CISM Information Security Programme Practice Test 7 — 15 Questions

Question 1

An organization's SOC team is measured on mean time to detect (MTTD) and mean time to respond (MTTR). The security manager notices that MTTD is low but MTTR is high. What is the most likely cause?

Accepted Answer

The incident response process lacks automation or clear procedures. Low MTTD means detection is working well, but high MTTR indicates the response phase is slow — typically due to manual processes, lack of automation (SOAR), unclear playbooks, or approval bottlenecks. The most likely cause is that the incident response process itself is inefficient, not that detection is failing. This points to a response capability gap rather than a detection or staffing issue.

Answer

The team is understaffed during off-hours

Answer

The vulnerability management program is ineffective

Answer

The SIEM is generating too many false positives

Question 2

A security manager is selecting controls for a new application. Which TWO controls are most important to include in a defense-in-depth strategy? (Select TWO)

Accepted Answer

Role-based access control (RBAC) with least privilege. Option B (RBAC with least privilege) is correct because it enforces authorization by granting users only the minimum permissions needed for their roles, directly limiting the blast radius of compromised accounts and insider misuse—a core preventive control in any defense-in-depth strategy. Option E (input validation and sanitization) is correct because it defends against injection flaws such as SQLi, XSS, and command injection by rejecting or neutralizing untrusted input at the application boundary, addressing the most common application-layer attack vector. Together these controls cover both access control and secure input handling, which are foundational application security layers. Option A is not among the marked answers because periodic vulnerability scans are detective/assessment activities that identify issues rather than directly preventing exploitation. Option C is not marked because SSO centralizes authentication and improves usability but does not by itself enforce least privilege or stop injection attacks. Option D is not marked because encryption at rest protects stored data confidentiality but does not prevent application-layer attacks like injection or privilege abuse.

Answer

Weekly vulnerability scans

Answer

Single sign-on (SSO) implementation

Answer

Encryption of data at rest

Question 3

Which THREE elements are essential components of a third-party risk management (TPRM) program? (Select THREE)

Accepted Answer

Contractual security requirements. Contractual security requirements (B) are essential because TPRM must codify security, privacy, breach-notification, and audit obligations in vendor agreements so that controls are legally enforceable. Vendor tiering based on data access and criticality (D) is essential because it lets the organization apply proportionate due diligence, monitoring, and reassessment to vendors according to the sensitivity of data and operational dependency. Onboarding risk assessment (E) is essential because risk must be evaluated before a vendor is engaged or given access, establishing a baseline for approval, remediation, and ongoing oversight. The unmarked options do not belong: automated patching of vendor systems (A) is an operational control the vendor itself normally performs and is not a core TPRM program element, and shared SOC services (C) are one possible assurance mechanism rather than a required component of every TPRM program.

Answer

Automated patching of vendor systems

Answer

Shared SOC services

Question 4

A security manager is developing OKRs for the security team. Which TWO key results are appropriate leading indicators? (Select TWO)

Accepted Answer

Complete 100% of privileged access reviews quarterly. Option A is correct because completing 100% of privileged access reviews quarterly is a proactive, measurable activity that the security team directly controls and that reduces the likelihood of credential misuse before any incident occurs, making it a classic leading indicator. Option D is correct because achieving 95% patch compliance within 30 days of release is likewise an actionable, preventive process metric that the team can drive and that lowers exploitability of known CVEs, so it predicts future risk reduction. By contrast, option B (zero critical vulnerabilities in external scans) is an outcome/target state rather than a controllable activity, option C (reduce data breaches by 20%) is a lagging outcome that only materializes after incidents, and option E (decrease MTTD to under 1 hour) measures detection performance after events have already occurred, so all three are lagging or outcome-oriented rather than leading indicators.

Answer

Achieve zero critical vulnerabilities in external scans

Answer

Reduce number of data breaches by 20%

Answer

Decrease mean time to detect (MTTD) to under 1 hour

Question 5

Which of the following is the BEST reporting structure for a CISO to ensure independent oversight and alignment with business strategy?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board ensures the CISO has the authority and independence to influence security strategy without conflicting priorities from IT operations.

Answer

Reporting to the CIO

Answer

Reporting to the head of legal

Answer

Reporting to the CFO

Question 6

An organization is implementing a defense-in-depth strategy. Which of the following control combinations BEST exemplifies this approach?

Accepted Answer

Network segmentation, intrusion detection system, and incident response plan. Network segmentation, intrusion detection system, and incident response plan represent a layered defense-in-depth approach because they combine preventive (segmentation), detective (IDS), and corrective (incident response) controls across different layers. This triad addresses network, monitoring, and process domains, which is the essence of defense in depth. The other options either focus on a single control type or lack the breadth of preventive, detective, and corrective measures.

Answer

Access control lists, data loss prevention, and encryption

Answer

Firewall, antivirus, and encryption

Answer

Security awareness training, vulnerability scanning, and patching

Question 7

A financial institution uses CIS Controls v8 and must prioritize implementation. The organization has limited resources and high exposure to ransomware. Which implementation group should be addressed FIRST?

Accepted Answer

Implementation Group 1 (IG1). CIS Controls v8 Implementation Group 1 (IG1) represents the foundational cyber hygiene controls that every organization — especially those with limited resources and high ransomware exposure — should implement first. IG1 controls are designed to be achievable with minimal expertise and cover the most impactful safeguards like inventory, patching, and access control. Prioritizing IG1 ensures the organization closes the most exploitable gaps before moving to IG2 and IG3.

Answer

All groups simultaneously

Answer

Implementation Group 3 (IG3)

Answer

Implementation Group 2 (IG2)

Question 8

A company is designing its security awareness program. Which approach BEST addresses the need for role-based training?

