CISM Information Security Programme Practice Test 6 — 15 Questions

Question 1

Which THREE elements are essential components of a third-party risk management (TPRM) program? (Select THREE)

Accepted Answer

Contractual security requirements. Contractual security requirements (Option B) are essential because they legally bind the vendor to specific security controls, data protection obligations, and compliance standards. Without these enforceable clauses in the contract, the organization has no formal recourse if the vendor suffers a breach or fails to meet security expectations. This is a foundational element of any third-party risk management program, as it sets the baseline for acceptable risk transfer and due care.

Answer

Automated patching of vendor systems

Answer

Shared SOC services

Question 2

A security manager is developing OKRs for the security team. Which TWO key results are appropriate leading indicators? (Select TWO)

Accepted Answer

Complete 100% of privileged access reviews quarterly. Leading indicators are proactive; patch compliance reflects current security posture, and access review completion indicates governance effectiveness.

Answer

Achieve zero critical vulnerabilities in external scans

Answer

Reduce number of data breaches by 20%

Answer

Decrease mean time to detect (MTTD) to under 1 hour

Question 3

Which of the following is the BEST reporting structure for a CISO to ensure independent oversight and alignment with business strategy?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board ensures the CISO has the authority and independence to influence security strategy without conflicting priorities from IT operations.

Answer

Reporting to the CIO

Answer

Reporting to the head of legal

Answer

Reporting to the CFO

Question 4

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this approach?

Accepted Answer

Network segmentation, intrusion detection system, and incident response plan. Defense-in-depth uses multiple layers of controls; here, network segmentation (preventive), IDS (detective), and incident response plan (corrective) cover different stages.

Answer

Access control lists, data loss prevention, and encryption

Answer

Firewall, antivirus, and encryption

Answer

Security awareness training, vulnerability scanning, and patching

Question 5

A financial institution uses CIS Controls v8 and must prioritize implementation. The organization has limited resources and high exposure to ransomware. Which implementation group should be addressed FIRST?

Accepted Answer

Implementation Group 1 (IG1). IG1 consists of essential controls (e.g., inventory, malware defenses) that address the most common attacks, including ransomware.

Answer

All groups simultaneously

Answer

Implementation Group 3 (IG3)

Answer

Implementation Group 2 (IG2)

Question 6

A CISO wants to present a high-level security status to the board using a one-page dashboard. Which of the following metrics is MOST appropriate for this audience?

Accepted Answer

Phishing click rate and patch compliance percentage. Leading indicators like phishing click rate and patch compliance are actionable and forward-looking, suitable for board-level oversight.

Answer

Mean time to detect (MTTD) for incidents

Answer

Detailed vulnerability counts by severity

Answer

Total number of security controls implemented

Question 7

A company is designing its security awareness program. Which approach BEST addresses the need for role-based training?

Accepted Answer

Provide secure coding training to developers and social engineering awareness to executives. Role-based training tailors content to specific job functions, making it more relevant and effective.

Answer

Focus only on phishing simulations for all staff

Answer

Deliver the same annual training to all employees

Answer

Create a single module covering all topics for everyone

Question 8

Which of the following is a leading indicator of security program effectiveness?

Accepted Answer

Access review completion rate. Leading indicators measure proactive security posture; access review completion rate indicates how well entitlements are managed.

Answer

Number of data breaches

Answer

Cost of a data breach

Answer

Mean time to respond (MTTR)

Question 9

During third-party risk assessment, a vendor is found to have access to sensitive customer data. The vendor's own supply chain includes a critical fourth-party component. What is the BEST way to address this nth-party risk?

Accepted Answer

Request the vendor to assess and pass through security requirements to its suppliers. Requiring the vendor to manage its sub-suppliers through contractual flow-down ensures the organization's risk requirements extend throughout the supply chain.

Answer

Ignore the fourth party as it is outside the organization's scope

Answer

Conduct a direct assessment of the fourth party

Answer

Terminate the contract with the vendor

Question 10

An organization's security budget is 8% of the IT budget. Industry benchmarks suggest 10-15% for mature programs. Which of the following should the CISO do FIRST to justify an increase?

Accepted Answer

Present a cost-benefit analysis showing breach avoidance value. Linking budget requests to specific risk reductions and potential breach costs provides a business case for investment.

Answer

Reduce other IT expenses to free up funds

Answer

Request additional budget for emerging threats

Answer

Highlight the percentage gap compared to peers

Question 11

In a security operations center (SOC), which function is PRIMARILY responsible for analyzing alerts and determining whether they represent actual security incidents?

Accepted Answer

Tier 2 SOC analyst. Tier 2 SOC analysts are primarily responsible for deep-dive analysis of alerts escalated from Tier 1, using threat intelligence, log correlation, and forensic techniques to determine if an alert represents a genuine security incident. They possess the technical expertise to differentiate false positives from true positives by examining raw packet captures, endpoint artifacts, and SIEM event details that Tier 1 analysts may lack the context or authority to investigate fully.

Answer

Tier 1 SOC analyst

Answer

Incident response manager

Answer

Security architect

Question 12

Which of the following is the PRIMARY purpose of a security champions program?

Accepted Answer

Embed security advocates in dev teams to promote secure practices. Security champions act as liaisons in development teams, promoting security practices and facilitating communication with the security team.

Answer

Enforce compliance with security policies

Answer

Reduce the number of phishing simulations

Answer

Replace the need for a dedicated security team

Question 13

An organization uses ISO 27001 Annex A as its control framework. During a risk assessment, a control weakness is identified that could lead to a high-impact data breach. However, implementing the recommended control is cost-prohibitive. Which approach BEST addresses this situation?

Accepted Answer

Implement a compensating control that provides equivalent protection. Compensating controls provide an alternative means of mitigating risk when the primary control is not feasible.

Answer

Transfer the risk through cyber insurance

Answer

Reduce the risk rating to justify not implementing

Answer

Accept the risk without further action

Question 14

A CISO is evaluating a cloud provider's security posture. Which of the following should be the MOST important consideration in the vendor risk assessment?

Accepted Answer

The provider's certifications and SOC 2 reports. The provider's certifications and independent audits provide objective evidence of security controls, which is critical for trust.

Answer

The provider's data center locations

Answer

The provider's market share and brand reputation

Answer

The provider's pricing compared to competitors

Question 15

A security manager is designing a metrics dashboard for the CISO. Which TWO metrics are leading indicators of security performance? (Select TWO)

Accepted Answer

Patch compliance percentage. Phishing click rate and patch compliance are proactive measures that predict future risk, unlike breach count and MTTD which are lagging.

Answer

Number of security incidents

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)