CISM Information Security Programme Practice Test 13 — 15 Questions

Question 1

A global retailer's security programme has grown organically: each region maintains its own policies, risk register, and incident process. The board asks the CISO to align the programme with a recognized standard so performance can be compared across regions. Which action should the CISO take FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a gap assessment of current regional practices against the chosen framework. Comparability across regions requires a common reference framework plus a factual baseline of where each region stands against it. A gap assessment delivers both, giving the CISO evidence to prioritize remediation, allocate budget, and report progress to the board. Mandating uniform policy, buying tooling, or auditing everything at once all presume knowledge the CISO does not yet have and skip the diagnostic step that makes the board's comparison meaningful.

Answer

Mandate that all regions immediately adopt the headquarters policy set unchanged

Answer

Procure an integrated GRC platform to consolidate all regional risk registers

Answer

Commission an external audit of every regional security control simultaneously

Question 2

A newly appointed CISO at a healthcare provider is establishing the information security programme's governance structure. Executive management asks who should ultimately approve the organisation's information security policy. Who is MOST appropriate to approve it?

Accepted Answer

Executive management, because the policy sets enterprise-wide security expectations and demonstrates top-level commitment.. The top-level information security policy sets expectations for the entire organisation and expresses management's risk appetite, so it must be approved by executive management. This provides the authority for enforcement and demonstrates visible commitment. The CISO drafts and maintains it, IT implements it, and internal audit independently assesses compliance against it.

Answer

The CISO, because they own the information security programme and are accountable for its policies.

Answer

The internal audit function, because it independently verifies that policy requirements are being met.

Answer

The IT operations manager, because they implement most of the technical controls described in the policy.

Question 3

A healthcare provider's security programme has grown organically, and the CISO now wants to formalize how security requirements are integrated into every new IT project. Which activity should the CISO implement to achieve this?

Accepted Answer

Require a security risk assessment as a gate in the system development life cycle (SDLC).. Integrating security into the SDLC through a formal risk assessment gate ensures that security requirements are considered at the right time, with accountability and documentation. It transforms security from an afterthought into a standard project step, enabling consistent risk-based decisions. The other activities are valuable but do not create the structured, repeatable integration the CISO is seeking.

Answer

Deploy a vulnerability scanner across the development environment.

Answer

Create a security awareness campaign for project managers.

Answer

Perform an annual penetration test on all production systems.

Question 4

A security manager is drafting the information security strategy for a multinational retailer. Executive leadership has asked how the strategy should be structured to remain aligned with business objectives over the next three years. Which approach BEST addresses this request?

Accepted Answer

Derive the security strategy from the organization's business strategy and refresh it through an annual governance review tied to business planning.. Strategy alignment means the security programme exists to enable business objectives, so the strategy must be derived from the business strategy and revisited on the same planning cadence. Governance review tied to business planning keeps risk appetite, funding, and priorities synchronized. Technical artefacts such as penetration tests or competitor frameworks inform tactics but cannot define strategic direction for the organization.

Answer

Base the strategy on the most recent penetration test findings and reissue it whenever a critical vulnerability is discovered.

Answer

Let the IT steering committee define the strategy and forward it to the CISO for technical review before board approval.

Answer

Adopt the security framework used by the largest competitor and implement its controls in the same sequence.

Question 5

A newly appointed CISO is establishing the information security governance framework for a multinational financial services firm. The board wants assurance that security activities align with business objectives and regulatory obligations. Which action should the CISO take FIRST to establish effective governance?

Accepted Answer

Define and obtain board approval for an information security charter that articulates the mandate, authority, and scope of the security function.. Effective information security governance begins with a board-approved charter that defines the security function's mandate, authority, and scope. This artifact legitimises subsequent strategy, policy, metrics, and control investment, and ensures alignment with business objectives and regulatory obligations. Technical deployments, testing, and policy updates are downstream activities that should reflect the governance framework rather than precede it.

Answer

Conduct a full penetration test of the external attack surface and report findings to the board.

Answer

Immediately update all security policies to reflect ISO/IEC 27001 requirements and distribute them to staff.