Accepted Answer

Provide secure coding training to developers and social engineering awareness to executives. Role-based training tailors security education to the specific risks and responsibilities of different job functions. Developers need secure coding practices to prevent vulnerabilities like SQL injection or XSS, while executives are prime targets for social engineering and need awareness of executive-specific threats like whaling and business email compromise. This approach ensures that training is relevant, engaging, and effective in mitigating the most pertinent risks for each group.

Answer

Focus only on phishing simulations for all staff

Answer

Deliver the same annual training to all employees

Answer

Create a single module covering all topics for everyone

Question 9

During third-party risk assessment, a vendor is found to have access to sensitive customer data. The vendor's own supply chain includes a critical fourth-party component. What is the BEST way to address this nth-party risk?

Accepted Answer

Request the vendor to assess and pass through security requirements to its suppliers. The organization cannot directly assess every fourth party in its vendor's supply chain, but it can contractually require the vendor to flow down security requirements and assess its own suppliers. This is the standard nth-party risk management approach recommended by frameworks like NIST SP 800-161 and ISO 28000. It maintains accountability through the vendor while extending controls to the fourth party.

Answer

Ignore the fourth party as it is outside the organization's scope

Answer

Conduct a direct assessment of the fourth party

Answer

Terminate the contract with the vendor

Question 10

An organization's security budget is 8% of the IT budget. Industry benchmarks suggest 10-15% for mature programs. Which of the following should the CISO do FIRST to justify an increase?

Accepted Answer

Present a cost-benefit analysis showing breach avoidance value. A cost-benefit analysis that quantifies the value of avoided breaches translates the security gap into business terms (financial risk reduction, regulatory exposure, downtime cost), which is the language executives and the board use to approve budget. It directly addresses the CISO's need to justify the increase with evidence rather than comparison or emotion. This is the FIRST step because it builds the business case that supports any subsequent request.

Answer

Reduce other IT expenses to free up funds

Answer

Request additional budget for emerging threats

Answer

Highlight the percentage gap compared to peers

Question 11

Which of the following is the PRIMARY purpose of a security champions program?

Accepted Answer

Embed security advocates in dev teams to promote secure practices. The primary purpose of a security champions program is to embed security advocates within development teams to promote secure practices and foster a security culture. Champions are developers who receive additional security training and act as the go-to person for security questions within their team, helping to integrate security earlier in the SDLC. This scales security knowledge without adding dedicated security staff to every team.

Answer

Enforce compliance with security policies

Answer

Reduce the number of phishing simulations

Answer

Replace the need for a dedicated security team

Question 12

A CISO is evaluating a cloud provider's security posture. Which of the following should be the MOST important consideration in the vendor risk assessment?

Accepted Answer

The provider's certifications and SOC 2 reports. Independent third-party attestations such as SOC 2 reports and certifications (ISO 27001, FedRAMP, PCI DSS) provide verifiable evidence of the provider's security controls, making them the most important consideration in a vendor risk assessment. They allow the CISO to evaluate the provider's actual control environment rather than relying on marketing claims, brand reputation, or pricing.

Answer

The provider's data center locations

Answer

The provider's market share and brand reputation

Answer

The provider's pricing compared to competitors

Question 13

An organization is implementing a vendor tiering program for third-party risk management. Which TWO criteria should be used to classify vendors into high, medium, or low risk tiers? (Select TWO)

Accepted Answer

Type and sensitivity of data accessed. Option B is correct because the type and sensitivity of data a vendor accesses directly determines the potential impact of a breach — vendors handling regulated data such as PII, PHI, or PCI cardholder data warrant higher risk tiers than those with no data access. Option D is correct because the criticality of the service provided reflects how much business disruption would occur if the vendor failed, making it a core input to tiering under frameworks like NIST and ISO 31000. Options A, C, and E are not primary tiering criteria: contract length does not indicate inherent risk, annual revenue reflects vendor size rather than the risk it poses to the organization, and geographic location is at most a secondary or contextual factor rather than a defining classification criterion.

Answer

Length of contract

Answer

Vendor's annual revenue

Answer

Vendor's geographic location

Question 14

A security awareness program includes phishing simulations. Which THREE factors should be considered when designing the simulation frequency and difficulty? (Select THREE)

Accepted Answer

Employee role and job function. Option B (Employee role and job function) is correct because employees in finance, HR, or executive roles face different phishing lures and risk levels, so simulations should be tailored to the specific threats and responsibilities of each role. Option C (Past phishing click rate trends) is correct because historical click-rate data reveals which users or departments are most susceptible, allowing frequency and difficulty to be adjusted upward or downward based on demonstrated performance. Option E (Current threat landscape and prevalent attack types) is correct because simulations must reflect real-world tactics such as credential harvesting, QR-code phishing, or business email compromise that are actively trending, ensuring training stays relevant. Option A (Employee's years of service) is not a reliable indicator of phishing susceptibility, since tenure does not correlate consistently with security awareness or behavior. Option D (Number of security incidents in the past year) is too broad and lagging an indicator; it does not directly inform the design of phishing simulation frequency or difficulty the way role, click trends, and threat landscape do.

Answer

Employee's years of service

Answer

Number of security incidents in the past year

Question 15

When implementing security controls, which approach ensures that multiple layers of defense are applied so that if one control fails, others compensate?

Accepted Answer

Defense-in-depth. Defense-in-depth (option D) is the correct approach because it implements multiple, overlapping layers of security controls (e.g., firewalls, IDS/IPS, endpoint protection, access controls) so that if one layer fails or is bypassed, subsequent layers continue to provide protection. This layered strategy reduces the likelihood of a single point of failure compromising the entire security posture, aligning with the CISM principle of risk mitigation through redundancy.

Answer

Business-enabling controls

Answer

Critical controls first

Answer

Compensating controls