CISM Information Security Programme Practice Test 4 — 15 Questions

Question 1

An organization is redesigning its information security program to better align with business objectives. The CISO reports to the CIO, but business leaders feel security decisions are too IT-centric. Which reporting structure would best address this concern?

Accepted Answer

CISO reports directly to the CEO or Board of Directors.. Reporting to the CEO or Board gives the CISO independence from IT and better alignment with business strategy.

Answer

CISO reports to the Chief Risk Officer (CRO).

Answer

CISO reports to the Chief Operating Officer (COO).

Answer

CISO continues reporting to CIO but with a dotted line to the Board.

Question 2

Which security control framework is organized into Implementation Groups (IG1, IG2, IG3) based on organizational risk profile and resources?

Accepted Answer

CIS Controls v8. CIS Controls v8 uses Implementation Groups to help organizations prioritize controls based on their maturity and risk.

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Question 3

A security manager is developing metrics for the C-suite dashboard. Which combination of metrics would provide the best view of security program effectiveness, including both leading and lagging indicators?

Accepted Answer

Phishing click rate and mean time to detect (MTTD). A balanced scorecard includes leading indicators (like patch compliance) and lagging indicators (like MTTD) to provide a comprehensive view.

Answer

Breach count and number of security tools deployed

Answer

Patch compliance and number of vulnerabilities identified

Answer

Number of security incidents and percentage of budget spent

Question 4

During a third-party risk assessment, the security team discovers that a critical vendor has subcontracted data processing to another company without notification. This represents which type of risk?

Accepted Answer

Nth-party risk. Nth-party risk refers to risks from suppliers of your suppliers, which can be overlooked.

Answer

Fourth-party risk

Answer

Inherent risk

Answer

Residual risk

Question 5

An organization wants to implement a defense-in-depth strategy for its web application. Which set of controls best exemplifies this approach?

Accepted Answer

Web application firewall (WAF), input validation, and security awareness training. Defense-in-depth uses multiple layers: network, host, application, and monitoring controls.

Answer

Single sign-on and multi-factor authentication

Answer

Encryption at rest and in transit

Answer

Intrusion detection system and vulnerability scanner

Question 6

Which role is primarily responsible for developing and maintaining the organization's security architecture?

Accepted Answer

Security Architect. The security architect designs and oversees the implementation of security architecture.

Answer

Security Analyst

Answer

GRC Analyst

Answer

Penetration Tester

Question 7

A security manager needs to justify an increase in the security budget to the board. The current budget is 0.15% of revenue. Which approach would most effectively demonstrate the need for additional funding?

Accepted Answer

Show that the budget is below the industry benchmark of 0.2-0.5% of revenue and detail the risks of underfunding.. Benchmarking against industry standards (0.2-0.5% of revenue) and showing the gap provides a compelling case.

Answer

Compare the budget to last year's spending and note the increase in threats.

Answer

Present a cost-benefit analysis showing how additional investment reduces breach probability and potential loss.

Answer

Highlight recent high-profile breaches in the industry.

Question 8

Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?

Accepted Answer

Phishing click rate. Phishing click rate is a leading indicator because it predicts future incidents by measuring current behavior.

Answer

Number of vulnerabilities patched

Answer

Mean time to respond (MTTR)

Answer

Number of security incidents

Question 9

An organization is implementing a security champions program. What is the primary purpose of this initiative?

Accepted Answer

To embed security advocates within development teams to improve secure coding practices. Security champions embed security advocates within development teams to promote secure practices.

Answer

To conduct security awareness training for all employees

Answer

To provide a career path for security professionals

Answer

To replace the need for a dedicated security team

Question 10

When selecting security controls, a company must prioritize which controls first?

Accepted Answer

Controls that address the highest risks and are critical to business operations. Critical controls that address the most significant risks should be implemented first.

Answer

Controls that are least expensive

Answer

Controls that are easiest to implement

Answer

All controls from the chosen framework equally

Question 11

A company uses a SaaS provider that processes sensitive customer data. The provider undergoes annual SOC 2 audits. Which additional step is essential to manage nth-party risk?

Accepted Answer

Require the provider to disclose and assess the security of its subcontractors. Nth-party risk requires understanding the provider's subcontractors; requiring disclosure and assessment of their vendors is key.

Answer

Include a right-to-audit clause for the provider

Answer

Conduct penetration testing on the provider's application

Answer

Review the SOC 2 report annually

Question 12

What is the primary function of a Security Operations Center (SOC)?

Accepted Answer

Continuous monitoring, detection, and response to security threats. A SOC is responsible for monitoring, detecting, and responding to security incidents.

Answer

Designing the security architecture

Answer

Developing security policies and standards

Answer

Conducting security awareness training

Question 13

Which TWO metrics are considered leading indicators for information security program performance?

Accepted Answer

Patch compliance percentage. Leading indicators predict future performance; phishing click rate and patch compliance are proactive measures.

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 14

Which THREE components are essential for a comprehensive third-party risk management (TPRM) program?

Accepted Answer

Ongoing monitoring. TPRM includes onboarding risk assessment, ongoing monitoring, and exit procedures for a complete lifecycle.

Answer

Vendor product marketing review

Question 15

Which TWO are key elements of a security awareness program designed to change employee behavior?

Accepted Answer

Role-based training tailored to specific job functions. Role-based training tailors content to job functions, and phishing simulations with remediation training reinforce learning.

Answer

Annual compliance training for all employees

Answer

Posters and newsletters about security topics