CISM Information Security Program Practice Test 9 — 15 Questions

Question 1

A large financial institution is maturing its information security program and wants to move from a reactive to a proactive posture. Which of the following initiatives would best support this transition?

Accepted Answer

Establish a threat intelligence unit that analyzes adversary tactics and shares indicators across the organization.. Correct answer is B because threat intelligence enables proactive identification and mitigation of emerging threats. Option A (increased monitoring) is reactive. Option C (bug bounty program) is useful but externally focused and limited in scope. Option D (compliance automation) does not address proactive threat management.

Answer

Deploy an automated compliance monitoring tool.

Answer

Implement a bug bounty program to uncover vulnerabilities.

Answer

Increase the number of security operations center (SOC) analysts.

Question 2

Which TWO of the following are key performance indicators (KPIs) for measuring the effectiveness of an information security program?

Accepted Answer

Mean time to detect (MTTD) security incidents.. Correct answers are A and D. Option A (mean time to detect) directly measures detection effectiveness. Option D (percentage of systems patched within SLA) measures protection. Option B (number of security policies) is a count, not performance. Option C (budget spent) is a financial metric, not a performance indicator. Option E (employee satisfaction) is not a security KPI.

Answer

Number of security policies approved.

Answer

Employee satisfaction score from annual survey.

Answer

Percentage of security budget spent on tools.

Question 3

Which TWO of the following are essential components of an information security program charter?

Accepted Answer

Roles, responsibilities, and authority of the program team.. Correct answers are B and D. Option B (scope and objectives) defines program boundaries. Option D (roles and responsibilities) establishes accountability. Option A (detailed budget) is typically in a separate document. Option C (technology stack) is operational, not charter-level. Option E (vendor list) is not relevant to charter.

Answer

List of approved security technologies.

Answer

Detailed annual budget allocation.

Answer

List of approved third-party vendors.

Question 4

Which THREE of the following are common challenges in implementing an information security program across a large enterprise?

Accepted Answer

Cultural resistance to security controls from business units.. Correct answers are A, C, and E. Option A (cultural resistance to security controls) is common. Option C (legacy systems that cannot be patched) is a technical challenge. Option E (inconsistent enforcement across business units) reflects governance issues. Option B (lack of security awareness training) is a symptom but not an implementation challenge per se; training can be provided. Option D (overreliance on automated tools) is less common.

Answer

Overreliance on automated security tools.

Answer

Lack of security awareness training for end users.

Question 5

You are the CISO of a mid-sized manufacturing company. The company has grown rapidly through acquisitions, and each subsidiary has its own information security program. There is no centralized governance, and recent security incidents have occurred due to inconsistent policies. The board has asked you to create a unified information security program that balances flexibility with control. Each subsidiary has unique operational processes and varying levels of security maturity. You have limited budget and cannot replace all local security teams. Which approach should you take?

Accepted Answer

Develop a minimum security standard (MSS) and a phased implementation roadmap based on risk.. Correct answer is D because developing a minimum security standard (MSS) with a phased roadmap allows each subsidiary to implement controls based on risk while providing a common baseline. Option A (centralize all security functions) is costly and disruptive. Option B (adopt the best subsidiary's program) may not fit others. Option C (mandate immediate compliance) ignores varying maturity and can cause resistance.

Answer

Immediately mandate compliance with a new enterprise-wide security policy.

Answer

Centralize all security operations and disband local teams.

Answer

Adopt the most mature subsidiary's program as the enterprise standard.

Question 6

You are the information security program manager at a global financial services firm. The firm has a mature security program, but the CISO is concerned that the program is not keeping pace with emerging threats such as supply chain attacks and advanced persistent threats (APTs). Additionally, the program currently focuses heavily on compliance with regulations (e.g., PCI DSS, GDPR) rather than proactive risk management. The board wants to see a more strategic approach to information security. However, the compliance team is large and influential, and they resist changes that might reduce their role. You have been asked to propose a new program model that addresses these concerns while maintaining regulatory compliance. What should you do?

Accepted Answer

Evolve the program to a risk-based approach that integrates threat intelligence and adapts controls dynamically, while keeping compliance as a baseline.. Correct answer is C because evolving to a risk-based model with integrated threat intelligence directly addresses the proactive gap while maintaining compliance. Option A (expand compliance coverage) does not solve the proactive issue. Option B (restructure the compliance team) may cause political friction without addressing root cause. Option D (increase awareness training) is too narrow.

Answer

Restructure the compliance team into a risk management function.

