CISM Information Security Programme — 30 Questions

Question 1

Which TWO budget components are considered 'services' in a typical security budget?

Accepted Answer

Penetration testing conducted by an external firm. Option A (penetration testing conducted by an external firm) is a service because it is a professional engagement delivered by third-party consultants rather than a product you own, and it is typically billed per assessment or per project. Option E (Managed Security Service Provider fees) is a service because an MSSP provides ongoing, subscription-based monitoring and management (e.g., 24x7 SOC, SIEM monitoring) under a service-level agreement, which is an operational expense rather than a capital purchase. Option B is a software license, which is a product/asset purchase (often capitalized or treated as a software expense), not a service. Option C is firewall hardware, a capital asset/product. Option D is salaries for security staff, which are internal personnel costs (headcount), not externally procured services.

Answer

Security awareness training software license

Answer

Firewall hardware

Answer

Salaries for security staff

Question 2

An organization's security budget is 12% of the IT budget. Which of the following best describes the maturity of this security program?

Accepted Answer

Mature, as it aligns with the 10-15% benchmark. Industry benchmarks commonly place security spending at 10-15% of the IT budget for a mature program, so 12% falls within that range and indicates reasonable maturity. This benchmark reflects an organization that invests in preventive, detective, and responsive controls rather than treating security as an afterthought. The percentage alone is not definitive, but among the options it best describes maturity.

Answer

Immature, because security should be less than 5% of IT budget

Answer

Mature, but only if it also includes a separate budget for compliance

Answer

Overbudgeted, as the ideal is 8% of IT budget

Question 3

A CISO is evaluating security metrics for reporting to the board. Which TWO of the following are leading indicators?

Accepted Answer

Phishing simulation click rate. Option D (phishing simulation click rate) is a leading indicator because it measures the current susceptibility of users to social engineering before an actual breach occurs, predicting the likelihood of future compromise and guiding awareness training priorities. Option E (patch compliance percentage) is a leading indicator because it reflects the proportion of systems currently up to date with security fixes, forecasting exposure to known vulnerabilities and future exploit risk. By contrast, option A (MTTD) is a lagging/operational detection metric that measures how long incidents have already gone undetected, option B (number of data breaches in the past quarter) is a classic lagging outcome indicator of events that already happened, and option C (number of security tools deployed) is a vanity or activity metric that does not predict security posture or risk reduction.

Answer

Mean time to detect (MTTD) incidents

Answer

Number of data breaches in the past quarter

Answer

Number of security tools deployed

Question 4

A security architect is designing a defense-in-depth strategy. Which combination of controls best exemplifies this approach?

Accepted Answer

Firewall, antivirus, encryption, and security awareness training. Defense-in-depth requires layering controls across different categories — administrative, technical, and physical — so that no single failure exposes the asset. Option D uniquely combines a network control (firewall), a host control (antivirus), a data control (encryption), and an administrative/human control (security awareness training), covering multiple layers and threat vectors. This diversity is the defining characteristic of defense-in-depth: if one layer is bypassed, others still provide protection.

Answer

Physical security, background checks, and non-disclosure agreements

Answer

Encryption, data loss prevention, and backup

Answer

Firewall, intrusion detection system, and SIEM

Question 5

A CISO is preparing the security budget for the next fiscal year. The current IT budget is $10 million. For a mature security program, what is the recommended security budget range?

Accepted Answer

$1 million to $1.5 million. Industry benchmarks, including Gartner and IANS research, indicate mature security programs typically spend 5-15% of the IT budget, with 10% being a common planning target. Ten percent of a $10 million IT budget is $1 million, and the $1M-$1.5M range aligns with that mature-program benchmark. CISM expects candidates to recognize this ratio as a governance and benchmarking concept rather than a precise formula.

Answer

$500,000 to $750,000

Answer

$100,000 to $200,000

Answer

$2 million to $3 million

Question 6

Which metric is considered a lagging indicator of security program performance?

Accepted Answer

Mean time to detect (MTTD). Lagging indicators measure past events. Mean time to detect (MTTD) is a lagging indicator because it reflects historical detection efficiency.

