CISM Information Security Programme Practice Test 10 — 15 Questions

Question 1

In designing a security operations centre (SOC), which TWO functions are core to the SOC's responsibilities? (Select TWO.)

Accepted Answer

Security monitoring and detection. The SOC core functions include monitoring security events, detecting threats, and responding to incidents. Vulnerability management and security architecture are typically separate functions, though they may interact with the SOC.

Answer

Vulnerability management

Answer

Security awareness training

Answer

Security architecture design

Question 2

Which of the following is the PRIMARY purpose of a security awareness program?

Accepted Answer

To reduce human-related security risks. The primary purpose is to change employee behavior to reduce human-related security risks, such as phishing susceptibility.

Answer

To achieve compliance with regulatory requirements

Answer

To increase the security team's visibility

Answer

To document training completion for audits

Question 3

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this principle?

Accepted Answer

Network segmentation, intrusion detection systems, and full-disk encryption. Defense-in-depth uses multiple layers of controls. Network segmentation, IDS, and encryption provide preventive, detective, and corrective layers at different points.

Answer

A single firewall with access control lists

Answer

Antivirus software on all endpoints

Answer

Physical locks on server room doors and CCTV

Question 4

A CISO is presenting security metrics to the board. Which of the following metrics would be MOST relevant for a one-page executive dashboard?

Accepted Answer

Breach count and associated financial impact. Executives need high-level summary metrics. Breach count is a lagging indicator that directly communicates security effectiveness to the board.

Answer

Mean time to detect (MTTD) for incidents

Answer

Number of firewall rule changes per month

Answer

Percentage of employees who completed training

Question 5

An organization uses CIS Controls v8. They are a small business with limited cybersecurity resources. Which implementation group (IG) should they prioritize?

Accepted Answer

IG1. IG1 is the basic set of cyber hygiene controls designed for organizations with limited resources.

Answer

All IGs simultaneously

Answer

IG3

Answer

IG2

Question 6

A security manager is selecting controls for a new application. Which of the following is the BEST approach for prioritization?

Accepted Answer

Prioritize critical controls that address the highest risks. Prioritizing critical controls first ensures the most important risks are addressed before less critical ones.

Answer

Select controls based on vendor recommendations

Answer

Implement controls in the order of ease of deployment

Answer

Implement all controls simultaneously

Question 7

Which of the following is a LEADING indicator of security performance?

Accepted Answer

Patch compliance percentage. Leading indicators predict future performance. Patch compliance measures proactive security posture.

Answer

Cost of a data breach

Answer

Mean time to respond (MTTR)

Answer

Number of security incidents

Question 8

A company is designing a third-party risk management (TPRM) program. Which factor should PRIMARILY determine the tier of a vendor?

Accepted Answer

Type of data accessed and service criticality. Vendor tiering should be based on the risk they pose. Data access and service criticality directly affect organizational risk.

Answer

Vendor's annual revenue

Answer

Length of business relationship

Answer

Contract value

Question 9

An information security manager needs to justify a budget increase. Which approach would be MOST effective for gaining executive approval?

Accepted Answer

Present ROI analysis showing breach avoidance savings. Executives respond to financial justification. ROI based on breach avoidance demonstrates value in monetary terms.

Answer

List all planned technology purchases

Answer

Describe the latest cyber threats

Answer

Show industry benchmarks for security spending

Question 10

Which of the following BEST describes the role of a security architect in a security program?

Accepted Answer

Designing and reviewing security controls and solutions. The security architect designs security structures and ensures controls are integrated into systems and networks.

Answer

Managing user access requests

Answer

Conducting penetration tests

Answer

Monitoring security alerts and incidents

Question 11

Which of the following is the PRIMARY benefit of a security champions program?

Accepted Answer

Embedding security advocates in business units. Security champions act as liaisons within development teams, promoting security best practices and improving collaboration.

Answer

Reducing the need for security awareness training

Answer

Automating security testing

Answer

Eliminating third-party risks

Question 12

An organization uses ISO 27001 Annex A controls. During a risk assessment, they identify a need for a compensating control because the primary control is not feasible. What should the security manager do FIRST?

Accepted Answer

Document the risk and obtain management approval for the compensating control. Compensating controls require formal acceptance of the residual risk and approval by management to ensure accountability.

Answer

Accept the risk without any control

Answer

Remove the asset from scope

Answer

Implement the compensating control immediately

Question 13

Which of the following metrics would be MOST useful for measuring the effectiveness of a phishing simulation program?

Accepted Answer

Phishing click rate over time. Trending click rates over time show whether user behavior is improving, directly measuring program effectiveness.

Answer

Percentage of employees who failed the simulation

Answer

Time taken to complete the simulation

Answer

Number of phishing emails reported

Question 14

An organization is developing a vendor risk management program. Which TWO of the following should be included in the vendor onboarding risk assessment?

Accepted Answer

Verification of security certifications (e.g., SOC 2, ISO 27001). Onboarding assessment should evaluate inherent risk (data access) and security capabilities (certifications).

Answer

Vendor's employee satisfaction surveys

Answer

Review of vendor's financial stability

Answer

Vendor's marketing materials

Question 15

A security manager is developing a security scorecard for the CISO. Which THREE of the following metrics are considered LEADING indicators?

Accepted Answer

Patch compliance percentage. Leading indicators predict future incidents. Patch compliance, access review completion, and phishing click rate are proactive measures.

Answer

Mean time to detect (MTTD)

Answer

Number of data breaches