CISM Information Security Programme Practice Test 8 — 15 Questions

Question 1

An organization is selecting security controls from NIST SP 800-53. Which TWO control families are most directly related to access control? (Select TWO)

Accepted Answer

Identification and Authentication (IA). Access Control (AC) and Identification and Authentication (IA) are the primary families governing access management.

Answer

Configuration Management (CM)

Answer

System and Communications Protection (SC)

Answer

Audit and Accountability (AU)

Question 2

A security manager is building a business case for additional security budget. Which THREE justifications are most effective for obtaining executive approval? (Select THREE)

Accepted Answer

Compliance cost avoidance. Breach avoidance value, compliance cost avoidance, and operational efficiency gains are direct, quantifiable benefits that resonate with executives.

Answer

Number of security tools deployed

Answer

Industry peer comparison

Question 3

A CISO is deciding on the organizational structure for the information security team. Which reporting structure is most likely to ensure the security function has sufficient independence and authority?

Accepted Answer

Reporting to the CEO or board of directors. Reporting to the CEO or board of directors ensures the information security function operates independently from operational and IT management, preventing conflicts of interest where security decisions could be overridden by cost or performance pressures. This structure aligns with the CISM principle that the CISO must have sufficient authority to enforce security policies across the entire organization without reporting to a function that may prioritize other objectives over security.

Answer

Reporting to the Chief Information Officer (CIO)

Answer

Reporting to the Chief Operating Officer (COO)

Answer

Reporting to the Chief Financial Officer (CFO)

Question 4

An organization is implementing a defense-in-depth strategy. Which of the following is the BEST example of a compensating control?

Accepted Answer

Requiring multi-factor authentication for remote access where strong passwords are not feasible. The best example of a compensating control because it provides an alternative security measure (multi-factor authentication) to mitigate the risk of weak or infeasible strong passwords for remote access. Compensating controls are implemented when a primary control cannot be applied due to technical or operational constraints, and they must achieve an equivalent or greater level of security. In this scenario, MFA compensates for the lack of password strength by requiring an additional authentication factor, such as a one-time passcode (OTP) or biometric, thereby reducing the likelihood of credential compromise.

Answer

Encrypting data at rest using AES-256

Answer

Installing a firewall at the network perimeter

Answer

Conducting quarterly vulnerability scans

Question 5

An information security manager is developing a security scorecard for the board. Which combination of metrics BEST provides a balanced view of security program effectiveness?

Accepted Answer

Number of security incidents and percentage of systems with critical patches applied within SLA. Leading indicators (patch compliance) predict future performance, while lagging indicators (breach count) measure past outcomes. Both are needed for balance.

Answer

Percentage of employees who completed security awareness training and number of reported phishing emails

Answer

Number of security incidents and mean time to detect (MTTD)

Answer

Phishing click rate and percentage of systems with critical patches applied within SLA

Question 6

A company is designing a security awareness program. Which approach is MOST effective for ensuring that employees apply security principles in their daily work?

Accepted Answer

Role-based training: developers receive secure coding training, executives receive social engineering awareness. Role-based training targets specific risks relevant to each job function, making the training more practical and memorable.

Answer

Annual computer-based training for all employees covering general security topics

Answer

Monthly phishing simulations without any accompanying training

Answer

A one-time security awareness seminar conducted by an external consultant

Question 7

Which control framework is structured around Implementation Groups (IG1, IG2, IG3) to help organizations prioritize security controls based on risk?

Accepted Answer

CIS Controls v8. The CIS Controls v8 framework is uniquely structured around Implementation Groups (IG1, IG2, IG3) to provide a prioritized, risk-based approach to security control implementation. IG1 represents basic cyber hygiene for organizations with limited resources, IG2 adds more advanced controls for those with moderate risk, and IG3 includes comprehensive controls for high-risk environments. This tiered structure directly aligns with the CISM focus on aligning security controls with business risk and resource constraints.

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Answer

NIST SP 800-53

Question 8

An organization's third-party risk management program has been in place for two years. Which of the following is the MOST critical action to ensure the program remains effective?

Accepted Answer

Implementing continuous monitoring of high-risk vendors. Continuous monitoring of high-risk vendors is the most critical action because it provides real-time or near-real-time visibility into security posture changes, such as new vulnerabilities, configuration drifts, or breach indicators, which static annual assessments cannot catch. This aligns with the NIST SP 800-137 framework for continuous monitoring and is essential for adapting to evolving threats in a third-party ecosystem.

Answer

Conducting a one-time risk assessment before contract signing

Answer

Performing annual reassessments for all vendors

Answer

Maintaining a list of all vendors and their criticality

Question 9

A company is developing security metrics to present to the C-suite. Which metric is a leading indicator of security performance?

Accepted Answer

Percentage of user access reviews completed on time. Leading indicators predict future security outcomes. Access review completion rates indicate how well access controls are managed, which reduces risk of unauthorized access.

Answer

Mean time to detect (MTTD) security incidents

Answer

Total cost of security incidents

Answer

Number of data breaches in the past quarter

Question 10

An information security manager is asked to justify an increase in the security budget. Which approach BEST demonstrates the value of the security program?

Accepted Answer

Calculating the ROI by estimating breach avoidance and compliance cost savings. Presenting the return on investment (ROI) by quantifying avoided breach costs and compliance savings provides a business case for budget increases.

Answer

Comparing the proposed budget to industry benchmarks

Answer

Highlighting the number of security tools currently in use

Answer

Listing all security certifications held by the team

Question 11

Which security team role is primarily responsible for defining and maintaining security architecture standards?

Accepted Answer

Security architect. The security architect designs the security architecture, ensuring that security controls are integrated into systems and networks.

Answer

GRC analyst

Answer

Security analyst

Answer

Penetration tester

Question 12

An organization with a mature security program allocates 12% of its IT budget to security. Which factor is MOST likely to support this level of investment?

Accepted Answer

The organization is in a highly regulated industry with strict compliance mandates. A mature program typically invests 10-15% of IT budget. The key driver is the organization's risk appetite and compliance requirements, not just revenue percentage.

Answer

The organization's IT budget is very large

Answer

The organization has a low number of security incidents historically

Answer

The organization has a high risk tolerance

Question 13

A SOC analyst receives an alert about a potential malware infection on a critical server. Which step should the analyst take FIRST?

Accepted Answer

Perform initial triage to verify the alert and assess severity. The first step in incident response is to investigate and confirm the alert (triage) to avoid acting on false positives.

Answer

Reboot the server to clear the potential malware

Answer

Notify the incident response team and escalate

Answer

Disconnect the server from the network immediately

Question 14

When selecting security controls based on NIST SP 800-53, which control family is MOST directly related to protecting the confidentiality of data?

Accepted Answer

Access Control (AC). Access control (AC) family includes controls that restrict access to data, directly protecting confidentiality.

Answer

Identification and Authentication (IA)

Answer

System and Communications Protection (SC)

Answer

Audit and Accountability (AU)

Question 15

Which TWO of the following are components of a typical vulnerability management program?

Accepted Answer

Remediating identified vulnerabilities through patching. Vulnerability management includes scanning for vulnerabilities and remediation (patching).

Answer

Conducting security awareness training

Answer

Monitoring network traffic for anomalies

Answer

Performing penetration tests