CISM Information Security Programme Practice Test 9 — 15 Questions

Question 1

Which control framework is structured around Implementation Groups (IG1, IG2, IG3) to help organizations prioritize security controls based on risk?

Accepted Answer

CIS Controls v8. The CIS Controls v8 framework is uniquely structured around Implementation Groups (IG1, IG2, IG3) to provide a prioritized, risk-based approach to security control implementation. IG1 represents basic cyber hygiene for organizations with limited resources, IG2 adds more advanced controls for those with moderate risk, and IG3 includes comprehensive controls for high-risk environments. This tiered structure directly aligns with the CISM focus on aligning security controls with business risk and resource constraints.

Answer

COBIT 2019

Answer

ISO 27001 Annex A

Answer

NIST SP 800-53

Question 2

An organization's third-party risk management program has been in place for two years. Which of the following is the MOST critical action to ensure the program remains effective?

Accepted Answer

Implementing continuous monitoring of high-risk vendors. Continuous monitoring of high-risk vendors is the most critical action because it provides real-time or near-real-time visibility into security posture changes, such as new vulnerabilities, configuration drifts, or breach indicators, which static annual assessments cannot catch. This aligns with the NIST SP 800-137 framework for continuous monitoring and is essential for adapting to evolving threats in a third-party ecosystem.

Answer

Conducting a one-time risk assessment before contract signing

Answer

Performing annual reassessments for all vendors

Answer

Maintaining a list of all vendors and their criticality

Question 3

A company is developing security metrics to present to the C-suite. Which metric is a leading indicator of security performance?

Accepted Answer

Percentage of user access reviews completed on time. Percentage of user access reviews completed on time is a leading indicator because it measures a proactive governance activity that reduces the risk of excessive or inappropriate access before it can be exploited. Completing reviews on time predicts better access control hygiene and lower future incident likelihood. The other options are lagging indicators that report past incidents or their costs.

Answer

Mean time to detect (MTTD) security incidents

Answer

Total cost of security incidents

Answer

Number of data breaches in the past quarter

Question 4

An information security manager is asked to justify an increase in the security budget. Which approach BEST demonstrates the value of the security program?

Accepted Answer

Calculating the ROI by estimating breach avoidance and compliance cost savings. Presenting the return on investment (ROI) by quantifying avoided breach costs and compliance savings provides a business case for budget increases.

Answer

Comparing the proposed budget to industry benchmarks

Answer

Highlighting the number of security tools currently in use

Answer

Listing all security certifications held by the team

Question 5

Which security team role is primarily responsible for defining and maintaining security architecture standards?

Accepted Answer

Security architect. The security architect is the role responsible for defining and maintaining security architecture standards, including reference architectures, control frameworks, and design patterns. This role translates business and risk requirements into technical standards that other teams implement.

Answer

GRC analyst

Answer

Security analyst

Answer

Penetration tester

Question 6

An organization with a mature security program allocates 12% of its IT budget to security. Which factor is MOST likely to support this level of investment?

Accepted Answer

The organization is in a highly regulated industry with strict compliance mandates. A 12% security budget allocation is most likely supported by a highly regulated industry with strict compliance mandates (A). Regulatory requirements (e.g., HIPAA, PCI DSS, GDPR, SOX) mandate specific security controls, audits, and reporting, forcing organizations to invest significantly in security to avoid penalties and maintain compliance. This external pressure justifies and sustains higher security spending compared to discretionary investment.

Answer

The organization's IT budget is very large

Answer

The organization has a low number of security incidents historically

Answer

The organization has a high risk tolerance

Question 7

A SOC analyst receives an alert about a potential malware infection on a critical server. Which step should the analyst take FIRST?

Accepted Answer

Perform initial triage to verify the alert and assess severity. The first step in any incident response is to verify that an alert represents a real incident and assess its severity. Performing initial triage allows the analyst to gather evidence, determine the scope, and decide on the appropriate response without causing unnecessary disruption. Rebooting, disconnecting, or escalating prematurely can destroy evidence or disrupt critical services.

Answer

Reboot the server to clear the potential malware

Answer

Notify the incident response team and escalate

Answer

Disconnect the server from the network immediately

Question 8

When selecting security controls based on NIST SP 800-53, which control family is MOST directly related to protecting the confidentiality of data?

Accepted Answer

Access Control (AC). In NIST SP 800-53, the Access Control (AC) family is the most directly related to protecting data confidentiality because it governs who can access which resources and under what conditions, including least privilege, separation of duties, and information flow enforcement. Confidentiality is fundamentally about restricting unauthorized read access, which is the core purpose of AC controls.

Answer

Identification and Authentication (IA)

Answer

System and Communications Protection (SC)

Answer

Audit and Accountability (AU)

Question 9

Which TWO of the following are components of a typical vulnerability management program?

Accepted Answer

Remediating identified vulnerabilities through patching. A vulnerability management program is built around a continuous cycle of discovering, prioritizing, and fixing weaknesses, so option E (conducting regular vulnerability scans) is correct because recurring authenticated and unauthenticated scans are the primary discovery mechanism that populates the vulnerability inventory. Option B (remediating identified vulnerabilities through patching) is correct because remediation—applying vendor patches, configuration changes, or compensating controls—closes the loop and is the ultimate goal of the program; scanning without remediation provides no risk reduction. Option A (security awareness training) belongs to a security education/awareness program, not vulnerability management, since it targets human behavior rather than technical weaknesses. Option C (monitoring network traffic for anomalies) is a detection/incident-monitoring activity typically handled by IDS/IPS, SIEM, or SOC operations, not vulnerability management. Option D (performing penetration tests) is an offensive security assessment that can validate and supplement a vulnerability management program, but it is a point-in-time testing exercise rather than a core component of the ongoing scan-and-remediate process.