Answer

Deploy an enterprise SIEM and begin centralising log collection from critical systems.

Question 6

A newly appointed CISO at a mid-sized financial firm discovers that the information security programme has been operating without a formally approved charter. Business units frequently bypass security review, and the security team lacks authority to enforce policy. Which action should the CISO take FIRST to establish the programme's foundation?

Accepted Answer

Obtain executive and board approval for a formal information security charter that defines scope, authority, and accountability.. Establishing a formal, executive-approved charter gives the information security programme its mandate, scope, and enforcement authority. In this scenario, business units ignore the security team because it lacks organizational legitimacy, not because controls or policies are missing. A charter is the foundational governance artifact from which policy, risk assessment, and control deployment derive their authority.

Answer

Deploy an automated compliance scanning tool across all business units to identify policy deviations.

Answer

Develop a comprehensive set of security policies and distribute them to all department heads for immediate adoption.

Answer

Conduct a full risk assessment of all critical business systems to quantify the current risk exposure.

Question 7

A financial services firm is defining the scope of its information security management system. The CISO must decide which assets and processes fall under the programme's governance. Which criterion should PRIMARILY drive scoping decisions?

Accepted Answer

The criticality of the business processes and information the assets support. Governance scope should be anchored to business criticality and information sensitivity, because that is where disruption, regulatory breach, or data loss would cause the greatest harm. Location, user population, and sourcing model are attributes that shape how controls are applied once an asset is in scope, but none of them reliably identifies which assets warrant programme governance in the first place.

Answer

The physical location of the data center hosting each system

Answer

The number of users who have accounts on each application

Answer

Whether the system was purchased or developed in-house

Question 8

A financial services firm has completed a business impact analysis (BIA). The CISO must now ensure the information security programme's recovery priorities are consistent with the BIA results. Which action should the CISO take NEXT?

Accepted Answer

Update the disaster recovery plan to reflect the recovery time objectives (RTOs) and recovery point objectives (RPOs) identified in the BIA.. The BIA defines critical processes and their RTOs and RPOs. To make the security programme consistent with these findings, the CISO must ensure disaster recovery and related plans are updated so that systems and data can be restored within the required timeframes. This is a direct, necessary step before validating or transferring risk.

Answer

Conduct a penetration test of the disaster recovery site to validate its security posture.

Answer

Launch a security awareness programme focused on business continuity responsibilities.

Answer

Increase the cybersecurity insurance coverage to transfer residual risk identified in the BIA.

Question 9

A CISO is designing the security programme's organisational structure for a multinational manufacturer. The CISO wants to ensure the structure supports both central governance and responsiveness to regional regulatory requirements. Which TWO structural elements BEST support these goals? (Choose two.)

Accepted Answer

A central security governance function that sets policy, standards and the risk assessment methodology used worldwide.. A federated model works best here: central governance sets consistent policy, standards and methodology, while regional security officers within the security reporting line adapt implementation to local regulation and feed requirements back. This balances enterprise consistency with local responsiveness. Full delegation, complete outsourcing or fully independent country teams each break either central accountability or local regulatory fit.

Answer

Outsourcing the entire security function to a managed security service provider so that regional staffing costs are eliminated.

Answer

Delegating all security decision-making to regional business unit leaders so that each can respond quickly to local market conditions.

Answer

Creating a separate security team in every country, each reporting to that country's general manager with no common standards.

Question 10

A retail organisation's security steering committee is prioritising remediation of findings from a recent risk assessment. The CISO must recommend which risk to address FIRST, given limited resources. Which factor should PRIMARILY drive the prioritisation decision?

Accepted Answer

The risk whose exposure most exceeds the organisation's defined risk appetite and tolerance.. Prioritisation should reflect the gap between current exposure and the board-approved risk appetite and tolerance. That gap defines which risks the organisation has formally committed to treat, and it integrates likelihood, impact, and business context rather than relying on a single dimension such as loss magnitude, audit attention, or technical severity. Aligning remediation with risk appetite keeps security investment defensible to executive stakeholders.

Answer

The risk with the largest potential financial loss in the register.

Answer

The risk that the external auditor flagged in the most recent report.

