CISM Information Security Program Practice Test 9 — 15 Questions

Question 1

A company is designing its information security program and wants to ensure that it meets regulatory requirements across multiple jurisdictions. Which of the following approaches is most appropriate?

Accepted Answer

Implement a regulatory compliance framework that maps controls to applicable laws and standards.. A regulatory compliance framework that maps controls to applicable laws and standards provides a structured, auditable method to address multiple, sometimes conflicting, jurisdictional requirements. This approach ensures that each control is explicitly linked to a specific legal or regulatory obligation, facilitating compliance verification and reducing the risk of oversight. It is the most comprehensive and adaptable method for a multi-jurisdictional environment, as it allows the organization to manage overlapping and unique requirements without relying on a single standard or external review alone.

Answer

Adopt ISO 27001 as the sole framework for the program.

Answer

Comply with the strictest regulation and ignore others.

Answer

Engage external legal counsel to review policies quarterly.

Question 2

An organization's information security program recently experienced a ransomware attack that encrypted critical data. Which of the following program components should be improved first to prevent recurrence?

Accepted Answer

Implement a robust backup and recovery process with offline copies.. While all options are valid security measures, the immediate priority after a ransomware attack that has already encrypted critical data is to ensure data resilience. A robust backup and recovery process with offline copies (e.g., immutable snapshots or air-gapped tape backups) directly addresses the core impact of ransomware by enabling restoration without paying the ransom. Without recoverable backups, even the best incident response plan or training cannot undo the encryption.

Answer

Develop an incident response plan specific to ransomware.

Answer

Conduct additional security awareness training on phishing.

Answer

Enhance network segmentation to isolate critical systems.

Question 3

A large financial institution is maturing its information security program and wants to move from a reactive to a proactive posture. Which of the following initiatives would best support this transition?

Accepted Answer

Establish a threat intelligence unit that analyzes adversary tactics and shares indicators across the organization.. Establishing a threat intelligence unit directly supports a proactive posture by enabling the organization to anticipate and prepare for emerging threats based on adversary tactics, techniques, and procedures (TTPs). Unlike reactive measures, this initiative shifts focus from responding to incidents to preventing them by sharing actionable indicators across the enterprise, aligning with the CISM goal of maturing the security program toward proactive risk management.

Answer

Deploy an automated compliance monitoring tool.

Answer

Implement a bug bounty program to uncover vulnerabilities.

Answer

Increase the number of security operations center (SOC) analysts.

Question 4

Which TWO of the following are key performance indicators (KPIs) for measuring the effectiveness of an information security program?

Accepted Answer

Mean time to detect (MTTD) security incidents.. Correct answers are B and D. Option B (Mean time to detect security incidents) directly measures detection effectiveness, a key performance indicator (KPI) for security program effectiveness. Option D (Percentage of critical systems patched within 30 days) measures the effectiveness of vulnerability management and protection. Option A (Number of security policies approved) is a count of administrative actions, not a performance indicator. Option C (Employee satisfaction score) is a general HR metric unrelated to security performance. Option E (Percentage of security budget spent on tools) is a financial metric, not a measure of security program effectiveness.

Answer

Number of security policies approved.

Answer

Employee satisfaction score from annual survey.

Answer

Percentage of security budget spent on tools.

Question 5

Which THREE of the following are common challenges in implementing an information security program across a large enterprise?

Accepted Answer

Cultural resistance to security controls from business units.. Cultural resistance to security controls from business units is a common challenge because security teams must balance risk mitigation with operational efficiency. Business units often perceive controls like mandatory encryption or access restrictions as hindrances to productivity, leading to shadow IT or workarounds that undermine the program's effectiveness.

Answer

Overreliance on automated security tools.

Answer

Lack of security awareness training for end users.

Question 6

You are the CISO of a mid-sized manufacturing company. The company has grown rapidly through acquisitions, and each subsidiary has its own information security program. There is no centralized governance, and recent security incidents have occurred due to inconsistent policies. The board has asked you to create a unified information security program that balances flexibility with control. Each subsidiary has unique operational processes and varying levels of security maturity. You have limited budget and cannot replace all local security teams. Which approach should you take?

Accepted Answer

Develop a minimum security standard (MSS) and a phased implementation roadmap based on risk.. Correct answer is B because developing a minimum security standard (MSS) and a phased implementation roadmap based on risk allows each subsidiary to implement controls based on their unique risk profiles while ensuring a common baseline. This approach balances flexibility with control, respects varying maturity levels, and avoids disruption. Option A (immediate enterprise-wide policy) ignores diverse operational processes and may cause resistance. Option C (centralize all security operations) is costly and impractical given the budget and local teams. Option D (adopt the most mature subsidiary's program) may not fit the context of less mature units.

Answer

Immediately mandate compliance with a new enterprise-wide security policy.

Answer

Centralize all security operations and disband local teams.

Answer

Adopt the most mature subsidiary's program as the enterprise standard.

