CISM Information Security Programme Practice Test 3 — 15 Questions

Question 1

An organization is implementing a security controls framework based on NIST SP 800-53. The CISO wants to prioritize controls that will provide the greatest risk reduction for critical assets. Which approach should be used to select the initial set of controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the critical controls first, focusing on those that address the highest risks.. Applying critical controls first, such as those from the CIS Critical Security Controls, ensures that the most impactful controls are implemented early to reduce risk.

Answer

Select all controls from the framework to achieve full compliance.

Answer

Implement business-enabling controls before any other controls.

Answer

Choose compensating controls to replace all technical controls.

Question 2

A security manager is designing a security awareness program. Which TWO metrics are leading indicators of program effectiveness?

Accepted Answer

Knowledge assessment scores from training.. Option A (Knowledge assessment scores from training) is a leading indicator because it measures how well employees have absorbed security concepts before any real-world incident occurs, predicting their future behavior and readiness. Option B (Phishing simulation click rate) is also a leading indicator because it directly measures employee susceptibility to a controlled, simulated attack, revealing the likelihood of future real-world compromise. In contrast, option C (Number of security incidents reported by employees) is a lagging indicator since it reflects incidents that have already happened. Option D (Number of phishing emails reported by users) is likewise lagging because it counts reports after real phishing attempts have already reached inboxes. Option E (Mean time to detect a phishing attack) is a lagging indicator because it measures response performance only after an actual attack has occurred.

Answer

Number of security incidents reported by employees.

Answer

Number of phishing emails reported by users.

Answer

Mean time to detect (MTTD) a phishing attack.

Question 3

A CISO is evaluating metrics for an executive security report. Which TWO of the following are lagging indicators?

Accepted Answer

Mean time to detect (MTTD) security incidents.. Option C, Mean time to detect (MTTD) security incidents, is a lagging indicator because it measures how long it took to identify incidents that already occurred, reflecting the outcome of detection capabilities after the fact. Option E, number of data breaches in the past quarter, is a lagging indicator because it counts realized security failures that have already happened, making it a retrospective measure of security effectiveness. The unmarked options are leading indicators: A (training sessions held) and D (training completion percentage) measure preventive activities and readiness before incidents occur, while B (patch compliance rate) reflects proactive vulnerability-reduction efforts rather than a past outcome.

Answer

Number of security awareness training sessions held.

Answer

Patch compliance rate for critical systems.

Answer

Percentage of employees who completed security training.

Question 4

A CISO is evaluating the reporting structure for the information security team. Which reporting line is generally considered MOST effective for ensuring independence and organizational influence?

Accepted Answer

Report to the board of directors or audit committee. For information security to be independent and influential, the CISO should report to the board of directors or audit committee (C). This reporting line ensures the security function is not subordinate to IT operations (which it must oversee) and gives it direct access to the highest governance body, enabling objective oversight and adequate resourcing. Independence is critical because the CISO must be able to raise risk concerns without conflicts of interest from IT management.

Answer

Report to the Chief Financial Officer (CFO)

Answer

Report to the Chief Information Officer (CIO)

Answer

Report to the Chief Operating Officer (COO)

Question 5

An organization is implementing a security controls framework based on NIST SP 800-53. The CISO wants to prioritize controls that will provide the greatest risk reduction for critical assets. Which approach should be used to select the initial set of controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Start with all controls from IG1, then move to IG2 and IG3 as resources allow. CIS Controls v8 defines Implementation Groups (IGs) as a prioritized approach: IG1 covers basic cyber hygiene controls that every organization should implement first, then IG2 adds more mature controls, and IG3 includes advanced controls for organizations with greater risk and resources. Starting with IG1 and progressing sequentially ensures foundational security before moving to more complex controls.

Answer

Focus only on controls that address the greatest risks regardless of group

Answer

Implement IG3 controls first as they are the most advanced

Answer

Implement controls from all groups simultaneously to achieve comprehensive coverage

Question 6

During a third-party risk assessment, the security team discovers that a critical vendor's sub-supplier (nth party) has access to sensitive data. The vendor contract does not address nth-party risk. What is the BEST course of action?

Accepted Answer

Revise the contract to require the vendor to flow down security requirements to sub-suppliers. The core issue is that the vendor contract does not address nth-party (sub-supplier) risk, so the organization has no contractual leverage to require the vendor to manage its sub-suppliers. The best course of action is to revise the contract to include flow-down clauses that require the vendor to impose security requirements on its sub-suppliers, thereby extending the organization's security posture through the supply chain. This addresses the root cause—lack of contractual control—and is a preventive, governance-level action.

Answer

Accept the risk because the vendor is contractually responsible

Answer

Perform an on-site assessment of the sub-supplier

Answer

Request that the vendor terminate the sub-supplier relationship

Question 7

Which of the following is a LEADING indicator of security performance?