Answer

Expand the compliance team to cover more regulations and increase auditing frequency.

Answer

Increase security awareness training across the organization.

Question 7

You are the CISO of a large healthcare organization that has recently experienced a data breach due to an insider who exfiltrated patient data over several months. The breach was discovered by an external partner. The organization's information security program includes data loss prevention (DLP) tools, but they were not configured to monitor outbound data from the compromised system. Additionally, user activity monitoring (UAM) was only applied to privileged users, not to regular staff. The board demands a comprehensive improvement plan that will prevent similar incidents. However, there are concerns about employee privacy and budget constraints. The organization has a strong culture of trust and minimal monitoring. Which of the following should be the first priority in the revised program?

Accepted Answer

Expand user activity monitoring to all employees with a clear policy on privacy and acceptable use.. Correct answer is D because expanding UAM to all users, with clear privacy guidelines, directly addresses the monitoring gap while respecting privacy. Option A (new DLP only) may not catch slow exfiltration. Option B (stronger access controls) helps but does not detect ongoing exfiltration. Option C (training) is important but not the primary corrective action.

Answer

Implement stricter access controls and review user permissions quarterly.

Answer

Deploy a new DLP solution with advanced analytics and block all external data transfers.

Answer

Conduct additional security awareness training focused on insider threats.

Question 8

You are the information security program manager for a government agency. The agency has a highly regulated environment and is in the process of updating its incident response plan. During a tabletop exercise, it becomes clear that the detection capabilities are strong, but the response coordination between IT, legal, and public affairs is poor. This caused delays in containing a simulated ransomware attack. The existing program includes an incident response policy but no formal procedures for cross-department coordination. The agency's leadership wants quick improvement with minimal budget impact. What should you recommend?

Accepted Answer

Develop a detailed incident response coordination plan with defined roles and communication channels, and conduct quarterly joint exercises.. Correct answer is C because creating structured coordination procedures and conducting regular joint exercises directly addresses the coordination gap at low cost. Option A (new SIEM) does not fix coordination. Option B (outsourcing) is expensive and may not align with government requirements. Option D (separate team) could be costly and does not leverage existing staff.

Answer

Outsource incident response to a managed security service provider (MSSP).

Answer

Create a dedicated incident response team that reports directly to the CISO.

Answer

Purchase a new SIEM solution to improve detection accuracy.

Question 9

You are the CISO of a retail company that is planning to implement a new e-commerce platform. The information security program currently consists of a set of high-level policies, but there are no detailed standards or guidelines for secure development. The development team uses agile methodologies and is accustomed to rapid releases. They have resisted security reviews in the past, citing delays. You need to integrate security into the development lifecycle without causing friction. The company's risk appetite is moderate; they accept some risk for speed but not if it leads to major breaches. The board expects you to manage this risk effectively. Which approach should you take?

Accepted Answer

Assign a security champion to each development team and create a lightweight secure coding checklist.. Correct answer is A because embedding a security champion in each team provides ongoing guidance without slowing down development drastically. Option B (gate process) will cause friction and likely be bypassed. Option C (separate team review) may cause delays and resentment. Option D (training only) may not change behavior effectively.

Answer

Provide annual security training to all developers.

Answer

Establish a separate security team that reviews all code after development is complete.

Answer

Implement a mandatory security gate before each release, requiring a full security review.

Question 10

You are the director of information security at a multinational corporation that operates in many countries with conflicting data privacy laws. The company's information security program includes a data classification policy and a data retention schedule, but there is no consistent method for handling cross-border data flows. Recently, a regulator in Country A fined the company for transferring personal data to Country B, which does not provide adequate protection. The legal department recommends implementing a binding corporate rules (BCR) approach, but the IT department says it would be too complex to implement across all systems. You must update the program to ensure compliance while minimizing operational impact. The board wants a solution that can be implemented within one year with reasonable cost. What should you do?

Accepted Answer

Conduct a data mapping exercise and implement a data classification tagging system to automate controls on sensitive data flows.. Correct answer is D because a data mapping exercise with automated tagging provides the foundation to enforce controls without manual effort. Option A (implement BCR globally) is complex and risky. Option B (stop all cross-border transfers) is impractical. Option C (rely on standard contractual clauses) may not be sufficient and is also administrative heavy.

Answer

Implement binding corporate rules (BCR) across all entities as recommended by legal.

Answer

Rely on standard contractual clauses (SCCs) for all cross-border data flows.

Answer

Stop all cross-border data transfers until compliant mechanisms are fully implemented.