Answer

Patch compliance percentage

Answer

Access review completion rate

Answer

Phishing simulation click rate

Question 7

An organization is redesigning its information security program to better align with business objectives. The CISO reports to the CIO, but business leaders feel security decisions are too IT-centric. Which reporting structure would best address this concern?

Accepted Answer

CISO reports directly to the CEO or Board of Directors.. Reporting directly to the CEO or Board of Directors elevates the CISO above IT operations, ensuring security decisions are driven by business risk rather than IT convenience. This structure gives the CISO organizational independence and a direct voice in strategic decisions, directly addressing the concern that security is 'too IT-centric.' It also aligns with governance best practices from ISO 27001 and NIST CSF, which emphasize independent security oversight.

Answer

CISO reports to the Chief Risk Officer (CRO).

Answer

CISO reports to the Chief Operating Officer (COO).

Answer

CISO continues reporting to CIO but with a dotted line to the Board.

Question 8

A security manager is developing metrics for the C-suite dashboard. Which combination of metrics would provide the best view of security program effectiveness, including both leading and lagging indicators?

Accepted Answer

Phishing click rate and mean time to detect (MTTD). Phishing click rate is a leading indicator that measures user awareness and proactive security posture, while mean time to detect (MTTD) is a lagging indicator that reflects the efficiency of detection processes. Together, they provide a balanced view of program effectiveness for executive oversight.

Answer

Breach count and number of security tools deployed

Answer

Patch compliance and number of vulnerabilities identified

Answer

Number of security incidents and percentage of budget spent

Question 9

During a third-party risk assessment, the security team discovers that a critical vendor has subcontracted data processing to another company without notification. This represents which type of risk?

Accepted Answer

Nth-party risk. Nth-party risk refers to the risk introduced by any external party beyond the primary vendor, including subcontractors, their subcontractors, and so on. In this scenario, the critical vendor subcontracted data processing to another company without notification, creating a risk from a party that is not the primary vendor but is part of the extended supply chain. This is a classic example of Nth-party risk because the exact number of parties (e.g., fourth, fifth) is not specified, and the term 'Nth' encompasses any level of subcontracting beyond the first party.

Answer

Fourth-party risk

Answer

Inherent risk

Answer

Residual risk

Question 10

An organization wants to implement a defense-in-depth strategy for its web application. Which set of controls best exemplifies this approach?

Accepted Answer

Web application firewall (WAF), input validation, and security awareness training. Defense-in-depth uses multiple layers: network, host, application, and monitoring controls.

Answer

Single sign-on and multi-factor authentication

Answer

Encryption at rest and in transit

Answer

Intrusion detection system and vulnerability scanner

Question 11

A security manager needs to justify an increase in the security budget to the board. The current budget is 0.15% of revenue. Which approach would most effectively demonstrate the need for additional funding?

Accepted Answer

Show that the budget is below the industry benchmark of 0.2-0.5% of revenue and detail the risks of underfunding.. It combines two persuasive elements that boards respond to: an external, objective benchmark (industry peers spend 0.2–0.5% of revenue) and a direct link to the risks of underfunding. This frames the request not as an arbitrary increase but as closing a competitive and risk-management gap. The board can easily see that the current 0.15% is below the norm and that the shortfall translates into specific, material risks. This approach aligns security spending with business strategy and governance expectations, which is exactly what CISM emphasizes.

Answer

Compare the budget to last year's spending and note the increase in threats.

Answer

Present a cost-benefit analysis showing how additional investment reduces breach probability and potential loss.

Answer

Highlight recent high-profile breaches in the industry.

Question 12

Which THREE components are essential for a comprehensive third-party risk management (TPRM) program?

Accepted Answer

Ongoing monitoring. Ongoing monitoring (B) is essential because third-party risk is continuous — you must track vendor security posture, breaches, financial health, and compliance changes throughout the relationship, not just at intake. Onboarding risk assessment (C) is essential because it establishes the initial due diligence and tiering of a vendor before any data or system access is granted, forming the baseline for all later controls. Annual reassessment (D) is essential because it provides a recurring, formal re-evaluation of each vendor's risk, ensuring that changes in scope, criticality, or threat landscape are captured and remediated on a defined cadence. Vendor product marketing review (A) is not a TPRM component; marketing materials are promotional and do not constitute a risk, security, or compliance control, so it does not belong in the program.

