CISM Information Security Programme — 20 Questions

Question 1

A CISO is evaluating the reporting structure for the information security team. Which reporting line is generally considered MOST effective for ensuring independence and organizational influence?

Accepted Answer

Report to the board of directors or audit committee. Reporting to the board of directors or a board committee ensures security has a direct voice at the highest level, avoiding conflicts with IT or business operations.

Answer

Report to the Chief Financial Officer (CFO)

Answer

Report to the Chief Information Officer (CIO)

Answer

Report to the Chief Operating Officer (COO)

Question 2

An organization is implementing a security controls framework and needs to prioritize which controls to implement first. According to CIS Controls v8, which approach aligns with the principle of 'implementation groups'?

Accepted Answer

Start with all controls from IG1, then move to IG2 and IG3 as resources allow. CIS Controls v8 defines Implementation Groups (IG1, IG2, IG3) that prioritize controls based on organizational maturity, starting with the most foundational and critical controls.

Answer

Focus only on controls that address the greatest risks regardless of group

Answer

Implement IG3 controls first as they are the most advanced

Answer

Implement controls from all groups simultaneously to achieve comprehensive coverage

Question 3

During a third-party risk assessment, the security team discovers that a critical vendor's sub-supplier (nth party) has access to sensitive data. The vendor contract does not address nth-party risk. What is the BEST course of action?

Accepted Answer

Revise the contract to require the vendor to flow down security requirements to sub-suppliers. The organization should require the vendor to contractually manage nth-party risks, as the organization's data is still at risk.

Answer

Accept the risk because the vendor is contractually responsible

Answer

Perform an on-site assessment of the sub-supplier

Answer

Request that the vendor terminate the sub-supplier relationship

Question 4

Which of the following is a LEADING indicator of security performance?

Accepted Answer

Patch compliance percentage. Leading indicators predict future performance; patch compliance measures proactive risk reduction.

Answer

Cost of a data breach

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 5

An information security manager is designing a security awareness program. Which approach BEST addresses the different learning needs of various employee groups?

Accepted Answer

Deliver role-based training: secure coding for developers, social engineering for executives, and basic awareness for all. Role-based training ensures that each group receives content relevant to their responsibilities.

Answer

Use only phishing simulations as training

Answer

Focus training only on high-risk groups such as system administrators

Answer

Provide the same annual training to all employees to ensure consistency

Question 6

A security manager needs to justify an increase in the security budget. Which metric is MOST compelling to demonstrate the value of security investments to the board?

Accepted Answer

Return on investment (ROI) from avoided breach costs. ROI calculations, such as breach avoidance value, show financial benefit and resonate with the board.

Answer

Number of phishing simulations conducted

Answer

Percentage of IT budget allocated to security

Answer

Number of security tools deployed

Question 7

Which control family from NIST SP 800-53 is MOST directly associated with ensuring that users have appropriate access rights?

Accepted Answer

Access Control (AC). The Access Control (AC) family specifically addresses user access management.

Answer

System and Communications Protection (SC)

Answer

Identification and Authentication (IA)

Answer

Personnel Security (PS)

Question 8

An organization is designing a security operations center (SOC). Which of the following functions is PRIMARILY responsible for analyzing alerts and determining if they represent genuine threats?

Accepted Answer

Security Analyst. Security analysts are responsible for alert triage and investigation.

Answer

SOC Manager

Answer

Security Architect

Answer

Incident Responder

Question 9

What is the PRIMARY purpose of a security champions program?

Accepted Answer

To embed security advocates in non-security teams to promote security best practices. Security champions act as advocates within teams, promoting security practices and bridging the gap between security and development.

Answer

To enforce security policies through peer pressure

Answer

To conduct security audits of other teams

Answer

To replace the security team in development projects

Question 10

A security manager is selecting a controls framework for a new organization. Which framework provides the most granular control families and is widely used for US federal agencies?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is a comprehensive catalog of controls organized into families, commonly used by US federal agencies and many private organizations.

