CISM Information Security Governance Practice Test 2 — 15 Questions

Question 1

A multinational corporation is designing its information security governance framework. The board has requested a single metric that best indicates the effectiveness of the security program. Which metric would BEST satisfy this request?

Accepted Answer

Percentage of security controls achieving their intended outcomes as validated by testing.. Option D is correct because it provides a direct measure of how well security controls are working. Option A is an operational metric, not strategic. Option B is a compliance metric but does not measure effectiveness. Option C is a technical metric that may not resonate with the board.

Answer

Percentage of systems compliant with security baseline.

Answer

Number of security incidents reported per month.

Answer

Mean time to detect (MTTD) security events.

Question 2

An information security manager is developing a security strategy for a financial institution. Which of the following should be the PRIMARY driver for selecting security controls?

Accepted Answer

Business requirements derived from risk assessment and compliance obligations.. Business requirements derived from risk assessment and compliance obligations are the primary driver because they directly align security controls with the institution's specific risk appetite, regulatory mandates (e.g., PCI DSS, SOX, GDPR), and operational needs. This ensures controls are cost-effective and prioritized based on actual exposure rather than reactive or budget-driven decisions.

Answer

The latest cybersecurity threats reported in the industry.

Answer

Past security incidents that caused significant financial loss.

Answer

The security budget allocated for the fiscal year.

Question 3

During an audit, it was found that the organization's information security policy is not being followed by business units. Which of the following is the MOST effective way for the information security manager to improve compliance?

Accepted Answer

Establish a policy review committee with business unit representatives to align policy with operational needs.. The most effective way to improve compliance is to align the policy with operational realities by involving business unit representatives in a policy review committee. When policies conflict with business processes, users will bypass them; adjusting the policy to be both secure and practical increases voluntary adherence. This addresses the root cause—policy misalignment—rather than treating symptoms like lack of awareness or enforcement.

Answer

Provide additional security awareness training focused on policy requirements.

Answer

Escalate non-compliance to senior management for disciplinary action.

Answer

Increase the frequency of automated policy compliance checks.

Question 4

An organization has decided to adopt a risk-based approach to information security. What is the FIRST step the information security manager should take to implement this approach?

Accepted Answer

Identify and assess information assets and their associated threats and vulnerabilities.. The first step in implementing a risk-based approach is to identify and assess information assets along with their associated threats and vulnerabilities. This foundational activity provides the necessary context for all subsequent risk management decisions, including defining risk appetite, selecting a framework, and implementing controls. Without a clear understanding of what assets exist and what risks they face, any further steps would be based on assumptions rather than evidence.

Answer

Define the organization's risk appetite and risk tolerance levels.

Answer

Implement security controls based on industry best practices.

Answer

Select a risk management framework such as ISO 31000 or NIST RMF.

Question 5

Which TWO of the following are key responsibilities of an information security governance committee?

Accepted Answer

Approve major changes to information security policies.. The information security governance committee is a high-level body responsible for strategic oversight. Approving major changes to information security policies (Option C) is a core governance function, ensuring that policy updates align with business objectives and regulatory requirements before implementation. This is distinct from operational tasks like vulnerability assessments or daily monitoring.

Answer

Perform vulnerability assessments on critical systems.

Answer

Set the organization's risk appetite.

Answer

Conduct daily monitoring of security events.

Question 6

Which THREE of the following are essential components of an information security governance framework?

Accepted Answer

Strategic alignment of security with business objectives.. Strategic alignment of security with business objectives (Option C) is essential because an information security governance framework must ensure that security initiatives directly support and enable the organization's mission and goals. Without this alignment, security becomes a siloed cost center rather than a strategic enabler, leading to misallocated resources and reduced executive sponsorship. This principle is foundational to the CISM governance domain, where security is viewed as a business function, not just a technical discipline.

Answer

A process for conducting security incident response.

Answer

Implementation of technical security controls such as firewalls.

Question 7

You are the information security manager for a mid-sized e-commerce company with 500 employees. The company recently experienced a data breach where an attacker exploited a vulnerability in a third-party payment processing API, resulting in the exposure of 10,000 customer credit card numbers. The breach was detected by an external forensics team 90 days after the initial compromise. The board is concerned about the company's ability to detect and respond to incidents. Currently, the company has a part-time security team of three people who focus on firewall management and antivirus updates. There is no formal incident response plan, and security monitoring is limited to basic log review once a week. The CISO has asked you to recommend a course of action to improve the security posture, with a focus on governance and oversight. Which of the following is the BEST course of action?