Answer

Vendor product marketing review

Question 13

Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?

Accepted Answer

Phishing click rate. Phishing click rate is a leading indicator because it measures user behavior and susceptibility before an actual breach occurs, providing predictive insight into the effectiveness of security awareness training. A declining click rate indicates improved awareness and reduced likelihood of successful phishing attacks. Leading indicators are proactive metrics that signal future outcomes, unlike lagging indicators that measure past events.

Answer

Number of breaches

Answer

Number of security incidents

Answer

Mean time to detect (MTTD)

Question 14

A security manager is developing metrics for the executive dashboard. Which combination of metrics provides a balanced view of security program performance?

Accepted Answer

Phishing click rate and mean time to detect (MTTD). A balanced dashboard should include both leading and lagging indicators to show current effectiveness and past outcomes.

Answer

Budget spent and number of security tools deployed

Answer

Patch compliance percentage and number of phishing simulation clicks

Answer

Number of security incidents and mean time to respond (MTTR)

Question 15

A CISO wants to present a high-level security status to the board using a one-page dashboard. Which of the following metrics is MOST appropriate for this audience?

Accepted Answer

Phishing click rate and patch compliance percentage. Leading indicators like phishing click rate and patch compliance are actionable and forward-looking, suitable for board-level oversight.

Answer

Mean time to detect (MTTD) for incidents

Answer

Detailed vulnerability counts by severity

Answer

Total number of security controls implemented

Question 16

Which of the following is a leading indicator of security program effectiveness?

Accepted Answer

Access review completion rate. Leading indicators measure proactive security posture; access review completion rate indicates how well entitlements are managed.

Answer

Number of data breaches

Answer

Cost of a data breach

Answer

Mean time to respond (MTTR)

Question 17

In a security operations center (SOC), which function is PRIMARILY responsible for analyzing alerts and determining whether they represent actual security incidents?

Accepted Answer

Tier 2 SOC analyst. Tier 2 SOC analysts are primarily responsible for deep-dive analysis of alerts escalated from Tier 1, using threat intelligence, log correlation, and forensic techniques to determine if an alert represents a genuine security incident. They possess the technical expertise to differentiate false positives from true positives by examining raw packet captures, endpoint artifacts, and SIEM event details that Tier 1 analysts may lack the context or authority to investigate fully.

Answer

Tier 1 SOC analyst

Answer

Incident response manager

Answer

Security architect

Question 18

An organization uses ISO 27001 Annex A as its control framework. During a risk assessment, a control weakness is identified that could lead to a high-impact data breach. However, implementing the recommended control is cost-prohibitive. Which approach BEST addresses this situation?

Accepted Answer

Implement a compensating control that provides equivalent protection. When a recommended control is cost-prohibitive, ISO 27001 (and risk management best practice) requires that the organization still address the risk. A compensating control provides an alternative measure that achieves a similar risk reduction, allowing the organization to meet the intent of the original control without the prohibitive cost. This is explicitly recognized in ISO 27001 as an acceptable approach when a control cannot be implemented as specified. It is the best answer because it maintains security while being feasible.

Answer

Transfer the risk through cyber insurance

Answer

Reduce the risk rating to justify not implementing

Answer

Accept the risk without further action

Question 19

A security manager is designing a metrics dashboard for the CISO. Which TWO metrics are leading indicators of security performance? (Select TWO)

Accepted Answer

Patch compliance percentage. Patch compliance percentage (A) is a leading indicator because it measures the preventive state of systems before a vulnerability is exploited, showing how well the organization is reducing its attack surface in advance. Phishing click rate (E) is also a leading indicator because it quantifies user susceptibility to social engineering, predicting the likelihood of future credential compromise or malware infection. By contrast, the number of security incidents (B) and number of data breaches (C) are lagging indicators, since they report events that have already occurred. Mean time to detect (D) is likewise a lagging indicator, as it measures response performance only after an incident has already happened.

Answer

Number of security incidents

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 20

Which of the following is a leading indicator of security program effectiveness?

Accepted Answer

Phishing click rate. Leading indicators predict future security performance, and phishing click rate is a proactive measure that can be improved before a breach occurs.

Answer

Mean time to detect (MTTD)

Answer

Breach count

Answer

Number of security incidents