CISM Information Security Programme Practice Test 6 — 15 Questions

Question 1

An organization is implementing a security champions program. What is the primary purpose of this initiative?

Accepted Answer

To embed security advocates within development teams to improve secure coding practices. Security champions embed security advocates within development teams to promote secure practices.

Answer

To conduct security awareness training for all employees

Answer

To provide a career path for security professionals

Answer

To replace the need for a dedicated security team

Question 2

When selecting security controls, a company must prioritize which controls first?

Accepted Answer

Controls that address the highest risks and are critical to business operations. Controls should be prioritized based on their ability to address the highest risks and support critical business operations. CISM emphasizes a risk-based approach where resources are allocated to mitigate the most significant threats first, ensuring that security investments align with business objectives and risk appetite. This prevents wasted effort on low-impact controls while critical exposures remain unaddressed.

Answer

Controls that are least expensive

Answer

Controls that are easiest to implement

Answer

All controls from the chosen framework equally

Question 3

A company uses a SaaS provider that processes sensitive customer data. The provider undergoes annual SOC 2 audits. Which additional step is essential to manage nth-party risk?

Accepted Answer

Require the provider to disclose and assess the security of its subcontractors. Requiring the provider to disclose and assess the security of its subcontractors is essential because SOC 2 audits typically cover only the provider's own controls, not those of its downstream vendors. This step extends risk visibility to the nth party, ensuring that subcontractors meet equivalent security standards and that the provider manages them contractually. It addresses the gap left by annual SOC 2 reviews and right-to-audit clauses, which focus on the primary provider.

Answer

Include a right-to-audit clause for the provider

Answer

Conduct penetration testing on the provider's application

Answer

Review the SOC 2 report annually

Question 4

What is the primary function of a Security Operations Center (SOC)?

Accepted Answer

Continuous monitoring, detection, and response to security threats. A SOC's primary mission is continuous monitoring of security telemetry, detecting threats, and coordinating response actions. It operates 24/7 using SIEM, EDR, and threat intelligence to identify and triage incidents in real time. This detection-and-response focus distinguishes the SOC from architecture, policy, or training functions.

Answer

Designing the security architecture

Answer

Developing security policies and standards

Answer

Conducting security awareness training

Question 5

Which TWO metrics are considered leading indicators for information security program performance?

Accepted Answer

Patch compliance percentage. Patch compliance percentage (A) is a leading indicator because it measures preventive control coverage before an incident occurs, showing how well vulnerabilities are being remediated ahead of exploitation. Phishing click rate (B) is also a leading indicator, as it quantifies user susceptibility to social engineering and predicts the likelihood of future credential compromise or malware infection. By contrast, the number of data breaches (C) is a lagging indicator, since it counts security failures only after they have already happened. Mean time to detect (D) is likewise a lagging indicator, because it measures response performance after an incident has already occurred rather than predicting future risk.

Answer

Number of data breaches

Answer

Mean time to detect (MTTD)

Question 6

Which TWO are key elements of a security awareness program designed to change employee behavior?

Accepted Answer

Role-based training tailored to specific job functions. Option A is correct because role-based training tailors security content to the specific risks and responsibilities of each job function (for example, finance staff trained on BEC/invoice fraud, developers on secure coding), which makes the material relevant and far more likely to change day-to-day behavior than generic content. Option C is correct because phishing simulations provide measurable, experiential reinforcement: users who click are immediately routed into targeted remediation training, converting a real mistake into a teachable moment and building the conditioned vigilance that reduces click rates over time. These two elements combine relevance (A) with active practice and feedback (C), the mechanisms that actually drive sustained behavior change. Option B does not belong because a once-a-year compliance checkbox satisfies audit requirements but is too infrequent and generic to alter habits. Option D does not belong because posters and newsletters are passive awareness artifacts that may raise knowledge but lack the interactivity, personalization, and reinforcement needed to change behavior.

Answer

Annual compliance training for all employees

Answer

Posters and newsletters about security topics

Question 7

An information security manager is designing the reporting structure for the CISO. Which reporting structure is most likely to ensure independence and adequate authority for the security function?

Accepted Answer

CISO reports to the CEO or board of directors. Reporting to the board or a senior executive not directly responsible for IT operations ensures independence and reduces conflicts of interest.

