CISM Information Security Programme Practice Test 11 — 15 Questions

Question 1

An organization is designing a security awareness program. Which TWO of the following should be included for developers?

Accepted Answer

Threat modeling techniques. Developers need secure coding and threat modeling to build secure applications.

Answer

Physical security procedures

Answer

Social engineering defense for executives

Answer

General phishing awareness

Question 2

A security manager is designing a security awareness program for a mid-sized organization. Which of the following is the MOST effective approach to ensure that training is relevant to different employee roles?

Accepted Answer

Provide role-based training that addresses specific risks for each job function.. Role-based training tailors content to specific job functions, making it more relevant and effective than generic training. Developers need secure coding, executives need social engineering awareness, and all staff need basic awareness.

Answer

Deliver the same annual training to all employees to ensure consistency.

Answer

Focus only on senior executives since they are the primary targets of social engineering.

Answer

Conduct quarterly phishing simulations without any formal training.

Question 3

An organization is implementing a security controls framework based on NIST SP 800-53. The CISO wants to prioritize controls that will provide the greatest risk reduction for critical assets. Which approach should be used to select the initial set of controls?

Accepted Answer

Apply the critical controls first, focusing on those that address the highest risks.. Applying critical controls first, such as those from the CIS Critical Security Controls, ensures that the most impactful controls are implemented early to reduce risk.

Answer

Select all controls from the framework to achieve full compliance.

Answer

Implement business-enabling controls before any other controls.

Answer

Choose compensating controls to replace all technical controls.

Question 4

A security manager is developing a security scorecard for the C-suite. Which combination of metrics would be MOST appropriate for a one-page dashboard?

Accepted Answer

Patch compliance percentage and mean time to detect incidents.. A one-page dashboard for the C-suite should include both leading and lagging indicators that provide a high-level view of security posture, such as patch compliance (leading) and mean time to detect (lagging).

Answer

Detailed vulnerability counts by severity and system owner.

Answer

Number of security awareness training sessions completed.

Answer

List of all third-party vendors and their risk ratings.

Question 5

An organization with a mature security program is reviewing its budget allocation. The board has asked the CISO to justify a proposed increase. Which of the following provides the STRONGEST justification for the security budget?

Accepted Answer

Breach avoidance value, estimating the cost of incidents that were prevented.. Breach avoidance value quantifies the financial impact of prevented incidents, providing a direct link between security investment and risk reduction, which is compelling to the board.

Answer

Benchmarking against industry peers showing that the proposed budget is below average.

Answer

Operational efficiency gains from automation of security processes.

Answer

Compliance with all regulatory requirements to avoid fines.

Question 6

A security architect is designing a defense-in-depth strategy for a financial institution. Which TWO of the following are essential components of a defense-in-depth approach?

Accepted Answer

Network segmentation to isolate critical systems.. Defense-in-depth uses multiple layers of security controls. Network segmentation limits lateral movement, and endpoint detection provides visibility at the host level.

Answer

A single, strong firewall at the network perimeter.

Answer

A single sign-on (SSO) solution for all applications.

Answer

Annual penetration testing as the primary security control.

Question 7

A CISO is establishing a vendor risk management (TPRM) program. Which THREE of the following are key components of an effective TPRM program?

Accepted Answer

Exit procedures to ensure data is returned or destroyed.. A TPRM program includes onboarding risk assessment, ongoing monitoring, and exit procedures to manage risks throughout the vendor lifecycle.

Answer

Performing a single annual assessment for all vendors.

Answer

Requiring all vendors to have ISO 27001 certification.

Question 8

A security manager is designing a security awareness program. Which TWO metrics are leading indicators of program effectiveness?

Accepted Answer

Knowledge assessment scores from training.. Leading indicators predict future performance. Phishing click rate and knowledge assessment scores measure current behavior and knowledge, which can predict future incidents.

Answer

Number of security incidents reported by employees.

Answer

Number of phishing emails reported by users.

Answer

Mean time to detect (MTTD) a phishing attack.

Question 9

An organization is implementing CIS Controls v8. Which THREE of the following are implementation groups (IGs) defined in the CIS Controls?

Accepted Answer

IG1: Basic cyber hygiene for small organizations.. CIS Controls v8 defines three implementation groups: IG1 (basic cyber hygiene), IG2 (intermediate), and IG3 (advanced) based on organization size and risk.

Answer

IG4: Cloud-specific controls for cloud-first organizations.

Answer

IG0: Minimal controls for non-critical systems.

Question 10

A CISO is building a security operations center (SOC). Which TWO of the following are primary functions of a SOC?

Accepted Answer

Continuous monitoring of security events and alerts.. A SOC's core functions are monitoring for threats and responding to incidents. Vulnerability management and architecture are separate functions.

Answer

Conducting penetration tests of critical applications.

Answer

Performing vulnerability scans and patch management.

Answer

Developing secure coding standards for developers.

Question 11

An organization is implementing a security champions program to improve application security. Which THREE of the following are key success factors for such a program?

Accepted Answer

Ensuring that champions have authority to stop releases with critical vulnerabilities.. Security champions need dedicated time, training, and management support to be effective. Champions act as liaisons between security and development.

Answer

Rotating champions every quarter to maximize exposure.

Answer

Selecting champions only from senior management.

Question 12

A security manager is designing a security budget for a mid-sized company. Which TWO of the following are typical components of a security budget?

Accepted Answer

Technology costs for security tools and infrastructure.. Security budgets typically include personnel costs (salaries) and technology costs (tools, software). Training and licensing are also common but may be subsumed under personnel or technology.

Answer

Legal fees for contract reviews.

Answer

Marketing budget for security awareness campaigns.

Answer

Office renovation for security operations center.

Question 13

A CISO is evaluating metrics for an executive security report. Which TWO of the following are lagging indicators?

Accepted Answer

Mean time to detect (MTTD) security incidents.. Lagging indicators reflect past incidents or performance. Breach count and mean time to detect (MTTD) are outcome-based metrics that show what has already happened.

Answer

Number of security awareness training sessions held.

Answer

Patch compliance rate for critical systems.

Answer

Percentage of employees who completed security training.

Question 14

An organization is implementing an identity and access management (IAM) program. Which THREE of the following are key components of a mature IAM program?

Accepted Answer

Role-based access control (RBAC) aligned with job functions.. Mature IAM includes lifecycle management (provisioning/de-provisioning), role-based access control (RBAC), and periodic access reviews to ensure least privilege.

Answer

Biometric authentication for all users.

Answer

Single sign-on (SSO) for all cloud applications.

Question 15

A security manager is designing a vulnerability management program. Which TWO of the following are essential processes?

Accepted Answer

Regular vulnerability scanning of all systems.. Vulnerability management includes regular scanning and a prioritization process to remediate based on risk. Patching is part of remediation, but scanning and prioritization are foundational.

Answer

Immediate patching of all vulnerabilities within 24 hours.

Answer

Vulnerability disclosure program for external researchers.

Answer

Penetration testing of all applications annually.