CISM Information Security Programme — 30 Questions

Question 1

Which THREE components are essential for a comprehensive third-party risk management (TPRM) program?

Accepted Answer

Ongoing monitoring. A comprehensive TPRM program includes three essential components: onboarding risk assessment to evaluate third parties before engagement, ongoing monitoring to track performance and risks continuously, and annual reassessment to periodically verify compliance and risk posture. These components ensure a complete lifecycle of third-party risk management.

Answer

Vendor product marketing review

Question 2

A CISO is preparing an executive dashboard for the board of directors. Which combination of metrics would provide the most meaningful overview of the security programme's effectiveness?

Accepted Answer

Mean time to detect (MTTD), mean time to respond (MTTR), and number of breaches. For a board-level dashboard, the most meaningful metrics are those that provide a high-level view of security programme effectiveness. MTTD and MTTR are key operational metrics that indicate the efficiency of detection and response capabilities, while the number of breaches is a critical lagging indicator of overall security posture. Together, they offer a balanced picture of both current operational performance and historical impact, which is what the board needs to assess risk and resource allocation.

Answer

Number of security architects, SOC analyst headcount, and security tool count

Answer

Number of security incidents, percentage of systems patched, and security awareness training completion rate

Answer

Phishing click rate, number of vendor assessments completed, and security budget spent

Question 3

A security architect is selecting controls for an e-commerce platform. Which TWO of the following are examples of compensating controls?

Accepted Answer

Implementing multi-factor authentication when strong passwords cannot be enforced.. Compensating controls are alternative measures that provide equivalent protection when a primary control cannot be implemented. Multi-factor authentication compensates for weak passwords when strong password policies cannot be enforced. Network segmentation compensates for the inability to patch a legacy system by isolating it from the network, thereby reducing exposure.

Answer

Encrypting all data at rest.

Answer

Deploying a web application firewall (WAF) to protect against SQL injection.

Answer

Conducting quarterly vulnerability scans.

Question 4

A CISO is evaluating the reporting structure for the information security team. Which reporting line is generally considered MOST effective for ensuring independence and organizational influence?

Accepted Answer

Report to the board of directors or audit committee. Reporting to the board of directors or a board committee ensures security has a direct voice at the highest level, avoiding conflicts with IT or business operations.

Answer

Report to the Chief Financial Officer (CFO)

Answer

Report to the Chief Information Officer (CIO)

Answer

Report to the Chief Operating Officer (COO)

Question 5

An organization is implementing a security controls framework and needs to prioritize which controls to implement first. According to CIS Controls v8, which approach aligns with the principle of 'implementation groups'?

Accepted Answer

Start with all controls from IG1, then move to IG2 and IG3 as resources allow. CIS Controls v8 defines Implementation Groups (IG1, IG2, IG3) that prioritize controls based on organizational maturity, starting with the most foundational and critical controls.

Answer

Focus only on controls that address the greatest risks regardless of group

Answer

Implement IG3 controls first as they are the most advanced

Answer

Implement controls from all groups simultaneously to achieve comprehensive coverage

Question 6

During a third-party risk assessment, the security team discovers that a critical vendor's sub-supplier (nth party) has access to sensitive data. The vendor contract does not address nth-party risk. What is the BEST course of action?

Accepted Answer

Revise the contract to require the vendor to flow down security requirements to sub-suppliers. The organization should require the vendor to contractually manage nth-party risks, as the organization's data is still at risk.

Answer

Accept the risk because the vendor is contractually responsible

Answer

Perform an on-site assessment of the sub-supplier

Answer

Request that the vendor terminate the sub-supplier relationship

Question 7

Which of the following is a LEADING indicator of security performance?

Accepted Answer

Patch compliance percentage. Leading indicators predict future performance; patch compliance measures proactive risk reduction.

Answer

Cost of a data breach

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 8

An information security manager is designing a security awareness program. Which approach BEST addresses the different learning needs of various employee groups?

Accepted Answer

Deliver role-based training: secure coding for developers, social engineering for executives, and basic awareness for all. Role-based training ensures that each group receives content relevant to their responsibilities.

Answer

Use only phishing simulations as training

Answer

Focus training only on high-risk groups such as system administrators

Answer

Provide the same annual training to all employees to ensure consistency

Question 9

A security manager needs to justify an increase in the security budget. Which metric is MOST compelling to demonstrate the value of security investments to the board?