Answer

Conducting security awareness training

Answer

Monitoring network traffic for anomalies

Answer

Performing penetration tests

Question 10

Which THREE of the following are key activities in a third-party risk management (TPRM) program?

Accepted Answer

Ongoing monitoring of vendor security posture. Option A (Ongoing monitoring of vendor security posture) is correct because TPRM requires continuous oversight of a vendor's security controls, compliance status, and threat exposure after onboarding, using methods such as periodic reassessments, security ratings services, and audit reviews. Option C (Negotiating contract security requirements) is correct because TPRM includes embedding security, privacy, data-handling, breach-notification, and right-to-audit clauses into vendor contracts to establish enforceable obligations and risk allocation. Option D (Onboarding risk assessment for new vendors) is correct because TPRM begins with due diligence before engagement, evaluating the vendor's security posture, data access, criticality, and compliance against organizational risk tolerance. Option B (Providing vendor with access to internal network) is not a TPRM activity; it is an operational access decision that should be minimized and controlled, not a core program function. Option E (Performing background checks on vendor employees) is not a TPRM program activity; personnel screening is typically the vendor's responsibility under contract, and TPRM focuses on organizational vendor risk rather than individual employee vetting.

Answer

Providing vendor with access to internal network

Answer

Performing background checks on vendor employees

Question 11

Which TWO of the following are characteristics of a security champions program that contribute to its effectiveness?

Accepted Answer

Champions act as liaisons between security and their teams. Option C is correct because the core value of a security champions program is that champions serve as the liaison or bridge between the central security team and their own development/product teams, translating security requirements into the team's language and feeding practical concerns back to security. Option E is correct because effective champions are typically volunteers drawn from development (or engineering) teams who receive additional security training, which gives them credibility with peers and the embedded knowledge to influence secure practices organically. Option A is incorrect because champions normally remain within their existing team and reporting line, not reporting directly to the CISO, which would undermine their embedded liaison role. Option B is incorrect because rotating champions every six months destroys the continuity, relationship-building, and accumulated security expertise that make the program effective. Option D is incorrect because champions are influencers and advocates, not enforcers; they generally lack the authority to enforce security policies, which remains with security leadership and management.

Answer

Champions report directly to the CISO

Answer

Champions are rotated every six months

Answer

Champions have authority to enforce security policies

Question 12

In designing a security programme for a mid-sized enterprise, the CISO is deciding which security framework to adopt for control selection. Which of the following frameworks is specifically structured around implementation groups (IG1, IG2, IG3) to help organizations prioritize controls based on risk and maturity?

Accepted Answer

CIS Controls v8. CIS Controls v8 is specifically structured around Implementation Groups (IG1, IG2, IG3) to help organizations prioritize controls based on risk and maturity. IG1 is for small organizations with limited resources, IG2 for mid-sized with more risk, and IG3 for mature organizations facing advanced threats. This makes it uniquely suited for the scenario described.

Answer

ISO 27001 Annex A

Answer

NIST SP 800-53

Answer

COBIT 2019

Question 13

An organization is implementing a vendor risk management program. A vendor that provides cloud-based HR services will have access to employee PII. According to industry best practices, what should be the first step in the vendor lifecycle?

Accepted Answer

Perform a risk assessment of the vendor. The first step in the vendor lifecycle is to perform a risk assessment of the vendor (B). Before any contractual, audit, or documentation requests, the organization must understand the risk the vendor poses based on the data it will access (employee PII) and the criticality of the service. This risk assessment determines the appropriate level of due diligence, contractual controls, and ongoing monitoring — it drives all subsequent steps.

Answer

Include security requirements in the contract

Answer

Request the vendor's SOC 2 report

Answer

Conduct an onsite audit of the vendor

Question 14

A CISO is preparing an executive dashboard for the board of directors. Which combination of metrics would provide the most meaningful overview of the security programme's effectiveness?

Accepted Answer

Mean time to detect (MTTD), mean time to respond (MTTR), and number of breaches. MTTD, MTTR, and number of breaches directly measure how quickly the security program detects and contains incidents and how often it fails, which is what a board needs to judge effectiveness. These are outcome-oriented metrics tied to risk, not activity counts. They translate technical operations into business-relevant resilience indicators.

Answer

Number of security architects, SOC analyst headcount, and security tool count

Answer

Number of security incidents, percentage of systems patched, and security awareness training completion rate

Answer

Phishing click rate, number of vendor assessments completed, and security budget spent

Question 15

In a defence-in-depth strategy, which control is considered a compensating control when a critical application cannot be patched immediately due to operational constraints?

Accepted Answer

Network segmentation. Network segmentation is a compensating control because it reduces the attack surface and lateral movement potential of an unpatched application by isolating it from other systems, thereby mitigating the risk that the vulnerability could be exploited to reach critical assets. When patching is delayed by operational constraints, segmentation provides an alternative risk-reduction mechanism that addresses the same underlying exposure.

Answer

Configuration management

Answer

Intrusion detection system (IDS)

Answer

Vulnerability scanning