity levels, and avoids disruption. Option A (immediate enterprise-wide policy) ignores diverse operational processes and may cause resistance. Option C (centralize all security operations) is costly and impractical given the budget and local teams. Option D (adopt the most mature subsidiary's program) may not fit the context of less mature units.

Answer

Immediately mandate compliance with a new enterprise-wide security policy.

Answer

Centralize all security operations and disband local teams.

Answer

Adopt the most mature subsidiary's program as the enterprise standard.

Question 12

You are the information security program manager at a global financial services firm. The firm has a mature security program, but the CISO is concerned that the program is not keeping pace with emerging threats such as supply chain attacks and advanced persistent threats (APTs). Additionally, the program currently focuses heavily on compliance with regulations (e.g., PCI DSS, GDPR) rather than proactive risk management. The board wants to see a more strategic approach to information security. However, the compliance team is large and influential, and they resist changes that might reduce their role. You have been asked to propose a new program model that addresses these concerns while maintaining regulatory compliance. What should you do?

Accepted Answer

Evolve the program to a risk-based approach that integrates threat intelligence and adapts controls dynamically, while keeping compliance as a baseline.. Evolving the program to a risk-based approach (Option D) integrates threat intelligence and dynamically adapts controls, directly addressing the need for proactive management of emerging threats while maintaining compliance as a baseline. This balances strategic evolution with the compliance team's continued role. Option A (restructuring the compliance team) risks political friction and does not inherently shift to risk management. Option B (expanding compliance coverage) increases focus on compliance, not proactive risk. Option C (increasing awareness training) is too narrow and does not address the program's strategic direction.

Answer

Restructure the compliance team into a risk management function.

Answer

Expand the compliance team to cover more regulations and increase auditing frequency.

Answer

Increase security awareness training across the organization.

Question 13

You are the information security program manager for a government agency. The agency has a highly regulated environment and is in the process of updating its incident response plan. During a tabletop exercise, it becomes clear that the detection capabilities are strong, but the response coordination between IT, legal, and public affairs is poor. This caused delays in containing a simulated ransomware attack. The existing program includes an incident response policy but no formal procedures for cross-department coordination. The agency's leadership wants quick improvement with minimal budget impact. What should you recommend?

Accepted Answer

Develop a detailed incident response coordination plan with defined roles and communication channels, and conduct quarterly joint exercises.. The gap identified in the tabletop exercise is coordination, not detection or tooling, so the fix must address cross-department roles and communication. Developing a formal coordination plan with defined roles and quarterly joint exercises directly closes that gap at low cost, since it leverages existing staff and processes rather than new technology.

Answer

Outsource incident response to a managed security service provider (MSSP).

Answer

Create a dedicated incident response team that reports directly to the CISO.

Answer

Purchase a new SIEM solution to improve detection accuracy.

Question 14

You are the CISO of a retail company that is planning to implement a new e-commerce platform. The information security program currently consists of a set of high-level policies, but there are no detailed standards or guidelines for secure development. The development team uses agile methodologies and is accustomed to rapid releases. They have resisted security reviews in the past, citing delays. You need to integrate security into the development lifecycle without causing friction. The company's risk appetite is moderate; they accept some risk for speed but not if it leads to major breaches. The board expects you to manage this risk effectively. Which approach should you take?

Accepted Answer

Assign a security champion to each development team and create a lightweight secure coding checklist.. Assigning a security champion to each development team and providing a lightweight secure coding checklist integrates security into agile workflows without imposing heavy gates. It leverages existing team structures, keeps friction low, and aligns with a moderate risk appetite by embedding security early rather than blocking releases.

Answer

Provide annual security training to all developers.

Answer

Establish a separate security team that reviews all code after development is complete.

Answer

Implement a mandatory security gate before each release, requiring a full security review.

Question 15

A multinational corporation is designing an information security program to align with diverse business units and regulatory requirements across different regions. The CISO is prioritizing key components that ensure the program is both comprehensive and adaptable. Which TWO components are most critical for achieving this alignment?

Accepted Answer

Establishing a governance structure with defined roles, responsibilities, and oversight. A governance structure with defined roles, responsibilities, and oversight (Option B) is critical because it provides the authority, accountability, and decision-making framework needed to align security activities with diverse business units and regulatory requirements. Without clear governance, the program lacks the mechanisms to enforce policies, manage exceptions, and adapt to regional legal variations, such as GDPR in Europe or CCPA in California.

Answer

Focusing exclusively on the most stringent regulatory requirement to satisfy all others

Answer

Adopting a single security framework such as ISO 27001 for all regions

Answer

Implementing separate security programs for each business unit to address unique needs