CISM Information Security Governance Practice Test 3 — 15 Questions

Question 1

An organization has recently experienced a data breach due to an insider threat. The board has requested an update on governance improvements. Which of the following should the information security manager recommend first?

Accepted Answer

Developing a formalized insider threat program with clear roles and responsibilities.. Option B is correct because a formalized insider threat program with defined roles and monitoring reduces the risk of insider incidents. Option A is wrong because technical controls alone are ineffective without governance and process. Option C is wrong because training is important but not the immediate governance priority. Option D is wrong for the same reason as A.

Answer

Conducting annual security awareness training for all employees.

Answer

Implementing two-factor authentication for all critical systems.

Answer

Deploying endpoint detection and response (EDR) software on all systems.

Question 2

An information security manager is evaluating the effectiveness of the organization's security governance. Which of the following metrics would best indicate that governance processes are functioning properly?

Accepted Answer

Percentage of risk treatment plans that have been implemented as scheduled.. Option C is correct because the percentage of risk treatment plans implemented directly reflects whether governance decisions are being executed. Option A is wrong because the number of incidents may vary due to external factors. Option B is wrong because mean time to detect is an operational metric, not governance. Option D is wrong because budget spent does not measure effectiveness.

Answer

Total spending on security tools compared to the approved budget.

Answer

Number of security incidents reported per quarter.

Answer

Mean time to detect (MTTD) for security incidents.

Question 3

A multinational corporation is establishing an information security governance framework. The board has approved a top-down approach where security policies are created at the corporate level and adapted locally. Which of the following is a key benefit of this approach?

Accepted Answer

It ensures a consistent baseline of security controls while allowing for local regulatory adjustments.. Option A is correct because consistent baseline policies ensure minimum security across all units, while local adaptation allows for regulatory compliance. Option B is wrong because local adaptation may reduce consistency. Option C is wrong because top-down reduces time to enforce baseline. Option D is wrong because local teams still have some autonomy.

Answer

It allows each subsidiary to develop security policies that best fit their local legal environment.

Answer

It reduces the time required to implement security policies across the entire organization.

Answer

It minimizes the need for local security teams to understand the corporate strategy.

Question 4

After a security incident, the board holds the CISO accountable. The CISO argues that the incident was caused by a failure in the third-party risk management process. Which of the following governance deficiencies is most likely the root cause?

Accepted Answer

There was no board-approved policy for assessing and monitoring third-party risk.. Option D is correct because without board-level oversight of third-party risk, governance cannot ensure proper management. Option A is wrong because technical failures are not governance deficiencies. Option B is wrong because vendor selection is operational, not governance. Option C is wrong because incident response is post-event; the root cause is lack of governance oversight.

Answer

The third-party contract did not specify security requirements.

Answer

The organization did not implement technical controls to monitor third-party access.

Answer

The incident response plan did not cover third-party related incidents.

Question 5

An information security manager is preparing a report for the board on the state of information security governance. Which of the following elements is most important to include in the report?

Accepted Answer

Key risk indicators (KRIs) related to the organization's critical assets.. Option B is correct because key risk indicators provide a concise view of risk exposure and governance effectiveness. Option A is wrong because a list of all security tools is too detailed and not strategic. Option C is wrong because operational incident details are not board-level. Option D is wrong because budget variance is only one aspect; KRIs are more comprehensive.

Answer

The percentage of the security budget spent on different projects.

Answer

A log of all recent security incidents and their root causes.

Answer

A detailed list of all security tools and their functionalities.

Question 6

A financial institution is restructuring its information security governance to comply with a new regulatory requirement that mandates a formal risk appetite statement. The board has conflicting views on the level of risk to accept. Which of the following should the information security manager do to facilitate the definition of risk appetite?

Accepted Answer

Facilitate a workshop with business leaders to map risk tolerance to strategic goals.. Option A is correct because risk appetite should be aligned with business objectives and defined in business terms to be meaningful. Option B is wrong because industry benchmarks are not binding and may not reflect the institution's unique situation. Option C is wrong because technology risks are only one component. Option D is wrong because the board has final responsibility, not the CISO.

Answer

Recommend adopting the risk appetite levels used by a peer financial institution.

Answer

Draft a risk appetite statement and ask the CISO to approve it on behalf of the board.

Answer

Propose a quantitative risk appetite based on the organization's technology risk metrics.

Question 7

A company's information security manager notices that several business units have implemented shadow IT systems that bypass the central security governance. Which of the following governance strategies would most effectively address this issue in the long term?

Accepted Answer

Establish a formal process for business units to request exceptions to the standard IT policy, with risk acceptance.. Option C is correct because a formal exception process allows business units to innovate while maintaining oversight. Option A is wrong because strict prohibition may drive shadow IT further underground. Option B is wrong because delayed discovery is not proactive governance. Option D is wrong because integration projects are one-time fixes, not a governance solution.

Answer

Conduct periodic audits to discover shadow IT and penalize non-compliant units.

Answer

Deploy a cloud access security broker (CASB) to discover and integrate shadow IT into the infrastructure.