Accepted Answer

Patch compliance percentage. Patch compliance percentage is a leading indicator because it measures proactive security hygiene—the proportion of systems with current patches—which predicts future breach likelihood. Leading indicators are forward-looking and actionable, allowing organizations to prevent incidents before they occur. MTTD, incident counts, and breach costs are lagging indicators that measure past performance.

Answer

Cost of a data breach

Answer

Mean time to detect (MTTD)

Answer

Number of security incidents

Question 8

An information security manager is designing a security awareness program. Which approach BEST addresses the different learning needs of various employee groups?

Accepted Answer

Deliver role-based training: secure coding for developers, social engineering for executives, and basic awareness for all. Role-based training ensures that each group receives content relevant to their responsibilities.

Answer

Use only phishing simulations as training

Answer

Focus training only on high-risk groups such as system administrators

Answer

Provide the same annual training to all employees to ensure consistency

Question 9

A security manager needs to justify an increase in the security budget. Which metric is MOST compelling to demonstrate the value of security investments to the board?

Accepted Answer

Return on investment (ROI) from avoided breach costs. Return on investment (ROI) from avoided breach costs translates security spending into financial terms that the board understands, showing how investments prevent losses. This metric directly ties security to business value by quantifying the cost avoidance from prevented incidents, which is more compelling than activity-based metrics. Boards are accountable for financial performance and risk, so ROI resonates with their fiduciary responsibilities.

Answer

Number of phishing simulations conducted

Answer

Percentage of IT budget allocated to security

Answer

Number of security tools deployed

Question 10

Which control family from NIST SP 800-53 is MOST directly associated with ensuring that users have appropriate access rights?

Accepted Answer

Access Control (AC). The Access Control (AC) family in NIST SP 800-53 addresses policies and mechanisms that govern who can access which resources and under what conditions. It includes controls like AC-2 (Account Management), AC-3 (Access Enforcement), and AC-6 (Least Privilege), which directly ensure users have appropriate access rights. This makes AC the most directly associated control family for access rights.

Answer

System and Communications Protection (SC)

Answer

Identification and Authentication (IA)

Answer

Personnel Security (PS)

Question 11

An organization is designing a security operations center (SOC). Which of the following functions is PRIMARILY responsible for analyzing alerts and determining if they represent genuine threats?

Accepted Answer

Security Analyst. The Security Analyst (often Tier 1 or Tier 2) is primarily responsible for monitoring alerts, triaging them, and determining whether they represent genuine threats. This role performs the initial analysis and escalates confirmed incidents to incident responders. The SOC Manager oversees operations, the Security Architect designs controls, and the Incident Responder handles confirmed incidents.

Answer

SOC Manager

Answer

Security Architect

Answer

Incident Responder

Question 12

What is the PRIMARY purpose of a security champions program?

Accepted Answer

To embed security advocates in non-security teams to promote security best practices. The primary purpose of a security champions program is to embed security advocates within non-security teams (e.g., development, operations) to promote security best practices (A). Champions are team members with an interest in security who receive additional training and act as liaisons between the security team and their functional teams, scaling security awareness and enabling earlier risk identification without adding headcount.

Answer

To enforce security policies through peer pressure

Answer

To conduct security audits of other teams

Answer

To replace the security team in development projects

Question 13

A security manager is selecting a controls framework for a new organization. Which framework provides the most granular control families and is widely used for US federal agencies?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the correct answer because it provides the most granular control families (20 families, over 1,000 controls) and is mandated for US federal agencies under FISMA. Its control catalog is organized into detailed families such as AC (Access Control), AU (Audit and Accountability), and CM (Configuration Management), each with specific control enhancements. This level of granularity and its federal adoption make it the best fit for the scenario.

Answer

CIS Controls v8

Answer

ISO 27001 Annex A

Answer

COBIT 2019

Question 14

A company maintains a security scorecard for the executive team. Which metric is MOST appropriate to include as a leading indicator on a one-page dashboard?

Accepted Answer

Phishing click rate. A phishing click rate is a leading indicator because it measures a current user behavior that predicts future compromise risk, allowing the executive team to act before incidents occur. It is actionable, quantifiable, and directly tied to the effectiveness of security awareness controls. The other options are lagging indicators that report outcomes after the fact.

Answer

Average cost per incident

Answer

Number of data breaches in the past year

Answer

Number of security tools deployed

Question 15

In the context of defense-in-depth, which control provides protection at the network layer to prevent unauthorized access?

Accepted Answer

Firewalls. Firewalls operate at the network layer (Layer 3) and transport layer (Layer 4) to filter traffic based on IP addresses, ports, and protocols, preventing unauthorized network access. They are a core component of defense-in-depth at the network perimeter and internal segments. This directly matches the requirement for network-layer protection.

Answer

Encryption of data at rest

Answer

Antivirus software

Answer

Security awareness training