Accepted Answer

Develop and implement an incident response plan, establish a security operations center (SOC) with 24/7 monitoring, and define clear roles and responsibilities.. Option B is correct because the core governance issue is the lack of a formal incident response plan and adequate monitoring. Establishing a SOC with 24/7 monitoring directly addresses the 90-day detection gap, while defining roles and responsibilities ensures accountability and oversight, which are key governance principles. This approach aligns with the CISM focus on establishing processes and oversight rather than just deploying technology.

Answer

Immediately implement a PCI DSS compliance program to ensure all payment data handling meets industry standards.

Answer

Purchase and deploy a next-generation firewall and endpoint detection and response (EDR) tools across the network.

Answer

Outsource all security operations to a managed security service provider (MSSP) with a focus on threat intelligence.

Question 8

A multinational corporation is implementing a risk-based approach to information security governance. The chief information security officer (CISO) has been asked to prioritize security initiatives based on business impact. Which of the following actions should the CISO take FIRST to align security governance with business objectives?

Accepted Answer

Conduct a business impact analysis (BIA) to identify critical processes and their security requirements.. Conducting a business impact analysis (BIA) is the foundational step in a risk-based governance approach because it identifies critical business processes, their recovery time objectives (RTOs), and the specific security requirements needed to protect them. Without this analysis, the CISO cannot align security initiatives with business impact, as the BIA directly links security controls to the organization's most valuable assets and operational priorities.

Answer

Enforce multifactor authentication (MFA) for all remote access.

Answer

Implement a compliance management tool to track regulatory requirements.

Answer

Deploy a security information and event management (SIEM) system to centralize log analysis.

Question 9

A security audit has identified several governance weaknesses. Which TWO of the following are most likely to indicate a lack of effective information security governance? (Choose two.)

Accepted Answer

Risk assessments are not performed on a regular basis.. A is correct because regular risk assessments are a foundational requirement of information security governance, as they ensure that security controls remain aligned with evolving threats and business objectives. Without periodic risk assessments, the organization cannot demonstrate due diligence or maintain an accurate risk profile, which is a direct indicator of governance failure.

Answer

The information security policy is not available on the intranet.

Answer

Employees have not completed annual security awareness training.

Answer

Antivirus software is not updated on all endpoints.

Question 10

Refer to the exhibit. A security analyst reviews the ACL on the organization's border router. Based on the exhibit, which of the following is the MOST significant governance concern?

Accepted Answer

The ACL does not include filtering for outbound traffic, which may allow spoofed internal IPs to exit the network.. Option B is correct because the ACL shown only filters inbound traffic on the border router's external interface. Without an outbound ACL (or an inbound ACL on the internal interface), spoofed packets with internal source IP addresses can exit the network, enabling IP spoofing attacks that bypass anti-spoofing best practices (RFC 2827, BCP 38). This is a governance concern as it violates the principle of preventing source address spoofing, which is a fundamental security control for network perimeter defense.

Answer

The ACL is applied to the outbound interface, which is ineffective for blocking inbound attacks.

Answer

The ACL permits any traffic after denying specific IP ranges, creating a security gap.

Answer

The ACL permits all traffic from private IP addresses, which could allow internal IP spoofing.

Question 11

Arrange the steps for responding to a data breach involving personally identifiable information (PII).

Question 12

Arrange the steps for deploying a security patch to critical servers in a production environment.

Question 13

Match each security control type to its example.

Question 14

Match each security metric to its description.

Question 15

A company's information security manager is tasked with ensuring that security initiatives align with business goals. Which of the following best demonstrates this alignment?

Accepted Answer

Establishing security metrics that are linked to key business performance indicators.. Option D is correct because linking security metrics to business KPIs directly shows how security supports business objectives. Option A is wrong because compliance alone does not guarantee alignment with business goals. Option B is wrong because focusing only on technical risks ignores business context. Option C is wrong because budget allocation should be based on risk and business value, not just equal distribution.

Answer

Prioritizing security projects based solely on technical risk assessment.

Answer

Implementing all security controls required by regulatory standards.

Answer

Creating a security budget that allocates funds equally across departments.