Question 7

You are the information security program manager at a global financial services firm. The firm has a mature security program, but the CISO is concerned that the program is not keeping pace with emerging threats such as supply chain attacks and advanced persistent threats (APTs). Additionally, the program currently focuses heavily on compliance with regulations (e.g., PCI DSS, GDPR) rather than proactive risk management. The board wants to see a more strategic approach to information security. However, the compliance team is large and influential, and they resist changes that might reduce their role. You have been asked to propose a new program model that addresses these concerns while maintaining regulatory compliance. What should you do?

Accepted Answer

Evolve the program to a risk-based approach that integrates threat intelligence and adapts controls dynamically, while keeping compliance as a baseline.. Evolving the program to a risk-based approach (Option D) integrates threat intelligence and dynamically adapts controls, directly addressing the need for proactive management of emerging threats while maintaining compliance as a baseline. This balances strategic evolution with the compliance team's continued role. Option A (restructuring the compliance team) risks political friction and does not inherently shift to risk management. Option B (expanding compliance coverage) increases focus on compliance, not proactive risk. Option C (increasing awareness training) is too narrow and does not address the program's strategic direction.

Answer

Restructure the compliance team into a risk management function.

Answer

Expand the compliance team to cover more regulations and increase auditing frequency.

Answer

Increase security awareness training across the organization.

Question 8

You are the CISO of a large healthcare organization that has recently experienced a data breach due to an insider who exfiltrated patient data over several months. The breach was discovered by an external partner. The organization's information security program includes data loss prevention (DLP) tools, but they were not configured to monitor outbound data from the compromised system. Additionally, user activity monitoring (UAM) was only applied to privileged users, not to regular staff. The board demands a comprehensive improvement plan that will prevent similar incidents. However, there are concerns about employee privacy and budget constraints. The organization has a strong culture of trust and minimal monitoring. Which of the following should be the first priority in the revised program?

Accepted Answer

Expand user activity monitoring to all employees with a clear policy on privacy and acceptable use.. Expanding user activity monitoring (UAM) to all users directly addresses the monitoring gap that allowed the exfiltration to go undetected for months. Implementing a clear policy on privacy and acceptable use balances security needs with employee privacy concerns. Option B (stricter access controls) is insufficient alone as it does not detect ongoing data exfiltration. Option C (new DLP solution) could be helpful but may not catch slow, low-volume exfiltration and does not address the monitoring gap. Option D (security awareness training) is important but is a long-term preventive measure and does not immediately close the detection gap.

Answer

Implement stricter access controls and review user permissions quarterly.

Answer

Deploy a new DLP solution with advanced analytics and block all external data transfers.

Answer

Conduct additional security awareness training focused on insider threats.

Question 9

You are the information security program manager for a government agency. The agency has a highly regulated environment and is in the process of updating its incident response plan. During a tabletop exercise, it becomes clear that the detection capabilities are strong, but the response coordination between IT, legal, and public affairs is poor. This caused delays in containing a simulated ransomware attack. The existing program includes an incident response policy but no formal procedures for cross-department coordination. The agency's leadership wants quick improvement with minimal budget impact. What should you recommend?

Accepted Answer

Develop a detailed incident response coordination plan with defined roles and communication channels, and conduct quarterly joint exercises.. Correct answer is D because developing a detailed incident response coordination plan with defined roles and communication channels, and conducting quarterly joint exercises, directly addresses the coordination gap at low cost. Option A (outsourcing) is expensive and may not align with government requirements. Option B (dedicated team) could be costly and does not leverage existing staff. Option C (new SIEM) does not fix coordination.

Answer

Outsource incident response to a managed security service provider (MSSP).

Answer

Create a dedicated incident response team that reports directly to the CISO.

Answer

Purchase a new SIEM solution to improve detection accuracy.

Question 10

You are the CISO of a retail company that is planning to implement a new e-commerce platform. The information security program currently consists of a set of high-level policies, but there are no detailed standards or guidelines for secure development. The development team uses agile methodologies and is accustomed to rapid releases. They have resisted security reviews in the past, citing delays. You need to integrate security into the development lifecycle without causing friction. The company's risk appetite is moderate; they accept some risk for speed but not if it leads to major breaches. The board expects you to manage this risk effectively. Which approach should you take?

Accepted Answer

Assign a security champion to each development team and create a lightweight secure coding checklist.. Assigning a security champion to each team and creating a lightweight secure coding checklist integrates security into the agile development process without causing significant friction. Security champions provide ongoing guidance and can help enforce secure coding practices in real-time, which aligns with the rapid release cycles. Option A (annual training) is insufficient to change behavior and does not provide continuous oversight. Option C (separate security team review after development) introduces delays and friction, as developers have already completed their work. Option D (mandatory security gate before release) can cause bottlenecks and resentment, likely being bypassed or causing slowdowns that the company wants to avoid.

Answer

Provide annual security training to all developers.

Answer

Establish a separate security team that reviews all code after development is complete.

Answer

Implement a mandatory security gate before each release, requiring a full security review.