Question 11

A multinational corporation is designing an information security program to align with diverse business units and regulatory requirements across different regions. The CISO is prioritizing key components that ensure the program is both comprehensive and adaptable. Which TWO components are most critical for achieving this alignment?

Accepted Answer

Establishing a governance structure with defined roles, responsibilities, and oversight. A robust governance framework (B) ensures consistent oversight and accountability, while mapping controls to multiple regulations (D) enables efficiency and compliance across jurisdictions. Option A (single framework) may not cover all specific requirements; option C (separate programs) leads to duplication; option E (focus on one regulation) risks non-compliance elsewhere.

Answer

Focusing exclusively on the most stringent regulatory requirement to satisfy all others

Answer

Adopting a single security framework such as ISO 27001 for all regions

Answer

Implementing separate security programs for each business unit to address unique needs

Question 12

A small e-commerce company with 50 employees and limited IT budget is establishing its first formal information security program. The company processes customer payment data and must comply with PCI DSS. The CEO wants to balance security with operational costs. The IT manager proposes investing in a state-of-the-art security information and event management (SIEM) system costing $100,000 annually. The CISO, however, recommends a more phased approach. Considering the company's size, budget constraints, and compliance requirements, what should be the CISO's primary recommendation?

Accepted Answer

Deploy a firewall, antivirus software, and enforce strong access controls as baseline security measures.. The correct action is to implement a firewall, antivirus, and basic access controls as foundational measures that address PCI DSS requirements cost-effectively. A SIEM (A) is too expensive and complex for a small organization. Outsourcing to an MSSP (C) may be considered later but is not the first step. Developing custom software (D) is unnecessary and wastes resources.

Answer

Implement the SIEM system immediately to achieve real-time threat detection.

Answer

Outsource all security operations to a managed security service provider (MSSP).

Answer

Develop a custom security software solution tailored to the company's payment processing system.

Question 13

A global financial services firm operates in 30 countries and is subject to multiple data protection regulations, including GDPR, CCPA, and various financial services directives. The firm has a centralized information security program but struggles with inconsistent enforcement across regions. The CISO is under pressure to demonstrate compliance to the board while reducing costs. The compliance team suggests creating a separate security program for each regulation, while the IT audit team recommends adopting the most stringent regulation as the baseline. The CISO must decide on a strategy that balances compliance, efficiency, and cost. What is the best approach for the CISO to take?

Accepted Answer

Develop a unified set of controls that satisfy the common requirements of all regulations and map them to each regulation's specific needs.. The best approach is to develop a unified control framework that maps common security controls to multiple regulations, leveraging the fact that many requirements overlap. Option A (adopting one framework) may not cover all regulatory specificities. Option B (separate programs) is inefficient and costly. Option D (focus on most stringent) can lead to gaps in less stringent but unique requirements.

Answer

Adopt ISO 27001 as the single framework and map it loosely to all regulations.

Answer

Create three separate security programs, one for each major regulation (GDPR, CCPA, financial directives).

Answer

Use the most stringent regulation (e.g., GDPR) as the baseline and accept potential gaps with other regulations.

Question 14

An organization is updating its information security program to align with business objectives. Which of the following is the PRIMARY benefit of integrating security risk management into the strategic planning process?

Accepted Answer

Aligns security investments with business priorities. Option C is correct because integrating security risk management into strategic planning ensures that security investments are prioritized based on business impact, aligning resources with the most critical risks. Option A is wrong because compliance is a legal requirement, not the primary benefit of integration. Option B is wrong because reducing incidents is a desirable outcome but not the primary benefit of integration. Option D is wrong because awareness is an operational benefit, not strategic.

Answer

Reduces the number of security incidents

Answer

Increases employee awareness of security policies

Answer

Ensures compliance with regulatory requirements

Question 15

During an audit of the information security program, the auditor identifies that several critical systems are not included in the incident response plan. Which of the following are the MOST appropriate actions for the security manager to take? (Select TWO.)

Accepted Answer

Update the incident response plan to include all critical systems. Options B and D are correct. Escalating to senior management ensures proper awareness and authorization (B), and updating the plan to include all critical systems directly addresses the finding (D). Option A is wrong because implementing compensating controls is a temporary measure and does not solve the root cause. Option C is wrong because immediately removing systems from production is too drastic and not justified. Option E is wrong because accepting risk without analysis bypasses proper risk management.

Answer

Implement compensating controls on the excluded systems

Answer

Document the finding and accept the risk

Answer

Immediately remove the excluded systems from production