Accepted Answer

Return on investment (ROI) from avoided breach costs. ROI calculations, such as breach avoidance value, show financial benefit and resonate with the board.

Answer

Number of phishing simulations conducted

Answer

Percentage of IT budget allocated to security

Answer

Number of security tools deployed

Question 10

Which control family from NIST SP 800-53 is MOST directly associated with ensuring that users have appropriate access rights?

Accepted Answer

Access Control (AC). The Access Control (AC) family specifically addresses user access management.

Answer

System and Communications Protection (SC)

Answer

Identification and Authentication (IA)

Answer

Personnel Security (PS)

Question 11

An organization is designing a security operations center (SOC). Which of the following functions is PRIMARILY responsible for analyzing alerts and determining if they represent genuine threats?

Accepted Answer

Security Analyst. Security analysts are responsible for alert triage and investigation.

Answer

SOC Manager

Answer

Security Architect

Answer

Incident Responder

Question 12

What is the PRIMARY purpose of a security champions program?

Accepted Answer

To embed security advocates in non-security teams to promote security best practices. Security champions act as advocates within teams, promoting security practices and bridging the gap between security and development.

Answer

To enforce security policies through peer pressure

Answer

To conduct security audits of other teams

Answer

To replace the security team in development projects

Question 13

A security manager is selecting a controls framework for a new organization. Which framework provides the most granular control families and is widely used for US federal agencies?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is a comprehensive catalog of controls organized into families, commonly used by US federal agencies and many private organizations.

Answer

CIS Controls v8

Answer

ISO 27001 Annex A

Answer

COBIT 2019

Question 14

A company maintains a security scorecard for the executive team. Which metric is MOST appropriate to include as a leading indicator on a one-page dashboard?

Accepted Answer

Phishing click rate. Phishing click rate is a leading indicator that measures user awareness and predicts future compromise risk.

Answer

Average cost per incident

Answer

Number of data breaches in the past year

Answer

Number of security tools deployed

Question 15

In the context of defense-in-depth, which control provides protection at the network layer to prevent unauthorized access?

Accepted Answer

Firewalls. Firewalls are a network security control that filter traffic based on rules.

Answer

Encryption of data at rest

Answer

Antivirus software

Answer

Security awareness training

Question 16

An organization is designing a vendor tiering process for its third-party risk management program. Which TWO factors are MOST appropriate for determining a vendor's risk tier?

Accepted Answer

Type and sensitivity of data the vendor accesses. Data access and service criticality are primary factors for tiering vendors.

Answer

Vendor's geographic location

Answer

Number of employees at the vendor

Answer

Vendor's annual revenue

Question 17

A security manager is developing a set of objectives and key results (OKRs) for the security program. Which THREE would be considered effective security OKRs?

Accepted Answer

Objective: Enhance incident response. Key Result: Achieve 100% of incidents logged within 1 hour of detection.. OKRs should be measurable and tied to security outcomes.

Answer

Objective: Implement a new SIEM. Key Result: Deploy SIEM by Q3.

Answer

Objective: Increase security awareness. Key Result: Conduct quarterly phishing simulations.

Question 18

Which TWO budget components are considered 'services' in a typical security budget?

Accepted Answer

Penetration testing conducted by an external firm. Services include external consultants and managed security services, not personnel or technology purchases.

Answer

Security awareness training software license

Answer

Firewall hardware

Answer

Salaries for security staff

Question 19

A CISO is designing the security organization for a financial services firm. Which reporting structure is most likely to ensure the independence and authority of the information security function?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board provides independence from operational pressures, allowing the CISO to enforce security without conflict of interest. Reporting to the CIO can create conflicts, as security may be subordinated to IT goals. Reporting to legal or risk committees may lack operational authority.

Answer

Reporting to the risk committee

Answer

Reporting to the CIO

Answer

Reporting to the chief legal officer

Question 20

Which of the following security team roles is primarily responsible for designing and implementing security solutions to protect an organization's systems and data?

Accepted Answer

Security architect. The security architect designs the overall security structure, including policies, technologies, and controls. Other roles focus on operations, analysis, or governance.

Answer

Security analyst

Answer

GRC analyst

Answer

Penetration tester