CISM Information Security Programme Practice Test 9 — 15 Questions

Question 1

In designing a security programme for a mid-sized enterprise, the CISO is deciding which security framework to adopt for control selection. Which of the following frameworks is specifically structured around implementation groups (IG1, IG2, IG3) to help organizations prioritize controls based on risk and maturity?

Accepted Answer

CIS Controls v8. The CIS Controls v8 are organized into three Implementation Groups (IG1, IG2, IG3) to guide organizations in prioritizing controls based on their risk profile and security maturity. NIST SP 800-53 and ISO 27001 use different categorizations.

Answer

ISO 27001 Annex A

Answer

NIST SP 800-53

Answer

COBIT 2019

Question 2

A security awareness program includes phishing simulations. After six months, the click rate has decreased from 15% to 8%, but the number of reported phishing emails has also dropped. The CISO wants to measure the effectiveness of the program. Which metric would best indicate sustained improvement in security behavior?

Accepted Answer

Phishing click rate trend over the last 12 months. A sustained low click rate over time, with increasing or stable reporting rates, is a leading indicator of improved security awareness. A decreasing click rate alone may be confounded by other factors, but combined with reporting trends it shows behavioral change.

Answer

Pass rate on post-training knowledge assessments

Answer

Number of security incidents caused by phishing

Answer

Number of employees who completed training

Question 3

An organization is implementing a vendor risk management program. A vendor that provides cloud-based HR services will have access to employee PII. According to industry best practices, what should be the first step in the vendor lifecycle?

Accepted Answer

Perform a risk assessment of the vendor. The first step is to perform a risk assessment based on the vendor's data access and service criticality to determine the appropriate level of due diligence. This aligns with the NIST framework for third-party risk management.

Answer

Include security requirements in the contract

Answer

Request the vendor's SOC 2 report

Answer

Conduct an onsite audit of the vendor

Question 4

A CISO is preparing an executive dashboard for the board of directors. Which combination of metrics would provide the most meaningful overview of the security programme's effectiveness?

Accepted Answer

Mean time to detect (MTTD), mean time to respond (MTTR), and number of breaches. Leading indicators like patch compliance and MTTD provide forward-looking insight and operational efficiency, while lagging indicators like breach count show past impact. A balanced scorecard should include both.

Answer

Number of security architects, SOC analyst headcount, and security tool count

Answer

Number of security incidents, percentage of systems patched, and security awareness training completion rate

Answer

Phishing click rate, number of vendor assessments completed, and security budget spent

Question 5

In a defence-in-depth strategy, which control is considered a compensating control when a critical application cannot be patched immediately due to operational constraints?

Accepted Answer

Network segmentation. Compensating controls provide alternative protection when a primary control cannot be applied. Network segmentation limits the blast radius and reduces the attack surface until patching can occur.

Answer

Configuration management

Answer

Intrusion detection system (IDS)

Answer

Vulnerability scanning

Question 6

Which role within a security team is primarily responsible for designing and reviewing security architectures to ensure alignment with business requirements and security standards?

Accepted Answer

Security architect. The security architect designs and reviews the security architecture, ensuring it meets business needs and security requirements. Other roles focus on operations, analysis, or awareness.

Answer

SOC analyst

Answer

GRC analyst

Answer

Security analyst

Question 7

An organization is developing a security scorecard for the CISO. Which of the following is a leading indicator that would be most useful for predicting future security incidents?

Accepted Answer

Percentage of systems compliant with patch SLAs. Leading indicators, such as the percentage of systems with known vulnerabilities patched within the SLA, provide early warning of potential issues. Patch compliance is a proactive measure that reduces risk.

Answer

Mean time to respond (MTTR) to incidents

Answer

Number of security incidents in the past quarter

Answer

Total cost of security incidents

Question 8

A CISO is planning the security programme budget and wants to justify the investment to the CFO. The organization has a moderate risk appetite and an IT budget of $10 million. What is the most appropriate budget range for the security programme based on industry benchmarks?

