CISM Information Security Programme Practice Test 7 — 15 Questions

Question 1

An organization is implementing a vendor tiering program for third-party risk management. Which TWO criteria should be used to classify vendors into high, medium, or low risk tiers? (Select TWO)

Accepted Answer

Type and sensitivity of data accessed. Data access and service criticality directly affect the potential impact of a vendor compromise.

Answer

Length of contract

Answer

Vendor's annual revenue

Answer

Vendor's geographic location

Question 2

A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)

Accepted Answer

Employee role and job function. Employee role, past click rates, and current threat landscape help tailor simulations for effectiveness and relevance.

Answer

Employee's years of service

Answer

Number of security incidents in the past year

Question 3

Which of the following is a leading indicator of security program effectiveness?

Accepted Answer

Phishing click rate. Leading indicators predict future security performance, and phishing click rate is a proactive measure that can be improved before a breach occurs.

Answer

Mean time to detect (MTTD)

Answer

Breach count

Answer

Number of security incidents

Question 4

When implementing security controls, which approach ensures that multiple layers of defense are applied so that if one control fails, others compensate?

Accepted Answer

Defense-in-depth. Defense-in-depth (option D) is the correct approach because it implements multiple, overlapping layers of security controls (e.g., firewalls, IDS/IPS, endpoint protection, access controls) so that if one layer fails or is bypassed, subsequent layers continue to provide protection. This layered strategy reduces the likelihood of a single point of failure compromising the entire security posture, aligning with the CISM principle of risk mitigation through redundancy.

Answer

Business-enabling controls

Answer

Critical controls first

Answer

Compensating controls

Question 5

An organization's CISO reports to the CIO. The CISO is concerned that security initiatives are often deprioritized due to conflicts of interest. Which reporting structure would best address this concern?

Accepted Answer

Reporting to the board or risk committee. Reporting to the board or a risk committee provides independent oversight and reduces conflicts inherent in reporting to IT or operations.

Answer

Reporting to the CEO

Answer

Reporting to the COO

Answer

Reporting to the CFO

Question 6

A company is selecting a security control framework. They want a prioritized set of controls that are implementation group-based and address common cyber threats. Which framework best meets these requirements?

Accepted Answer

CIS Controls v8. CIS Controls v8 are organized into Implementation Groups (IG1, IG2, IG3) and provide a prioritized, threat-informed set of controls.

Answer

COBIT 2019

Answer

NIST SP 800-53

Answer

ISO 27001 Annex A

Question 7

A security awareness manager is designing role-based training. Which training is most appropriate for software developers?

Accepted Answer

Secure coding practices. Developers need specialized training on secure coding practices to reduce vulnerabilities in applications.

Answer

Phishing identification

Answer

Social engineering awareness

Answer

Incident response procedures

Question 8

In a vendor risk assessment, a third-party vendor will have access to sensitive customer data. According to TPRM best practices, what should the organization do first?

Accepted Answer

Conduct a risk assessment. A risk assessment is performed to understand the risks before defining contract requirements and ongoing monitoring.

Answer

Include security requirements in the contract

Answer

Define exit procedures

Answer

Perform ongoing monitoring

Question 9

A security dashboard is being designed for the C-suite. Which metric is most appropriate for a one-page executive summary?

Accepted Answer

Security scorecard with overall risk level. The security scorecard with overall risk level is the most appropriate metric for a one-page executive summary because it provides a high-level, aggregated view of the organization's security posture. Executives need a concise, actionable summary that distills complex security data into a single risk indicator, enabling quick decision-making without technical details.

Answer

Number of phishing simulation campaigns

Answer

List of all security incidents in the quarter

Answer

Detailed patch compliance by system

Question 10

An organization wants to establish a security champions program. What is the primary benefit of embedding security advocates in development teams?

Accepted Answer

Improving secure coding adoption and collaboration. Security champions serve as liaisons, promoting security practices and facilitating communication between security and development teams.

Answer

Eliminating the need for vulnerability assessments

Answer

Replacing the role of security architects

Answer

Reducing the need for a SOC

Question 11

A mature security program allocates 12% of IT budget to security. Which combination of budget components is most balanced for a program seeking to improve detection and response capabilities?

Accepted Answer

Personnel 40%, Technology 30%, Services 20%, Training 10%. For improving detection and response, investment in technology (SIEM, SOAR) and personnel (SOC analysts) is most critical, with services for assessments and training for skills.

Answer

Personnel 20%, Technology 50%, Services 20%, Training 10%

Answer

Personnel 50%, Technology 20%, Services 20%, Training 10%

Answer

Personnel 30%, Technology 30%, Services 30%, Training 10%

Question 12

A security manager is evaluating OKRs for the vulnerability management team. Which key result best aligns with an objective to reduce risk from vulnerabilities?

Accepted Answer

Reduce mean time to remediate critical vulnerabilities by 30%. Mean time to remediate critical vulnerabilities directly measures risk reduction, as faster remediation lowers exposure.

Answer

Conduct quarterly penetration tests

Answer

Achieve 95% scan coverage of assets

Answer

Increase the number of scans by 20%

Question 13

When designing phishing simulations, which approach best balances user learning and operational disruption?

Accepted Answer

Start with low-difficulty simulations, increase difficulty over time, and require remediation training for clickers. Progressive difficulty and remediation training for clickers helps users learn while minimizing negative impact on productivity.

Answer

Send high-difficulty simulations monthly without training

Answer

Use low-difficulty simulations quarterly with no follow-up

Answer

Send random-difficulty simulations weekly and report clickers to management

Question 14

A company is implementing a third-party risk management program and needs to prioritize vendors for assessment. Which factor should be given the highest weight?

Accepted Answer

Data access level and service criticality. The sensitivity of data accessed and the criticality of the service to operations are primary risk factors for vendor prioritization.

Answer

Contract value

Answer

Duration of the relationship

Answer

Vendor size

Question 15

Which TWO of the following are key components of a security operations center (SOC)? (Select TWO)

Accepted Answer

Incident response. A SOC focuses on monitoring, detection, and response. Vulnerability management and identity management are separate functions.

Answer

Vulnerability scanning

Answer

Identity and access management

Answer

Application security testing