CISM Information Security Programme Practice Test 3 — 15 Questions

Question 1

A CISO is evaluating security metrics for reporting to the board. Which TWO of the following are leading indicators?

Accepted Answer

Phishing simulation click rate. Leading indicators are proactive measures. Phishing click rate predicts future breaches, and patch compliance indicates current vulnerability posture. Breach count and MTTD are lagging, and number of security tools is not a performance metric.

Answer

Mean time to detect (MTTD) incidents

Answer

Number of data breaches in the past quarter

Answer

Number of security tools deployed

Question 2

A company is designing a third-party risk management (TPRM) program. Which THREE of the following are essential components of the ongoing monitoring phase for a critical vendor?

Accepted Answer

Annual reassessment of the vendor's security controls. Ongoing monitoring includes continuous assessment of security posture. Annual reassessment is part of the cycle, but ongoing monitoring includes more frequent checks. Contractual requirements are set during onboarding, not monitored ongoing. Exit procedures are for termination.

Answer

Contractual requirement for data encryption

Answer

One-time onboarding risk assessment

Question 3

Which TWO of the following are typical components of a security awareness program?

Accepted Answer

Role-based security training. Phishing simulations and role-based training are core components of awareness programs. Penetration testing is a technical assessment, vulnerability scanning is technical, and security architecture is a design function.

Answer

Vulnerability scanning

Answer

Security architecture design

Answer

Penetration testing

Question 4

Which of the following is a leading indicator of security program effectiveness?

Accepted Answer

Phishing click rate. Leading indicators are proactive measures that predict future performance. Phishing click rate is a leading indicator because it measures current user behavior that can be improved before an incident occurs.

Answer

Number of security incidents

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 5

An organization is implementing a security controls framework and needs to prioritize controls for a small business with limited resources. Which implementation group from CIS Controls v8 should be addressed first?

Accepted Answer

IG1. CIS Controls v8 defines Implementation Group 1 (IG1) as the basic set of controls for small businesses with limited resources. IG1 is designed to be the minimum standard and should be implemented first.

Answer

IG2

Answer

IG3

Answer

IG0

Question 6

A CISO is designing a security scorecard for the board of directors. Which metric is most appropriate to include for a one-page executive dashboard?

Accepted Answer

Percentage of systems patched within SLA. The board needs high-level, strategic metrics. Percentage of systems patched within SLA provides a clear, concise view of vulnerability management status, which is critical for risk reduction.

Answer

Detailed list of known vulnerabilities

Answer

Number of phishing simulations conducted

Answer

Names of vendors with critical findings

Question 7

An organization is designing a third-party risk management (TPRM) program. They have identified a vendor that stores sensitive customer data. According to best practices, what should be the minimum requirement for this vendor's contract?

Accepted Answer

Contractual security requirements and right to audit. For vendors handling sensitive customer data, the contract must include security requirements such as data protection clauses, incident notification timelines, and the right to audit. This ensures contractual enforceability of security controls.

Answer

Vendor's insurance certificate

Answer

Annual self-assessment questionnaire only

Answer

SOC 2 Type II report without contractual clauses

Question 8

Which control family in NIST SP 800-53 addresses the identification and authentication of users?

Accepted Answer

Identification and Authentication (IA). The Identification and Authentication (IA) family in NIST SP 800-53 covers user identification, authentication, and credential management.

Answer

Personnel Security (PS)

Answer

System and Communications Protection (SC)

Answer

Access Control (AC)

Question 9

A security architect is designing a defense-in-depth strategy. Which combination of controls best exemplifies this approach?

Accepted Answer

Firewall, antivirus, encryption, and security awareness training. Defense-in-depth uses multiple layers of security. Firewall (network), antivirus (host), encryption (data), and security awareness (human) provide overlapping layers.

Answer

Physical security, background checks, and non-disclosure agreements

Answer

Encryption, data loss prevention, and backup

Answer

Firewall, intrusion detection system, and SIEM

Question 10

In a security awareness program, which training approach is most appropriate for software developers?

Accepted Answer

Secure coding practices and common vulnerabilities. Developers need secure coding training to address vulnerabilities in code they write. Role-based training ensures relevance and effectiveness.

Answer

Social engineering awareness for executives

Answer

Incident response procedures

Answer

General security awareness training covering phishing

Question 11

A CISO is preparing the security budget for the next fiscal year. The current IT budget is $10 million. For a mature security program, what is the recommended security budget range?

Accepted Answer

$1 million to $1.5 million. Best practice for a mature security program is to allocate 10-15% of the IT budget to security. For a $10 million IT budget, that is $1 million to $1.5 million.

Answer

$500,000 to $750,000

Answer

$100,000 to $200,000

Answer

$2 million to $3 million

Question 12

An organization is implementing a security champions program. Which of the following is the primary benefit of such a program?

Accepted Answer

Embedding security expertise within development teams. Security champions are advocates embedded in development teams to help integrate security into the development lifecycle, promoting secure development practices.

Answer

Providing 24/7 security monitoring

Answer

Eliminating the need for security awareness training

Answer

Reducing the need for a dedicated security team

Question 13

Which metric is considered a lagging indicator of security program performance?

Accepted Answer

Mean time to detect (MTTD). Lagging indicators measure past events. Mean time to detect (MTTD) is a lagging indicator because it reflects historical detection efficiency.

Answer

Patch compliance percentage

Answer

Access review completion rate

Answer

Phishing simulation click rate

Question 14

A company is assessing nth-party risk from a critical cloud provider. Which approach should be taken to manage this risk effectively?

Accepted Answer

Require the cloud provider to contractually manage and report on their subcontractors. Managing nth-party risk requires understanding the cloud provider's supply chain. Contractual requirements for the provider to manage their subcontractors and regular audits help mitigate downstream risks.

Answer

Replace the cloud provider with an in-house solution

Answer

Conduct a direct audit of the provider's subcontractors

Answer

Ignore nth-party risk as it is out of scope

Question 15

Which role is primarily responsible for designing and reviewing an organization's security architecture?

Accepted Answer

Security architect. The security architect designs and reviews security architecture to ensure it aligns with business requirements and security standards.

Answer

Security analyst

Answer

GRC analyst

Answer

SOC analyst