Accepted Answer

$1,000,000 to $1,500,000. For a mature security programme, industry benchmarks suggest 10-15% of IT budget. For a $10M IT budget, that is $1M to $1.5M. 0.2-0.5% of revenue is another benchmark but not directly applicable here without revenue data.

Answer

$500,000 to $1,000,000

Answer

$1,500,000 to $2,000,000

Answer

$200,000 to $500,000

Question 9

Which of the following is the primary objective of a security champions programme?

Accepted Answer

To embed security advocates within development teams. A security champions programme embeds security advocates within development teams to promote secure practices, improve communication, and embed security into daily work, rather than incident response or policy enforcement.

Answer

To enforce security policies across the organization

Answer

To conduct phishing simulations for employees

Answer

To provide an escalation path for security incidents

Question 10

In a third-party risk management programme, what is the primary purpose of vendor tiering?

Accepted Answer

To prioritize which vendors require more rigorous security assessments. Vendor tiering categorizes vendors based on the criticality of services and data access to determine the appropriate level of due diligence and monitoring. This ensures resources are focused on high-risk vendors.

Answer

To assign responsibility for vendor management to different teams

Answer

To ensure all vendors receive the same level of oversight

Answer

To determine the vendor's pricing structure

Question 11

During a security architecture review, the security architect identifies that a new application stores sensitive customer data in plaintext in the database. The application owner argues that performance requirements prevent encryption. What is the most appropriate compensating control to reduce risk?

Accepted Answer

Database activity monitoring (DAM). Database activity monitoring (DAM) can detect unauthorized access or exfiltration attempts, providing visibility and alerting without impacting performance. Encryption at rest is preferred, but DAM is a compensating control when encryption is not feasible.

Answer

Implement strong password policies for database access

Answer

Network segmentation to isolate the database server

Answer

Conduct more frequent vulnerability scans

Question 12

An organization wants to measure the effectiveness of its security awareness programme. Which metric is a leading indicator of improved security culture?

Accepted Answer

Number of phishing emails reported by employees. An increase in the number of phishing emails reported by employees indicates that they are actively recognizing and reporting suspicious activity, which is a leading indicator of improved security awareness and culture.

Answer

Number of security incidents attributed to human error

Answer

Percentage of employees who completed annual training

Answer

Average score on knowledge assessment tests

Question 13

A CISO is developing key risk indicators (KRIs) for the security programme. Which TWO of the following are lagging indicators? (Select TWO.)

Accepted Answer

Number of data breaches in the past quarter. Lagging indicators measure past performance or outcomes. Number of data breaches and mean time to respond (MTTR) are outcome and efficiency metrics that reflect past events. Patch compliance and phishing click rate are leading indicators.

Answer

Percentage of systems patched within SLA

Answer

Percentage of access reviews completed on time

Answer

Phishing click rate

Question 14

A multinational organization is implementing a vendor risk management programme. Which THREE of the following should be included in the programme to effectively manage nth-party risk? (Select THREE.)

Accepted Answer

Include contractual clauses that require vendors to pass down security requirements to subcontractors. To manage nth-party risk, the programme should require vendors to disclose their subcontractors, include contractual clauses flowing down security requirements, and have the right to audit subcontractors. Assessing all suppliers' suppliers is impractical; focusing on high-risk vendors is more feasible.

Answer

Conduct annual security assessments of all subcontractors

Answer

Require vendors to obtain insurance for subcontractors

Question 15

In designing a security operations centre (SOC), which TWO functions are core to the SOC's responsibilities? (Select TWO.)

Accepted Answer

Security monitoring and detection. The SOC core functions include monitoring security events, detecting threats, and responding to incidents. Vulnerability management and security architecture are typically separate functions, though they may interact with the SOC.

Answer

Vulnerability management

Answer

Security awareness training

Answer

Security architecture design