CISM Information Security Programme Practice Test 8 — 15 Questions

Question 1

An organization's CISO reports to the CIO. The CISO is concerned that security initiatives are often deprioritized due to conflicts of interest. Which reporting structure would best address this concern?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reporting to the board or risk committee. Reporting to the board or risk committee provides the CISO with an independent reporting line that is not subordinate to the CIO or other executives whose priorities may conflict with security. This structure ensures security concerns are elevated to a governance body with fiduciary oversight, reducing the likelihood that security initiatives are deprioritized due to operational or budgetary conflicts. It also aligns with governance best practices that separate security oversight from IT delivery.

Answer

Reporting to the CEO

Answer

Reporting to the COO

Answer

Reporting to the CFO

Question 2

A company is selecting a security control framework. They want a prioritized set of controls that are implementation group-based and address common cyber threats. Which framework best meets these requirements?

Accepted Answer

CIS Controls v8. CIS Controls v8 provides a prioritized set of actions that collectively form a defense-in-depth set of best practices to mitigate the most common cyber attacks. It is organized into Implementation Groups (IG1, IG2, IG3) based on organizational risk and resources, making it the framework that best meets the requirement for prioritized, implementation group-based controls addressing common threats.

Answer

COBIT 2019

Answer

NIST SP 800-53

Answer

ISO 27001 Annex A

Question 3

A security awareness manager is designing role-based training. Which training is most appropriate for software developers?

Accepted Answer

Secure coding practices. Secure coding practices training is the most appropriate for software developers because it directly addresses the skills they need to write code that resists vulnerabilities like injection, XSS, and insecure deserialization. Role-based training should map to the specific risks and responsibilities of the role, and developers are primarily responsible for building secure software. Phishing and social engineering awareness are more relevant to general staff, while incident response procedures are for the incident response team.

Answer

Phishing identification

Answer

Social engineering awareness

Answer

Incident response procedures

Question 4

In a vendor risk assessment, a third-party vendor will have access to sensitive customer data. According to TPRM best practices, what should the organization do first?

Accepted Answer

Conduct a risk assessment. Before any contractual, monitoring, or exit planning can occur, the organization must first conduct a risk assessment to understand the vendor's risk profile, data sensitivity, and potential impact. This assessment informs the security requirements, contract clauses, and monitoring strategy that follow. TPRM best practice follows a logical sequence: assess risk first, then apply controls proportionate to that risk.

Answer

Include security requirements in the contract

Answer

Define exit procedures

Answer

Perform ongoing monitoring

Question 5

A security dashboard is being designed for the C-suite. Which metric is most appropriate for a one-page executive summary?

Accepted Answer

Security scorecard with overall risk level. The security scorecard with overall risk level is the most appropriate metric for a one-page executive summary because it provides a high-level, aggregated view of the organization's security posture. Executives need a concise, actionable summary that distills complex security data into a single risk indicator, enabling quick decision-making without technical details.

Answer

Number of phishing simulation campaigns

Answer

List of all security incidents in the quarter

Answer

Detailed patch compliance by system

Question 6

An organization wants to establish a security champions program. What is the primary benefit of embedding security advocates in development teams?

Accepted Answer

Improving secure coding adoption and collaboration. A security champions program embeds security-minded individuals within development teams to promote secure coding practices, provide peer guidance, and improve collaboration between security and engineering. The primary benefit is cultural and practical: security becomes part of the development workflow rather than a gate at the end. This improves secure coding adoption and cross-team collaboration, which is the core outcome of the program.

Answer

Eliminating the need for vulnerability assessments

Answer

Replacing the role of security architects

Answer

Reducing the need for a SOC

Question 7

A mature security program allocates 12% of IT budget to security. Which combination of budget components is most balanced for a program seeking to improve detection and response capabilities?

Accepted Answer

Personnel 40%, Technology 30%, Services 20%, Training 10%. A balanced security budget for improving detection and response typically allocates the largest portion to personnel (40%), since skilled analysts are critical for threat hunting, incident response, and security operations. Technology (30%) supports tools like SIEM, EDR, and SOAR, while services (20%) provide specialized expertise, and training (10%) ensures staff remain proficient. This distribution avoids over-reliance on technology or personnel alone, aligning with CISM's emphasis on balanced program management.

Answer

Personnel 20%, Technology 50%, Services 20%, Training 10%

Answer

Personnel 50%, Technology 20%, Services 20%, Training 10%

Answer

Personnel 30%, Technology 30%, Services 30%, Training 10%

Question 8

A security manager is evaluating OKRs for the vulnerability management team. Which key result best aligns with an objective to reduce risk from vulnerabilities?

Accepted Answer

Reduce mean time to remediate critical vulnerabilities by 30%. Reducing mean time to remediate (MTTR) critical vulnerabilities by 30% is a direct risk-reduction outcome — it shortens the window of exposure and is measurable, time-bound, and tied to the objective. OKRs require key results that measure outcomes, not activities. MTTR is a standard risk metric that security leadership uses to demonstrate reduced exposure.

Answer

Conduct quarterly penetration tests

Answer

Achieve 95% scan coverage of assets

Answer

Increase the number of scans by 20%

Question 9

When designing phishing simulations, which approach best balances user learning and operational disruption?

Accepted Answer

Start with low-difficulty simulations, increase difficulty over time, and require remediation training for clickers. A progressive difficulty model — starting easy, increasing over time, and requiring remediation training for clickers — balances learning with operational disruption. It builds user awareness gradually, reinforces learning through targeted training, and avoids overwhelming users with high-difficulty simulations that could cause frustration or distrust. This approach aligns with adult learning principles and security awareness best practices.