Answer

CISO reports to the CFO

Answer

CISO reports to the CIO

Answer

CISO reports to the head of internal audit

Question 8

A large organization is implementing a security controls framework and wants to prioritize controls that provide the greatest risk reduction with the least operational friction. Which approach should the security manager adopt?

Accepted Answer

Prioritize critical controls that address high-risk areas and enable business operations. A risk-based approach prioritizes controls that address the highest-risk areas while minimizing operational friction, which aligns security investment with business objectives. This ensures the greatest risk reduction per unit of effort and avoids disrupting critical business processes. It also reflects the CISM principle that security must enable the business, not obstruct it.

Answer

Implement all controls from the chosen framework simultaneously

Answer

Implement compensating controls only for legacy systems

Answer

Select controls based on regulatory compliance requirements only

Question 9

An organization is implementing a third-party risk management (TPRM) program. Which approach best addresses nth-party risk?

Accepted Answer

Requiring that key vendors include security requirements in contracts with their subcontractors. Nth-party risk refers to risks from suppliers of your suppliers. Contractual requirements that cascade down the supply chain are essential to manage this risk.

Answer

Performing on-site audits of all third parties

Answer

Accepting the risk since it is outside the organization's control

Answer

Conducting annual assessments of all direct vendors only

Question 10

Which of the following best describes the role of a security architect in a security program?

Accepted Answer

Designs security controls and integrates them into IT systems. A security architect's core responsibility is designing security controls and integrating them into IT systems — translating business and compliance requirements into technical architectures, frameworks, and control designs. This is a design and strategy role, distinct from operational or testing functions.

Answer

Performs penetration testing to identify vulnerabilities

Answer

Develops and delivers security awareness training

Answer

Monitors security alerts and responds to incidents

Question 11

Which of the following is a key objective of implementing a security champions program?

Accepted Answer

To embed security advocates in development teams. Security champions are volunteers within development teams who promote security best practices and facilitate communication between security and development.

Answer

To replace the need for a formal security awareness program

Answer

To reduce the number of security tools needed

Answer

To conduct phishing simulations for all employees

Question 12

A security manager needs to justify an increase in the security budget. Which approach provides the strongest quantitative justification?

Accepted Answer

Showing the return on investment using avoided breach costs. Quantitative justification requires translating security spend into financial terms that executives understand. Showing ROI via avoided breach costs — using industry data such as IBM's Cost of a Data Breach report, internal incident history, and expected loss modeling — converts security investment into a defensible business case. This directly answers the CFO's question: what do we get for the money?

Answer

Comparing the budget to industry benchmarks

Answer

Presenting the number of vulnerabilities discovered

Answer

Listing all pending compliance requirements

Question 13

A company has implemented a security awareness program with quarterly phishing simulations. The click rate has remained at 15% for the past two quarters. What is the most effective next step?

Accepted Answer

Implement mandatory remediation training for users who click. A stagnant 15% click rate indicates that awareness alone is not changing behavior; the program needs reinforcement through consequence and remediation. Mandatory remediation training for users who click — typically a short, targeted module delivered immediately after the failure — converts the teachable moment into learning and has been shown to reduce repeat click rates. This is the most effective next step because it addresses the root cause: users who click are not internalizing the training.

Answer

Increase the frequency of simulations to monthly

Answer

Discontinue simulations as they are not effective

Answer

Reduce the difficulty of simulations to lower the click rate

Question 14

Which control framework is most appropriate for an organization that wants a prioritized set of controls based on implementation groups (IG1, IG2, IG3)?

Accepted Answer

CIS Controls v8. CIS Controls v8 is uniquely structured around Implementation Groups (IG1, IG2, IG3), which prioritize safeguards based on organizational size, resources, and risk. No other major framework uses this exact IG tiering model. The question's mention of 'prioritized set of controls based on implementation groups' is a direct signature of CIS Controls v8.

Answer

NIST SP 800-53

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Question 15

What is the primary purpose of a vulnerability management program?

Accepted Answer

To identify, assess, and remediate security weaknesses in systems. Vulnerability management aims to identify, classify, and remediate vulnerabilities to reduce the attack surface.

Answer

To enforce access control policies

Answer

To detect and respond to security incidents

Answer

To manage third-party security risks