Question 11

You are the director of information security at a multinational corporation that operates in many countries with conflicting data privacy laws. The company's information security program includes a data classification policy and a data retention schedule, but there is no consistent method for handling cross-border data flows. Recently, a regulator in Country A fined the company for transferring personal data to Country B, which does not provide adequate protection. The legal department recommends implementing a binding corporate rules (BCR) approach, but the IT department says it would be too complex to implement across all systems. You must update the program to ensure compliance while minimizing operational impact. The board wants a solution that can be implemented within one year with reasonable cost. What should you do?

Accepted Answer

Conduct a data mapping exercise and implement a data classification tagging system to automate controls on sensitive data flows.. Correct answer is C because a data mapping exercise with automated tagging provides the foundation to enforce controls without manual effort. This approach allows the company to understand where sensitive data flows, apply appropriate protections (such as BCR or SCCs) only where needed, and minimize operational impact. Option A (implement BCR globally) is complex and time-consuming. Option B (rely on standard contractual clauses for all flows) may not be sufficient for all jurisdictions and is administrative heavy. Option D (stop all cross-border transfers) is impractical and would harm business operations.

Answer

Implement binding corporate rules (BCR) across all entities as recommended by legal.

Answer

Rely on standard contractual clauses (SCCs) for all cross-border data flows.

Answer

Stop all cross-border data transfers until compliant mechanisms are fully implemented.

Question 12

A multinational corporation is designing an information security program to align with diverse business units and regulatory requirements across different regions. The CISO is prioritizing key components that ensure the program is both comprehensive and adaptable. Which TWO components are most critical for achieving this alignment?

Accepted Answer

Establishing a governance structure with defined roles, responsibilities, and oversight. A governance structure with defined roles, responsibilities, and oversight (Option B) is critical because it provides the authority, accountability, and decision-making framework needed to align security activities with diverse business units and regulatory requirements. Without clear governance, the program lacks the mechanisms to enforce policies, manage exceptions, and adapt to regional legal variations, such as GDPR in Europe or CCPA in California.

Answer

Focusing exclusively on the most stringent regulatory requirement to satisfy all others

Answer

Adopting a single security framework such as ISO 27001 for all regions

Answer

Implementing separate security programs for each business unit to address unique needs

Question 13

A global financial services firm operates in 30 countries and is subject to multiple data protection regulations, including GDPR, CCPA, and various financial services directives. The firm has a centralized information security program but struggles with inconsistent enforcement across regions. The CISO is under pressure to demonstrate compliance to the board while reducing costs. The compliance team suggests creating a separate security program for each regulation, while the IT audit team recommends adopting the most stringent regulation as the baseline. The CISO must decide on a strategy that balances compliance, efficiency, and cost. What is the best approach for the CISO to take?

Accepted Answer

Develop a unified set of controls that satisfy the common requirements of all regulations and map them to each regulation's specific needs.. Developing a unified set of controls that satisfy the common requirements of all regulations and mapping them to each regulation's specific needs (Option A) is the best approach. This balances compliance by ensuring all regulations are addressed, efficiency by leveraging common controls, and cost reduction by avoiding duplicate efforts. Option B (adopting ISO 27001 alone) may not cover all regulatory specificities and requires additional mapping. Option C (separate programs) is inefficient and costly due to duplication. Option D (focusing on the most stringent regulation) can lead to gaps in less stringent but unique requirements.

Answer

Adopt ISO 27001 as the single framework and map it loosely to all regulations.

Answer

Create three separate security programs, one for each major regulation (GDPR, CCPA, financial directives).

Answer

Use the most stringent regulation (e.g., GDPR) as the baseline and accept potential gaps with other regulations.

Question 14

An organization is updating its information security program to align with business objectives. Which of the following is the PRIMARY benefit of integrating security risk management into the strategic planning process?

Accepted Answer

Aligns security investments with business priorities. Integrating security risk management into strategic planning ensures that security investments are directly tied to the organization's business priorities and risk appetite. This alignment allows for optimal allocation of resources to protect the most critical assets and processes, rather than spending on generic or low-priority controls. The primary benefit is that security becomes a business enabler, not a cost center, by focusing on what matters most to the organization's objectives.

Answer

Reduces the number of security incidents

Answer

Increases employee awareness of security policies

Answer

Ensures compliance with regulatory requirements

Question 15

During an audit of the information security program, the auditor identifies that several critical systems are not included in the incident response plan. Which of the following are the MOST appropriate actions for the security manager to take? (Select TWO.)

Accepted Answer

Update the incident response plan to include all critical systems. The incident response plan must be a living document that covers all critical systems to ensure a coordinated and effective response during a security incident. Excluding critical systems from the plan creates a blind spot that could lead to delayed containment, increased damage, or non-compliance with regulatory requirements. Updating the plan to include these systems is a direct corrective action that aligns with the CISM principle of maintaining an up-to-date incident response capability.

Answer

Implement compensating controls on the excluded systems

Answer

Document the finding and accept the risk

Answer

Immediately remove the excluded systems from production