CISM Information Security Programme Practice Test 10 — 15 Questions

Question 1

Which role within a security team is primarily responsible for designing and reviewing security architectures to ensure alignment with business requirements and security standards?

Accepted Answer

Security architect. The security architect designs and reviews the security architecture, ensuring it meets business needs and security requirements. Other roles focus on operations, analysis, or awareness.

Answer

SOC analyst

Answer

GRC analyst

Answer

Security analyst

Question 2

An organization is developing a security scorecard for the CISO. Which of the following is a leading indicator that would be most useful for predicting future security incidents?

Accepted Answer

Percentage of systems compliant with patch SLAs. A leading indicator predicts future outcomes, whereas lagging indicators measure past events. The percentage of systems compliant with patch SLAs is a leading indicator because it reflects the current state of vulnerability management, which directly influences the likelihood of future security incidents. High compliance with patching reduces the attack surface and is a proactive measure.

Answer

Mean time to respond (MTTR) to incidents

Answer

Number of security incidents in the past quarter

Answer

Total cost of security incidents

Question 3

Which of the following is the primary objective of a security champions programme?

Accepted Answer

To embed security advocates within development teams. The primary objective of a security champions programme is to embed security advocates within development teams, creating a decentralized network of individuals who promote secure practices and act as a liaison between security and development. This helps scale security knowledge and culture without adding full-time security staff to every team. Enforcement, phishing simulations, and escalation paths are not the core purpose of the programme.

Answer

To enforce security policies across the organization

Answer

To conduct phishing simulations for employees

Answer

To provide an escalation path for security incidents

Question 4

In a third-party risk management programme, what is the primary purpose of vendor tiering?

Accepted Answer

To prioritize which vendors require more rigorous security assessments. Vendor tiering is a risk-based classification process that segments third parties according to the criticality of the data they handle, the level of access they have to systems, and the potential business impact of a breach or failure. The primary purpose is to allocate limited security assessment resources efficiently by focusing the most rigorous due diligence, contractual controls, and ongoing monitoring on the highest-risk vendors. This ensures that oversight is proportionate to risk rather than uniform, which is a core CISM principle.

Answer

To assign responsibility for vendor management to different teams

Answer

To ensure all vendors receive the same level of oversight

Answer

To determine the vendor's pricing structure

Question 5

During a security architecture review, the security architect identifies that a new application stores sensitive customer data in plaintext in the database. The application owner argues that performance requirements prevent encryption. What is the most appropriate compensating control to reduce risk?

Accepted Answer

Database activity monitoring (DAM). Database activity monitoring (DAM) is the most appropriate compensating control because it provides real-time visibility into database transactions, detects anomalous access, and can alert on or block unauthorized queries — all without requiring encryption that might impact performance. DAM addresses the risk of plaintext data exposure by monitoring who accesses it and how, enabling detection and response even if encryption is not feasible.

Answer

Implement strong password policies for database access

Answer

Network segmentation to isolate the database server

Answer

Conduct more frequent vulnerability scans

Question 6

An organization wants to measure the effectiveness of its security awareness programme. Which metric is a leading indicator of improved security culture?

Accepted Answer

Number of phishing emails reported by employees. A leading indicator measures activities or behaviors that predict future outcomes. The number of phishing emails reported by employees is a leading indicator because it reflects increased security awareness and vigilance; employees are actively identifying and reporting suspicious emails, which can prevent incidents. This indicates a positive shift in security culture.

Answer

Number of security incidents attributed to human error

Answer

Percentage of employees who completed annual training

Answer

Average score on knowledge assessment tests

Question 7

A multinational organization is implementing a vendor risk management programme. Which THREE of the following should be included in the programme to effectively manage nth-party risk? (Select THREE.)

Accepted Answer

Include contractual clauses that require vendors to pass down security requirements to subcontractors. Option A is correct because nth-party risk arises from subcontractors, so contracts must include flow-down clauses that propagate the organization's security, privacy, and compliance requirements to those downstream parties. Option B is correct because including audit rights over subcontractors in vendor agreements gives the organization the contractual ability to verify nth-party controls directly or through the vendor, which is essential for oversight. Option D is correct because visibility into which subcontractors exist and their security posture is a prerequisite for assessing and managing nth-party risk; without disclosure, the organization cannot evaluate downstream exposure. Option C is not marked correct because conducting annual security assessments of all subcontractors is not a universally required or practical programme element; assessments should be risk-based and proportionate, not blanket annual reviews of every subcontractor. Option E is not marked correct because requiring vendors to obtain insurance for subcontractors addresses financial risk transfer only and does not by itself manage nth-party security risk.

Answer

Conduct annual security assessments of all subcontractors

Answer

Require vendors to obtain insurance for subcontractors

Question 8

In designing a security operations centre (SOC), which TWO functions are core to the SOC's responsibilities? (Select TWO.)