Answer

Enforce a strict policy that prohibits any IT system without prior security approval.

Question 8

During a merger, the acquiring company's board insists on integrating the target company's information security governance into its own within 90 days. However, the target has a significantly different risk culture and lacks documented policies. What is the most critical governance risk in this scenario?

Accepted Answer

The acquiring company may inadvertently accept unknown high-risk exposures.. Option B is correct because the speed of integration may force acceptance of unknown risks without proper due diligence. Option A is wrong because culture clash is important but the immediate risk is accepting unknown risks. Option C is wrong because policy development can follow due diligence. Option D is wrong because training is a later step.

Answer

The acquiring company's security team may lack the capacity to train the target's staff.

Answer

The target's employees may resist the new security culture.

Answer

There will be insufficient time to develop new security policies for the combined entity.

Question 9

Which TWO of the following are primary responsibilities of the board of directors in information security governance?

Accepted Answer

Approving the organization's information security risk appetite.. Options A and D are correct. The board is responsible for approving the risk appetite (A) and ensuring executive management's performance on security (D). Option B is wrong because implementing controls is management's role. Option C is wrong because technical security architecture is not a board function. Option E is wrong because the board oversees but does not conduct audits.

Answer

Implementing security controls to mitigate identified risks.

Answer

Designing the technical security architecture for the organization.

Answer

Conducting internal security audits of the information systems.

Question 10

Which TWO of the following are key indicators that an organization's information security governance is effective?

Accepted Answer

High percentage of risk treatment plans implemented on time.. Options B and D are correct. A high percentage of risk treatment plan implementation (B) shows governance execution, and board-level security dashboards (D) indicate oversight. Option A is wrong because the number of policies is not a measure of effectiveness. Option C is wrong because low budget variance does not equal good governance. Option E is wrong because awareness training completion is operational.

Answer

Low variance between the approved security budget and actual spending.

Answer

The number of security policies that have been published.

Answer

High completion rate for security awareness training.

Question 11

Which THREE of the following are essential components of a mature information security governance framework?

Accepted Answer

A formally defined and approved risk appetite statement.. Options A, B, and D are correct. A strategic alignment (A) ensures security supports business goals, a defined risk appetite (B) sets boundaries, and performance measurement (D) enables oversight. Option C is wrong because security operations center is an operational function, not a governance component. Option E is wrong because regulatory compliance is an outcome, not a governance framework component itself.

Answer

Full compliance with all relevant regulatory requirements.

Answer

A dedicated security operations center (SOC) with 24/7 monitoring.

Question 12

Refer to the exhibit. A security manager notices that several contractors have been granted access to a financial system without documented exceptions. Based on the policy, what is the most likely governance deficiency?

Accepted Answer

Lack of documentation for approved exceptions.. Option A is correct because the policy requires exceptions to be documented, but they are not. Option B is wrong because the owners approved, but documentation is missing. Option C is wrong because the policy does not require quarterly reviews. Option D is wrong because revocation is a control, but the deficiency is lack of documentation.

Answer

The policy does not specify quarterly review of access rights.

Answer

The data owner did not approve the exceptions.

Answer

Contractors should not have any access to financial systems.

Question 13

Refer to the exhibit. An information security manager reviews the risk register and sees that Risk ID R001 has a residual risk of High with a treatment of Accept. Which of the following best explains why this situation may indicate a governance failure?

Accepted Answer

Accepting a high residual risk likely exceeds the board-approved risk appetite.. Option D is correct because accepting a high residual risk without board approval likely violates risk appetite policy. Option A is wrong because the CISO can be risk owner. Option B is wrong because controls are partially effective, but that's not the governance failure. Option C is wrong because the risk register is not invalid; the issue is the treatment decision.

Answer

The risk register should not contain risks with residual risk above low.

Answer

The control effectiveness rating of 'Partially effective' is too vague.

Answer

The risk owner should be a business unit head, not the CISO.

Question 14

Refer to the exhibit. The audit finding reveals a deficiency in which critical aspect of information security governance?

Accepted Answer

Strategic alignment between security objectives and business goals is missing.. Option C is correct because the lack of measurable objectives linked to business outcomes indicates a failure in strategic alignment. Option A is wrong because while risk management is related, the finding specifically addresses strategy. Option B is wrong because the board may have approved the current strategy, but it is deficient. Option D is wrong because resource allocation is not the direct issue.

Answer

The board has not approved the security strategy.

Answer

Resource allocation for security initiatives is not based on business impact.

Answer

Risk management processes are not integrated with business planning.

Question 15

An organization is developing its information security strategy. Which of the following should be the PRIMARY driver for defining security objectives?

Accepted Answer

Business objectives. Business objectives are the primary driver because security exists to enable business goals. Option A is wrong because industry benchmarks are reference points, not primary drivers. Option B is wrong because regulatory requirements are constraints, not drivers. Option D is wrong because historical incidents inform but don't drive strategy.

Answer

Industry best practices

Answer

Historical security incidents

Answer

Regulatory compliance requirements