CISM Information Security Programme Practice Test 2 — 15 Questions

Question 1

A CISO is designing the security organization for a financial services firm. Which reporting structure is most likely to ensure the independence and authority of the information security function?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board provides independence from operational pressures, allowing the CISO to enforce security without conflict of interest. Reporting to the CIO can create conflicts, as security may be subordinated to IT goals. Reporting to legal or risk committees may lack operational authority.

Answer

Reporting to the risk committee

Answer

Reporting to the CIO

Answer

Reporting to the chief legal officer

Question 2

Which of the following security team roles is primarily responsible for designing and implementing security solutions to protect an organization's systems and data?

Accepted Answer

Security architect. The security architect designs the overall security structure, including policies, technologies, and controls. Other roles focus on operations, analysis, or governance.

Answer

Security analyst

Answer

GRC analyst

Answer

Penetration tester

Question 3

An organization is implementing a security controls framework and must decide on prioritization. According to defense-in-depth principles, which approach should be taken first?

Accepted Answer

Prioritize critical controls that address the most significant risks. Defense-in-depth starts with critical controls that protect against the most likely threats, often following frameworks like CIS Critical Controls, which prioritize foundational controls.

Answer

Select all controls from NIST SP 800-53 without prioritization

Answer

Deploy business-enabling controls that support operations

Answer

Implement compensating controls to address gaps in existing controls

Question 4

Which of the following is a leading indicator for security performance?

Accepted Answer

Patch compliance percentage. Leading indicators are proactive measures that predict future performance. Patch compliance is a leading indicator because it shows current security posture that influences future incidents.

Answer

Mean time to recover (MTTR)

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 5

A security awareness program includes phishing simulations. Which metric best measures the long-term effectiveness of the program?

Accepted Answer

Click rate trend over multiple simulation cycles. A sustained downward trend in click rate over time indicates improved awareness and behavior, while single-click rate or reported emails may vary.

Answer

Number of phishing simulation campaigns per year

Answer

Pass rate on phishing simulation knowledge test

Answer

Number of employees who report phishing emails

Question 6

In a vendor tiering system for third-party risk management, which factor is most critical for determining the tier?

Accepted Answer

Vendor's data access and service criticality. The vendor's access to sensitive data and the criticality of the service to business operations are the primary factors for tiering, as they directly impact risk exposure.

Answer

Vendor's annual revenue

Answer

Vendor's geographic location

Answer

Vendor's number of employees

Question 7

An organization's security budget is 12% of the IT budget. Which of the following best describes the maturity of this security program?

Accepted Answer

Mature, as it aligns with the 10-15% benchmark. Industry benchmarks indicate that mature security programs allocate 10-15% of IT budget to security. 12% falls within this range, suggesting a mature program.

Answer

Immature, because security should be less than 5% of IT budget

Answer

Mature, but only if it also includes a separate budget for compliance

Answer

Overbudgeted, as the ideal is 8% of IT budget

Question 8

A security manager is designing an executive security report. Which content is most appropriate for a one-page C-suite dashboard?

Accepted Answer

Top security risks and key performance indicators with trends. C-suite executives need high-level strategic insights, not operational details. Top risks and key metrics (e.g., risk posture, critical incidents) are suitable for a dashboard.

Answer

Detailed logs of all security incidents from the past week

Answer

List of all vulnerabilities found during the last scan

Answer

Full results of the latest phishing simulation

Question 9

Which control selection framework includes implementation groups (IG1, IG2, IG3) that help organizations prioritize controls based on their risk profile?

Accepted Answer

CIS Controls v8. CIS Controls v8 organizes controls into Implementation Groups (IG1, IG2, IG3) to guide prioritization. NIST SP 800-53 uses families, and ISO 27001 uses Annex A controls.

Answer

COBIT 2019

Answer

NIST SP 800-53

Answer

ISO 27001 Annex A

Question 10

A company wants to establish a security champions program. What is the primary benefit of embedding security champions in development teams?

Accepted Answer

Ensuring security is considered during the design and development phases. Security champions act as liaisons, promoting secure coding practices and facilitating communication between security and development, thereby integrating security earlier.

Answer

Eliminating the requirement for a dedicated security team

Answer

Reducing the need for automated security testing tools

Answer

Reducing the frequency of penetration testing

Question 11

Which of the following is a key objective of a Security Operations Center (SOC)?

Accepted Answer

Monitoring and responding to security incidents. The SOC's primary objectives include monitoring, detection, and response to security incidents. Risk assessment is typically a GRC function, and policy creation is a governance function.

Answer

Conducting risk assessments

Answer

Developing security policies

Answer

Managing user access rights

Question 12

An organization is implementing a data security program. Which of the following is the most effective approach to protect sensitive data at rest?

Accepted Answer

Encrypting sensitive data stored in databases and file shares. Encryption is a fundamental control for protecting data at rest. While DLP and access controls are important, encryption provides direct confidentiality protection.

Answer

Implementing strict access control lists (ACLs)

Answer

Implementing data loss prevention (DLP) solutions

Answer

Conducting regular vulnerability scans on servers

Question 13

A CISO is evaluating security metrics for reporting to the board. Which TWO of the following are leading indicators?

Accepted Answer

Phishing simulation click rate. Leading indicators are proactive measures. Phishing click rate predicts future breaches, and patch compliance indicates current vulnerability posture. Breach count and MTTD are lagging, and number of security tools is not a performance metric.

Answer

Mean time to detect (MTTD) incidents

Answer

Number of data breaches in the past quarter

Answer

Number of security tools deployed

Question 14

A company is designing a third-party risk management (TPRM) program. Which THREE of the following are essential components of the ongoing monitoring phase for a critical vendor?

Accepted Answer

Annual reassessment of the vendor's security controls. Ongoing monitoring includes continuous assessment of security posture. Annual reassessment is part of the cycle, but ongoing monitoring includes more frequent checks. Contractual requirements are set during onboarding, not monitored ongoing. Exit procedures are for termination.

Answer

Contractual requirement for data encryption

Answer

One-time onboarding risk assessment

Question 15

Which TWO of the following are typical components of a security awareness program?

Accepted Answer

Role-based security training. Phishing simulations and role-based training are core components of awareness programs. Penetration testing is a technical assessment, vulnerability scanning is technical, and security architecture is a design function.

Answer

Vulnerability scanning

Answer

Security architecture design

Answer

Penetration testing