Answer

CIS Controls v8

Answer

ISO 27001 Annex A

Answer

COBIT 2019

Question 11

A company maintains a security scorecard for the executive team. Which metric is MOST appropriate to include as a leading indicator on a one-page dashboard?

Accepted Answer

Phishing click rate. Phishing click rate is a leading indicator that measures user awareness and predicts future compromise risk.

Answer

Average cost per incident

Answer

Number of data breaches in the past year

Answer

Number of security tools deployed

Question 12

In the context of defense-in-depth, which control provides protection at the network layer to prevent unauthorized access?

Accepted Answer

Firewalls. Firewalls are a network security control that filter traffic based on rules.

Answer

Encryption of data at rest

Answer

Antivirus software

Answer

Security awareness training

Question 13

An organization is designing a vendor tiering process for its third-party risk management program. Which TWO factors are MOST appropriate for determining a vendor's risk tier?

Accepted Answer

Type and sensitivity of data the vendor accesses. Data access and service criticality are primary factors for tiering vendors.

Answer

Vendor's geographic location

Answer

Number of employees at the vendor

Answer

Vendor's annual revenue

Question 14

A security manager is developing a set of objectives and key results (OKRs) for the security program. Which THREE would be considered effective security OKRs?

Accepted Answer

Objective: Enhance incident response. Key Result: Achieve 100% of incidents logged within 1 hour of detection.. OKRs should be measurable and tied to security outcomes.

Answer

Objective: Implement a new SIEM. Key Result: Deploy SIEM by Q3.

Answer

Objective: Increase security awareness. Key Result: Conduct quarterly phishing simulations.

Question 15

Which TWO budget components are considered 'services' in a typical security budget?

Accepted Answer

Penetration testing conducted by an external firm. Services include external consultants and managed security services, not personnel or technology purchases.

Answer

Security awareness training software license

Answer

Firewall hardware

Answer

Salaries for security staff

Question 16

A CISO is designing the security organization for a financial services firm. Which reporting structure is most likely to ensure the independence and authority of the information security function?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board provides independence from operational pressures, allowing the CISO to enforce security without conflict of interest. Reporting to the CIO can create conflicts, as security may be subordinated to IT goals. Reporting to legal or risk committees may lack operational authority.

Answer

Reporting to the risk committee

Answer

Reporting to the CIO

Answer

Reporting to the chief legal officer

Question 17

Which of the following security team roles is primarily responsible for designing and implementing security solutions to protect an organization's systems and data?

Accepted Answer

Security architect. The security architect designs the overall security structure, including policies, technologies, and controls. Other roles focus on operations, analysis, or governance.

Answer

Security analyst

Answer

GRC analyst

Answer

Penetration tester

Question 18

An organization is implementing a security controls framework and must decide on prioritization. According to defense-in-depth principles, which approach should be taken first?

Accepted Answer

Prioritize critical controls that address the most significant risks. Defense-in-depth starts with critical controls that protect against the most likely threats, often following frameworks like CIS Critical Controls, which prioritize foundational controls.

Answer

Select all controls from NIST SP 800-53 without prioritization

Answer

Deploy business-enabling controls that support operations

Answer

Implement compensating controls to address gaps in existing controls

Question 19

Which of the following is a leading indicator for security performance?

Accepted Answer

Patch compliance percentage. Leading indicators are proactive measures that predict future performance. Patch compliance is a leading indicator because it shows current security posture that influences future incidents.

Answer

Mean time to recover (MTTR)

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 20

A security awareness program includes phishing simulations. Which metric best measures the long-term effectiveness of the program?

Accepted Answer

Click rate trend over multiple simulation cycles. A sustained downward trend in click rate over time indicates improved awareness and behavior, while single-click rate or reported emails may vary.

Answer

Number of phishing simulation campaigns per year

Answer

Pass rate on phishing simulation knowledge test

Answer

Number of employees who report phishing emails