CISM Information Security Programme Practice Test 2 — 15 Questions

Question 1

An organization is designing a vendor tiering process for its third-party risk management program. Which TWO factors are MOST appropriate for determining a vendor's risk tier?

Accepted Answer

Type and sensitivity of data the vendor accesses. Data access and service criticality are primary factors for tiering vendors.

Answer

Vendor's geographic location

Answer

Number of employees at the vendor

Answer

Vendor's annual revenue

Question 2

A security manager is developing a set of objectives and key results (OKRs) for the security program. Which THREE would be considered effective security OKRs?

Accepted Answer

Objective: Enhance incident response. Key Result: Achieve 100% of incidents logged within 1 hour of detection.. OKRs should be measurable and tied to security outcomes.

Answer

Objective: Implement a new SIEM. Key Result: Deploy SIEM by Q3.

Answer

Objective: Increase security awareness. Key Result: Conduct quarterly phishing simulations.

Question 3

Which TWO budget components are considered 'services' in a typical security budget?

Accepted Answer

Penetration testing conducted by an external firm. Services include external consultants and managed security services, not personnel or technology purchases.

Answer

Security awareness training software license

Answer

Firewall hardware

Answer

Salaries for security staff

Question 4

A CISO is designing the security organization for a financial services firm. Which reporting structure is most likely to ensure the independence and authority of the information security function?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board provides independence from operational pressures, allowing the CISO to enforce security without conflict of interest. Reporting to the CIO can create conflicts, as security may be subordinated to IT goals. Reporting to legal or risk committees may lack operational authority.

Answer

Reporting to the risk committee

Answer

Reporting to the CIO

Answer

Reporting to the chief legal officer

Question 5

Which of the following security team roles is primarily responsible for designing and implementing security solutions to protect an organization's systems and data?

Accepted Answer

Security architect. The security architect designs the overall security structure, including policies, technologies, and controls. Other roles focus on operations, analysis, or governance.

Answer

Security analyst

Answer

GRC analyst

Answer

Penetration tester

Question 6

An organization is implementing a security controls framework and must decide on prioritization. According to defense-in-depth principles, which approach should be taken first?

Accepted Answer

Prioritize critical controls that address the most significant risks. Defense-in-depth starts with critical controls that protect against the most likely threats, often following frameworks like CIS Critical Controls, which prioritize foundational controls.

Answer

Select all controls from NIST SP 800-53 without prioritization

Answer

Deploy business-enabling controls that support operations

Answer

Implement compensating controls to address gaps in existing controls

Question 7

Which of the following is a leading indicator for security performance?

Accepted Answer

Patch compliance percentage. Leading indicators are proactive measures that predict future performance. Patch compliance is a leading indicator because it shows current security posture that influences future incidents.

Answer

Mean time to recover (MTTR)

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 8

A security awareness program includes phishing simulations. Which metric best measures the long-term effectiveness of the program?

Accepted Answer

Click rate trend over multiple simulation cycles. A sustained downward trend in click rate over time indicates improved awareness and behavior, while single-click rate or reported emails may vary.

Answer

Number of phishing simulation campaigns per year

Answer

Pass rate on phishing simulation knowledge test

Answer

Number of employees who report phishing emails

Question 9

In a vendor tiering system for third-party risk management, which factor is most critical for determining the tier?

Accepted Answer

Vendor's data access and service criticality. The vendor's access to sensitive data and the criticality of the service to business operations are the primary factors for tiering, as they directly impact risk exposure.

Answer

Vendor's annual revenue

Answer

Vendor's geographic location

Answer

Vendor's number of employees

Question 10

An organization's security budget is 12% of the IT budget. Which of the following best describes the maturity of this security program?

Accepted Answer

Mature, as it aligns with the 10-15% benchmark. Industry benchmarks indicate that mature security programs allocate 10-15% of IT budget to security. 12% falls within this range, suggesting a mature program.

Answer

Immature, because security should be less than 5% of IT budget

Answer

Mature, but only if it also includes a separate budget for compliance

Answer

Overbudgeted, as the ideal is 8% of IT budget

Question 11

A security manager is designing an executive security report. Which content is most appropriate for a one-page C-suite dashboard?

Accepted Answer

Top security risks and key performance indicators with trends. C-suite executives need high-level strategic insights, not operational details. Top risks and key metrics (e.g., risk posture, critical incidents) are suitable for a dashboard.

Answer

Detailed logs of all security incidents from the past week

Answer

List of all vulnerabilities found during the last scan

Answer

Full results of the latest phishing simulation

Question 12

Which control selection framework includes implementation groups (IG1, IG2, IG3) that help organizations prioritize controls based on their risk profile?

Accepted Answer

CIS Controls v8. CIS Controls v8 organizes controls into Implementation Groups (IG1, IG2, IG3) to guide prioritization. NIST SP 800-53 uses families, and ISO 27001 uses Annex A controls.

Answer

COBIT 2019

Answer

NIST SP 800-53

Answer

ISO 27001 Annex A

Question 13

A company wants to establish a security champions program. What is the primary benefit of embedding security champions in development teams?

Accepted Answer

Ensuring security is considered during the design and development phases. Security champions act as liaisons, promoting secure coding practices and facilitating communication between security and development, thereby integrating security earlier.

Answer

Eliminating the requirement for a dedicated security team

Answer

Reducing the need for automated security testing tools

Answer

Reducing the frequency of penetration testing

Question 14

Which of the following is a key objective of a Security Operations Center (SOC)?

Accepted Answer

Monitoring and responding to security incidents. The SOC's primary objectives include monitoring, detection, and response to security incidents. Risk assessment is typically a GRC function, and policy creation is a governance function.

Answer

Conducting risk assessments

Answer

Developing security policies

Answer

Managing user access rights

Question 15

An organization is implementing a data security program. Which of the following is the most effective approach to protect sensitive data at rest?

Accepted Answer

Encrypting sensitive data stored in databases and file shares. Encryption is a fundamental control for protecting data at rest. While DLP and access controls are important, encryption provides direct confidentiality protection.

Answer

Implementing strict access control lists (ACLs)

Answer

Implementing data loss prevention (DLP) solutions

Answer

Conducting regular vulnerability scans on servers