Accepted Answer

Security monitoring and detection. Option B, security monitoring and detection, is a core SOC responsibility because the SOC's primary mission is continuous 24x7 visibility over logs, network traffic, and endpoint telemetry using SIEM, IDS/IPS, and EDR to identify malicious activity. Option E, incident response, is also core because once detection occurs, the SOC triages, contains, eradicates, and recovers from incidents, coordinating escalation and forensic evidence handling. Together, monitoring/detection and incident response form the detect-and-respond loop that defines SOC operations. Vulnerability management (A) is typically owned by a vulnerability management or risk team, though the SOC may consume its output. Security awareness training (C) belongs to the security awareness/HR function, and security architecture design (D) is an engineering/architecture responsibility rather than a SOC operational function.

Answer

Vulnerability management

Answer

Security awareness training

Answer

Security architecture design

Question 9

Which of the following is the PRIMARY purpose of a security awareness program?

Accepted Answer

To reduce human-related security risks. The primary purpose of a security awareness program is to reduce human-related security risks by educating employees about threats, policies, and safe behaviors. Since humans are often the weakest link in security, awareness programs aim to change behavior and culture to prevent incidents like phishing, social engineering, and data mishandling. While compliance, visibility, and documentation are secondary benefits, the core objective is risk reduction.

Answer

To achieve compliance with regulatory requirements

Answer

To increase the security team's visibility

Answer

To document training completion for audits

Question 10

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this principle?

Accepted Answer

Network segmentation, intrusion detection systems, and full-disk encryption. Defense in depth requires multiple, layered controls across different domains so that if one fails, others still protect the asset. Network segmentation, intrusion detection systems, and full-disk encryption represent layers across network, monitoring, and data-at-rest controls, covering different attack vectors. This combination exemplifies the principle by providing preventive, detective, and protective controls that complement each other.

Answer

A single firewall with access control lists

Answer

Antivirus software on all endpoints

Answer

Physical locks on server room doors and CCTV

Question 11

A CISO is presenting security metrics to the board. Which of the following metrics would be MOST relevant for a one-page executive dashboard?

Accepted Answer

Breach count and associated financial impact. For a one-page executive dashboard, the board needs metrics that communicate business risk and financial impact in a language they understand. Breach count and associated financial impact (A) directly translates security performance into business terms — number of breaches and their monetary cost — which is what boards care about for fiduciary oversight. This metric ties security directly to organizational risk and financial exposure, making it the most relevant for executive-level reporting.

Answer

Mean time to detect (MTTD) for incidents

Answer

Number of firewall rule changes per month

Answer

Percentage of employees who completed training

Question 12

An organization uses CIS Controls v8. They are a small business with limited cybersecurity resources. Which implementation group (IG) should they prioritize?

Accepted Answer

IG1. CIS Controls v8 defines Implementation Group 1 (IG1) as the foundational set of safeguards appropriate for small organizations with limited cybersecurity resources and low data sensitivity. IG1 covers essential hygiene controls (inventory, patching, access control, malware defenses) that provide the highest risk reduction per unit of effort. A small business should implement IG1 first and only progress to IG2/IG3 as resources and risk profile grow.

Answer

All IGs simultaneously

Answer

IG3

Answer

IG2

Question 13

A security manager is selecting controls for a new application. Which of the following is the BEST approach for prioritization?

Accepted Answer

Prioritize critical controls that address the highest risks. Risk-based prioritization ensures that security resources are focused on the threats and vulnerabilities that could cause the most harm to the organization. By identifying and addressing the highest risks first, the security manager aligns controls with business objectives and maximizes risk reduction per unit of effort. This approach is a core principle of CISM and is consistent with frameworks like NIST RMF and ISO 27005.

Answer

Select controls based on vendor recommendations

Answer

Implement controls in the order of ease of deployment

Answer

Implement all controls simultaneously

Question 14

A company is designing a third-party risk management (TPRM) program. Which factor should PRIMARILY determine the tier of a vendor?

Accepted Answer

Type of data accessed and service criticality. The tier of a vendor in a TPRM program should be primarily determined by the type of data the vendor accesses and the criticality of the service they provide. These factors directly impact the organization's risk exposure and regulatory compliance obligations. Revenue, relationship length, and contract value do not necessarily correlate with risk.

Answer

Vendor's annual revenue

Answer

Length of business relationship

Answer

Contract value

Question 15

An information security manager needs to justify a budget increase. Which approach would be MOST effective for gaining executive approval?

Accepted Answer

Present ROI analysis showing breach avoidance savings. Executives respond to financial justification. ROI based on breach avoidance demonstrates value in monetary terms.

Answer

List all planned technology purchases

Answer

Describe the latest cyber threats

Answer

Show industry benchmarks for security spending