CISM Information Security Programme Practice Test 4 — 15 Questions

Question 1

An organization is defining objectives and key results (OKRs) for the security program. Which TWO of the following are examples of leading indicators that could be used as key results?

Accepted Answer

Phishing click rate. Leading indicators are proactive and predictive. Phishing click rate (user behavior) and patch compliance (vulnerability management) are leading indicators.

Answer

Number of security incidents

Answer

Mean time to respond (MTTR)

Answer

Number of data breaches

Question 2

A company is implementing a vendor tiering system for third-party risk management. Which TWO factors should be used to determine the tier of a vendor?

Accepted Answer

Criticality of the service provided by the vendor. Vendor tiering is typically based on the sensitivity of data the vendor accesses and the criticality of the service they provide. These factors determine the risk level and required controls.

Answer

Vendor's marketing budget

Answer

Vendor's stock price

Answer

Vendor's annual revenue

Question 3

Which THREE of the following are components of a security operations center (SOC)?

Accepted Answer

Response. A SOC includes monitoring, detection, and response capabilities. Security awareness training is not a SOC function; it is part of the awareness program.

Answer

Vulnerability scanning

Answer

Security awareness training

Question 4

An organization is redesigning its information security program to better align with business objectives. The CISO reports to the CIO, but business leaders feel security decisions are too IT-centric. Which reporting structure would best address this concern?

Accepted Answer

CISO reports directly to the CEO or Board of Directors.. Reporting to the CEO or Board gives the CISO independence from IT and better alignment with business strategy.

Answer

CISO reports to the Chief Risk Officer (CRO).

Answer

CISO reports to the Chief Operating Officer (COO).

Answer

CISO continues reporting to CIO but with a dotted line to the Board.

Question 5

Which security control framework is organized into Implementation Groups (IG1, IG2, IG3) based on organizational risk profile and resources?

Accepted Answer

CIS Controls v8. CIS Controls v8 uses Implementation Groups to help organizations prioritize controls based on their maturity and risk.

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Question 6

A security manager is developing metrics for the C-suite dashboard. Which combination of metrics would provide the best view of security program effectiveness, including both leading and lagging indicators?

Accepted Answer

Phishing click rate and mean time to detect (MTTD). Phishing click rate is a leading indicator that measures user awareness and proactive security posture, while mean time to detect (MTTD) is a lagging indicator that reflects the efficiency of detection processes. Together, they provide a balanced view of program effectiveness for executive oversight.

Answer

Breach count and number of security tools deployed

Answer

Patch compliance and number of vulnerabilities identified

Answer

Number of security incidents and percentage of budget spent

Question 7

During a third-party risk assessment, the security team discovers that a critical vendor has subcontracted data processing to another company without notification. This represents which type of risk?

Accepted Answer

Nth-party risk. Nth-party risk refers to risks from suppliers of your suppliers, which can be overlooked.

Answer

Fourth-party risk

Answer

Inherent risk

Answer

Residual risk

Question 8

An organization wants to implement a defense-in-depth strategy for its web application. Which set of controls best exemplifies this approach?

Accepted Answer

Web application firewall (WAF), input validation, and security awareness training. Defense-in-depth uses multiple layers: network, host, application, and monitoring controls.

Answer

Single sign-on and multi-factor authentication

Answer

Encryption at rest and in transit

Answer

Intrusion detection system and vulnerability scanner

Question 9

Which role is primarily responsible for developing and maintaining the organization's security architecture?

Accepted Answer

Security Architect. The security architect designs and oversees the implementation of security architecture.

Answer

Security Analyst

Answer

GRC Analyst

Answer

Penetration Tester

Question 10

A security manager needs to justify an increase in the security budget to the board. The current budget is 0.15% of revenue. Which approach would most effectively demonstrate the need for additional funding?

Accepted Answer

Show that the budget is below the industry benchmark of 0.2-0.5% of revenue and detail the risks of underfunding.. Benchmarking against industry standards (0.2-0.5% of revenue) and showing the gap provides a compelling case.

Answer

Compare the budget to last year's spending and note the increase in threats.

Answer

Present a cost-benefit analysis showing how additional investment reduces breach probability and potential loss.

Answer

Highlight recent high-profile breaches in the industry.

Question 11

Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?

Accepted Answer

Phishing click rate. Phishing click rate is a leading indicator because it predicts future incidents by measuring current behavior.

Answer

Number of vulnerabilities patched

Answer

Mean time to respond (MTTR)

Answer

Number of security incidents

Question 12

An organization is implementing a security champions program. What is the primary purpose of this initiative?

Accepted Answer

To embed security advocates within development teams to improve secure coding practices. Security champions embed security advocates within development teams to promote secure practices.

Answer

To conduct security awareness training for all employees

Answer

To provide a career path for security professionals

Answer

To replace the need for a dedicated security team

Question 13

When selecting security controls, a company must prioritize which controls first?

Accepted Answer

Controls that address the highest risks and are critical to business operations. Critical controls that address the most significant risks should be implemented first.

Answer

Controls that are least expensive

Answer

Controls that are easiest to implement

Answer

All controls from the chosen framework equally

Question 14

A company uses a SaaS provider that processes sensitive customer data. The provider undergoes annual SOC 2 audits. Which additional step is essential to manage nth-party risk?

Accepted Answer

Require the provider to disclose and assess the security of its subcontractors. Nth-party risk requires understanding the provider's subcontractors; requiring disclosure and assessment of their vendors is key.

Answer

Include a right-to-audit clause for the provider

Answer

Conduct penetration testing on the provider's application

Answer

Review the SOC 2 report annually

Question 15

What is the primary function of a Security Operations Center (SOC)?

Accepted Answer

Continuous monitoring, detection, and response to security threats. A SOC is responsible for monitoring, detecting, and responding to security incidents.

Answer

Designing the security architecture

Answer

Developing security policies and standards

Answer

Conducting security awareness training