CISM Information Security Programme — 15 Questions

Question 1

Which THREE components are essential for a comprehensive third-party risk management (TPRM) program?

Accepted Answer

Ongoing monitoring. A comprehensive TPRM program includes three essential components: onboarding risk assessment to evaluate third parties before engagement, ongoing monitoring to track performance and risks continuously, and annual reassessment to periodically verify compliance and risk posture. These components ensure a complete lifecycle of third-party risk management.

Answer

Vendor product marketing review

Question 2

A CISO is preparing an executive dashboard for the board of directors. Which combination of metrics would provide the most meaningful overview of the security programme's effectiveness?

Accepted Answer

Mean time to detect (MTTD), mean time to respond (MTTR), and number of breaches. For a board-level dashboard, the most meaningful metrics are those that provide a high-level view of security programme effectiveness. MTTD and MTTR are key operational metrics that indicate the efficiency of detection and response capabilities, while the number of breaches is a critical lagging indicator of overall security posture. Together, they offer a balanced picture of both current operational performance and historical impact, which is what the board needs to assess risk and resource allocation.

Answer

Number of security architects, SOC analyst headcount, and security tool count

Answer

Number of security incidents, percentage of systems patched, and security awareness training completion rate

Answer

Phishing click rate, number of vendor assessments completed, and security budget spent

Question 3

A security architect is selecting controls for an e-commerce platform. Which TWO of the following are examples of compensating controls?

Accepted Answer

Implementing multi-factor authentication when strong passwords cannot be enforced.. Compensating controls are alternative measures that provide equivalent protection when a primary control cannot be implemented. Multi-factor authentication compensates for weak passwords when strong password policies cannot be enforced. Network segmentation compensates for the inability to patch a legacy system by isolating it from the network, thereby reducing exposure.

Answer

Encrypting all data at rest.

Answer

Deploying a web application firewall (WAF) to protect against SQL injection.

Answer

Conducting quarterly vulnerability scans.

Question 4

A CISO is evaluating the reporting structure for the information security team. Which reporting line is generally considered MOST effective for ensuring independence and organizational influence?

Accepted Answer

Report to the board of directors or audit committee. Reporting to the board of directors or a board committee ensures security has a direct voice at the highest level, avoiding conflicts with IT or business operations.

Answer

Report to the Chief Financial Officer (CFO)

Answer

Report to the Chief Information Officer (CIO)

Answer

Report to the Chief Operating Officer (COO)

Question 5

An organization is implementing a security controls framework and needs to prioritize which controls to implement first. According to CIS Controls v8, which approach aligns with the principle of 'implementation groups'?

Accepted Answer

Start with all controls from IG1, then move to IG2 and IG3 as resources allow. CIS Controls v8 defines Implementation Groups (IG1, IG2, IG3) that prioritize controls based on organizational maturity, starting with the most foundational and critical controls.

Answer

Focus only on controls that address the greatest risks regardless of group

Answer

Implement IG3 controls first as they are the most advanced

Answer

Implement controls from all groups simultaneously to achieve comprehensive coverage

Question 6

During a third-party risk assessment, the security team discovers that a critical vendor's sub-supplier (nth party) has access to sensitive data. The vendor contract does not address nth-party risk. What is the BEST course of action?

Accepted Answer

Revise the contract to require the vendor to flow down security requirements to sub-suppliers. The organization should require the vendor to contractually manage nth-party risks, as the organization's data is still at risk.

Answer

Accept the risk because the vendor is contractually responsible

Answer

Perform an on-site assessment of the sub-supplier

Answer

Request that the vendor terminate the sub-supplier relationship

Question 7

Which of the following is a LEADING indicator of security performance?

Accepted Answer

Patch compliance percentage. Leading indicators predict future performance; patch compliance measures proactive risk reduction.

Answer

Cost of a data breach

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 8

An information security manager is designing a security awareness program. Which approach BEST addresses the different learning needs of various employee groups?

Accepted Answer

Deliver role-based training: secure coding for developers, social engineering for executives, and basic awareness for all. Role-based training ensures that each group receives content relevant to their responsibilities.

Answer

Use only phishing simulations as training

Answer

Focus training only on high-risk groups such as system administrators

Answer

Provide the same annual training to all employees to ensure consistency

Question 9

A security manager needs to justify an increase in the security budget. Which metric is MOST compelling to demonstrate the value of security investments to the board?

Accepted Answer

Return on investment (ROI) from avoided breach costs. ROI calculations, such as breach avoidance value, show financial benefit and resonate with the board.

Answer

Number of phishing simulations conducted

Answer

Percentage of IT budget allocated to security

Answer

Number of security tools deployed

Question 10

Which control family from NIST SP 800-53 is MOST directly associated with ensuring that users have appropriate access rights?

Accepted Answer

Access Control (AC). The Access Control (AC) family specifically addresses user access management.

Answer

System and Communications Protection (SC)

Answer

Identification and Authentication (IA)

Answer

Personnel Security (PS)

Question 11

An organization is designing a security operations center (SOC). Which of the following functions is PRIMARILY responsible for analyzing alerts and determining if they represent genuine threats?

Accepted Answer

Security Analyst. Security analysts are responsible for alert triage and investigation.

Answer

SOC Manager

Answer

Security Architect

Answer

Incident Responder

Question 12

What is the PRIMARY purpose of a security champions program?

Accepted Answer

To embed security advocates in non-security teams to promote security best practices. Security champions act as advocates within teams, promoting security practices and bridging the gap between security and development.

Answer

To enforce security policies through peer pressure

Answer

To conduct security audits of other teams

Answer

To replace the security team in development projects

Question 13

A security manager is selecting a controls framework for a new organization. Which framework provides the most granular control families and is widely used for US federal agencies?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is a comprehensive catalog of controls organized into families, commonly used by US federal agencies and many private organizations.

Answer

CIS Controls v8

Answer

ISO 27001 Annex A

Answer

COBIT 2019

Question 14

A company maintains a security scorecard for the executive team. Which metric is MOST appropriate to include as a leading indicator on a one-page dashboard?

Accepted Answer

Phishing click rate. Phishing click rate is a leading indicator that measures user awareness and predicts future compromise risk.

Answer

Average cost per incident

Answer

Number of data breaches in the past year

Answer

Number of security tools deployed

Question 15

In the context of defense-in-depth, which control provides protection at the network layer to prevent unauthorized access?

Accepted Answer

Firewalls. Firewalls are a network security control that filter traffic based on rules.

Answer

Encryption of data at rest

Answer

Antivirus software

Answer

Security awareness training