Answer

The risk with the highest technical severity score from the vulnerability scanner.

Question 11

A newly appointed CISO at a healthcare provider must establish an information security governance structure. Which action should be performed FIRST?

Accepted Answer

Define the security strategy and obtain executive approval for the governance framework and charter.. Governance is about direction, accountability, and decision rights. A newly appointed security leader must first secure executive approval of a strategy and governance charter so the programme has authority and alignment. Technical assessments, tools, and insurance are treatments applied once governance establishes priorities, risk appetite, and responsibilities, and performing them first inverts the correct sequence.

Answer

Commission a penetration test of the electronic health record system.

Answer

Purchase cyber insurance to transfer residual risk to a third party.

Answer

Deploy an endpoint detection and response tool across all clinical workstations.

Question 12

A CISO is building the programme's risk treatment capability and wants to ensure that identified risks are handled consistently across business units. Which TWO activities are essential components of an effective risk treatment process? (Choose two.)

Accepted Answer

Documenting the selected treatment option and the residual risk accepted by the business owner. Consistent risk treatment requires that someone with authority owns each risk and that the chosen response, including any accepted residual risk, is documented. Ownership drives decisions and accountability; documentation preserves the audit trail and confirms acceptance happened at the right level. Full mitigation mandates, delegation to operations, and shifting rating scales all undermine consistency and either stall the process or make its outputs incomparable across business units.

Answer

Delegating all treatment decisions to the security operations team for speed

Answer

Requiring every identified risk to be mitigated to zero before the register can be closed

Answer

Recalculating every risk score monthly using a different qualitative scale each time

Question 13

An organization's security steering committee includes representatives from business units, IT, legal, and risk management. The CISO must decide which function this committee should perform within the information security programme.

Accepted Answer

Approve the strategic direction of the security programme and prioritize security initiatives against business objectives.. A security steering committee is a governance body whose purpose is to align the security programme with business strategy, approve direction, and prioritize initiatives using cross-functional input. Its membership of business, IT, legal, and risk leaders fits strategic decision-making. Operational execution and independent audit are deliberately separated from this body to preserve both efficiency and objectivity.

Answer

Perform daily monitoring of security alerts and coordinate the response to detected incidents.

Answer

Conduct technical vulnerability assessments of critical systems and track remediation activities.

Answer

Independently audit the security programme's controls and report findings directly to external regulators.

Question 14

A security manager is defining the structure of a new information security programme. The CISO has asked for a clear separation of duties between governance and execution. Which TWO of the following activities are typically governance responsibilities rather than operational execution? (Choose two.)

Accepted Answer

Reviewing and approving the enterprise risk register and accepting residual risks.. Governance involves setting direction, defining risk tolerance, and providing oversight, which includes approving policy and risk appetite and reviewing and accepting residual risks. Operational tasks such as configuring IDS signatures, monitoring dashboards, and running vulnerability scans execute the strategy and controls defined by governance, and are therefore not governance responsibilities.

Answer

Performing vulnerability scans on internal network segments.

Answer

Monitoring security dashboards and triaging alerts on a daily basis.

Answer

Configuring and tuning intrusion detection system (IDS) signatures.

Question 15

An organisation is preparing to adopt a control framework to structure its information security programme. The CISO must select an approach that provides a comprehensive catalogue of controls while allowing tailoring to the organisation's risk profile. Which approach BEST meets this requirement?

Accepted Answer

Adopt a comprehensive control catalogue as the baseline, then tailor control selection and implementation using the organisation's risk assessment results.. Control frameworks are designed to be adopted as a baseline and then tailored through risk assessment, which gives both completeness and proportionality. Implementing everything at maximum strength wastes resources, letting each unit choose its own framework destroys comparability, and a purely bespoke set risks blind spots that established catalogues are designed to prevent.

Answer

Build a bespoke control set from scratch based on internal incident history, avoiding external frameworks that may not reflect the organisation's environment.

Answer

Implement every control in the chosen catalogue to the highest specified level so that no gap can ever be identified by an auditor.

Answer

Allow each business unit to select controls from any framework it prefers, provided the unit documents its choices in its own risk register.