Answer

Send high-difficulty simulations monthly without training

Answer

Use low-difficulty simulations quarterly with no follow-up

Answer

Send random-difficulty simulations weekly and report clickers to management

Question 10

A company is implementing a third-party risk management program and needs to prioritize vendors for assessment. Which factor should be given the highest weight?

Accepted Answer

Data access level and service criticality. The highest-weighted factor in third-party risk prioritization is the combination of data access level and service criticality. This is because risk exposure is directly proportional to the sensitivity of data the vendor can access and how essential the vendor's service is to business operations. A vendor with access to regulated data (e.g., PII, PHI) or that supports a critical business function poses a significantly higher risk if compromised, regardless of contract value or vendor size. Thus, these two dimensions determine the potential impact of a vendor-related incident, making them the primary drivers for assessment prioritization.

Answer

Contract value

Answer

Duration of the relationship

Answer

Vendor size

Question 11

Which TWO of the following are key components of a security operations center (SOC)? (Select TWO)

Accepted Answer

Incident response. Incident response (C) is a core SOC component because the SOC's mission includes detecting, containing, eradicating, and recovering from security incidents, typically following a defined IR lifecycle and using tools like SIEM alerts, ticketing, and forensic analysis. Security monitoring and detection (D) is also fundamental, as the SOC continuously collects and correlates telemetry (for example, logs and network flows via a SIEM) to identify suspicious activity and generate alerts that drive response. Vulnerability scanning (A) is a vulnerability management activity often performed by a separate team, even if its output may inform SOC prioritization. Identity and access management (B) is an access-control discipline typically owned by IAM/identity teams, not a defining SOC component. Application security testing (E) belongs to secure development/AppSec functions such as SAST, DAST, and SCA, rather than the SOC's monitoring-and-response core.

Answer

Vulnerability scanning

Answer

Identity and access management

Answer

Application security testing

Question 12

An organization is selecting security controls from NIST SP 800-53. Which TWO control families are most directly related to access control? (Select TWO)

Accepted Answer

Identification and Authentication (IA). Option E, Access Control (AC), is correct because the AC family in NIST SP 800-53 is explicitly dedicated to controlling access to systems and information, covering policies, account management, access enforcement, least privilege, and separation of duties. Option A, Identification and Authentication (IA), is correct because IA controls establish and verify user, device, and process identities, which is the prerequisite for enforcing access control decisions. Together, AC and IA form the core of logical access control in the NIST control catalog. Option B, Configuration Management (CM), addresses baselines and change control rather than who may access resources. Option C, System and Communications Protection (SC), focuses on boundary protection, cryptography, and network security mechanisms. Option D, Audit and Accountability (AU), deals with logging, monitoring, and review of activity, not with granting or denying access.

Answer

Configuration Management (CM)

Answer

System and Communications Protection (SC)

Answer

Audit and Accountability (AU)

Question 13

A security manager is building a business case for additional security budget. Which THREE justifications are most effective for obtaining executive approval? (Select THREE)

Accepted Answer

Compliance cost avoidance. Option B (Compliance cost avoidance) is correct because executives respond to quantifiable financial impact, and demonstrating how security spending prevents regulatory fines, penalties, and audit remediation costs under frameworks like PCI DSS, HIPAA, or GDPR directly ties budget to avoided losses. Option C (Breach avoidance value) is correct because it expresses security investment in business terms—expected loss from data breaches, ransomware, and downtime—using metrics such as ALE (Annualized Loss Expectancy) to show the cost-benefit of prevention versus the cost of a incident. Option D (Operational efficiency improvements) is correct because security controls that streamline processes, reduce manual effort, and lower incident response overhead deliver measurable productivity gains that justify spend beyond pure risk reduction. Option A (Number of security tools deployed) is not a strong justification because tool count is a vanity metric that does not demonstrate value or risk reduction and may even suggest inefficiency. Option E (Industry peer comparison) is not compelling on its own because peer spending benchmarks do not prove that the investment will protect this specific organization's assets or deliver a positive return.

Answer

Number of security tools deployed

Answer

Industry peer comparison

Question 14

A CISO is deciding on the organizational structure for the information security team. Which reporting structure is most likely to ensure the security function has sufficient independence and authority?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board of directors ensures the information security function operates independently from operational and IT management, preventing conflicts of interest where security decisions could be overridden by cost or performance pressures. This structure aligns with the CISM principle that the CISO must have sufficient authority to enforce security policies across the entire organization without reporting to a function that may prioritize other objectives over security.

Answer

Reporting to the Chief Information Officer (CIO)

Answer

Reporting to the Chief Operating Officer (COO)

Answer

Reporting to the Chief Financial Officer (CFO)

Question 15

A company is designing a security awareness program. Which approach is MOST effective for ensuring that employees apply security principles in their daily work?

Accepted Answer

Role-based training: developers receive secure coding training, executives receive social engineering awareness. Role-based training is most effective because it tailors security education to the specific risks and responsibilities of different job functions. Developers need secure coding practices, while executives are prime targets for social engineering. This relevance increases engagement and application of security principles in daily work. Other approaches are either too generic or lack the necessary depth.

Answer

Annual computer-based training for all employees covering general security topics

Answer

Monthly phishing simulations without any accompanying training

Answer

A one-time security awareness seminar conducted by an external consultant