CISM Information Security Programme Practice Test 5 — 15 Questions

Question 1

An information security manager is designing the reporting structure for the CISO. Which reporting structure is most likely to ensure independence and adequate authority for the security function?

Accepted Answer

CISO reports to the CEO or board of directors. Reporting to the board or a senior executive not directly responsible for IT operations ensures independence and reduces conflicts of interest.

Answer

CISO reports to the CFO

Answer

CISO reports to the CIO

Answer

CISO reports to the head of internal audit

Question 2

Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?

Accepted Answer

Phishing click rate. Leading indicators are proactive measures that predict future performance; phishing click rate reflects current behavior that influences future security incidents.

Answer

Number of breaches

Answer

Number of security incidents

Answer

Mean time to detect (MTTD)

Question 3

A large organization is implementing a security controls framework and wants to prioritize controls that provide the greatest risk reduction with the least operational friction. Which approach should the security manager adopt?

Accepted Answer

Prioritize critical controls that address high-risk areas and enable business operations. Prioritizing critical controls first, especially those that address the most significant risks and are business-enabling, aligns with defense-in-depth and risk-based decision making.

Answer

Implement all controls from the chosen framework simultaneously

Answer

Implement compensating controls only for legacy systems

Answer

Select controls based on regulatory compliance requirements only

Question 4

A security manager is developing metrics for the executive dashboard. Which combination of metrics provides a balanced view of security program performance?

Accepted Answer

Phishing click rate and mean time to detect (MTTD). A balanced dashboard should include both leading and lagging indicators to show current effectiveness and past outcomes.

Answer

Budget spent and number of security tools deployed

Answer

Patch compliance percentage and number of phishing simulation clicks

Answer

Number of security incidents and mean time to respond (MTTR)

Question 5

An organization is implementing a third-party risk management (TPRM) program. Which approach best addresses nth-party risk?

Accepted Answer

Requiring that key vendors include security requirements in contracts with their subcontractors. Nth-party risk refers to risks from suppliers of your suppliers. Contractual requirements that cascade down the supply chain are essential to manage this risk.

Answer

Performing on-site audits of all third parties

Answer

Accepting the risk since it is outside the organization's control

Answer

Conducting annual assessments of all direct vendors only

Question 6

Which of the following best describes the role of a security architect in a security program?

Accepted Answer

Designs security controls and integrates them into IT systems. The security architect designs and oversees the implementation of security solutions and ensures they align with the overall architecture.

Answer

Performs penetration testing to identify vulnerabilities

Answer

Develops and delivers security awareness training

Answer

Monitors security alerts and responds to incidents

Question 7

Which of the following is a key objective of implementing a security champions program?

Accepted Answer

To embed security advocates in development teams. Security champions are volunteers within development teams who promote security best practices and facilitate communication between security and development.

Answer

To replace the need for a formal security awareness program

Answer

To reduce the number of security tools needed

Answer

To conduct phishing simulations for all employees

Question 8

A security manager needs to justify an increase in the security budget. Which approach provides the strongest quantitative justification?

Accepted Answer

Showing the return on investment using avoided breach costs. Quantifying the financial impact of risks avoided (e.g., using annualized loss expectancy) provides a compelling business case.

Answer

Comparing the budget to industry benchmarks

Answer

Presenting the number of vulnerabilities discovered

Answer

Listing all pending compliance requirements

Question 9

A company has implemented a security awareness program with quarterly phishing simulations. The click rate has remained at 15% for the past two quarters. What is the most effective next step?

Accepted Answer

Implement mandatory remediation training for users who click. Since the click rate is stagnating, the program needs to be adjusted. Remediation training targeted at those who click, combined with increased simulation complexity, can drive improvement.

Answer

Increase the frequency of simulations to monthly

Answer

Discontinue simulations as they are not effective

Answer

Reduce the difficulty of simulations to lower the click rate

Question 10

Which control framework is most appropriate for an organization that wants a prioritized set of controls based on implementation groups (IG1, IG2, IG3)?

Accepted Answer

CIS Controls v8. CIS Controls v8 explicitly defines implementation groups to help organizations prioritize controls based on their risk profile and resources.

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Question 11

What is the primary purpose of a vulnerability management program?

Accepted Answer

To identify, assess, and remediate security weaknesses in systems. Vulnerability management aims to identify, classify, and remediate vulnerabilities to reduce the attack surface.

Answer

To enforce access control policies

Answer

To detect and respond to security incidents

Answer

To manage third-party security risks

Question 12

An organization's SOC team is measured on mean time to detect (MTTD) and mean time to respond (MTTR). The security manager notices that MTTD is low but MTTR is high. What is the most likely cause?

Accepted Answer

The incident response process lacks automation or clear procedures. Low detection time but high response time indicates that while alerts are generated quickly, the response process is slow due to inefficiencies in triage or remediation.

Answer

The team is understaffed during off-hours

Answer

The vulnerability management program is ineffective

Answer

The SIEM is generating too many false positives

Question 13

A security manager is selecting controls for a new application. Which TWO controls are most important to include in a defense-in-depth strategy? (Select TWO)

Accepted Answer

Role-based access control (RBAC) with least privilege. Defense-in-depth requires multiple layers; input validation prevents injection attacks, and access control ensures least privilege.

Answer

Weekly vulnerability scans

Answer

Single sign-on (SSO) implementation

Answer

Encryption of data at rest

Question 14

Which THREE elements are essential components of a third-party risk management (TPRM) program? (Select THREE)

Accepted Answer

Contractual security requirements. Contractual security requirements (Option B) are essential because they legally bind the vendor to specific security controls, data protection obligations, and compliance standards. Without these enforceable clauses in the contract, the organization has no formal recourse if the vendor suffers a breach or fails to meet security expectations. This is a foundational element of any third-party risk management program, as it sets the baseline for acceptable risk transfer and due care.

Answer

Automated patching of vendor systems

Answer

Shared SOC services

Question 15

A security manager is developing OKRs for the security team. Which TWO key results are appropriate leading indicators? (Select TWO)

Accepted Answer

Complete 100% of privileged access reviews quarterly. Leading indicators are proactive; patch compliance reflects current security posture, and access review completion indicates governance effectiveness.

Answer

Achieve zero critical vulnerabilities in external scans

Answer

Reduce number of data breaches by 20%

Answer

Decrease mean time to detect (MTTD) to under 1 hour