CISM Information Security Governance Practice Test 4 — 15 Questions

Question 1

A large enterprise is implementing a new governance framework. The board has approved a risk appetite statement. What is the MOST important next step for the information security manager?

Accepted Answer

Define risk acceptance criteria and thresholds. Option B is correct because risk appetite must be translated into actionable criteria and thresholds for decision-making. Option A is wrong because controls implementation follows criteria. Option C is wrong because awareness is important but not the most immediate. Option D is wrong because audit approach is separate.

Answer

Implement technical controls to reduce risks

Answer

Develop an audit plan to monitor risk levels

Answer

Conduct security awareness training for employees

Question 2

A global company is establishing an information security governance committee. Which membership composition BEST ensures alignment between security and business strategy?

Accepted Answer

Senior leaders from each business unit, the CISO, and the Chief Risk Officer. Option D is correct because cross-functional representation from business units ensures diverse perspectives and stakeholder buy-in. Option A is wrong due to lack of business input. Option B is wrong as finance and legal alone are insufficient. Option C is wrong as IT operations lacks governance authority.

Answer

IT operations managers and the CISO

Answer

Chief Information Security Officer (CISO) and IT directors only

Answer

Chief Financial Officer (CFO), General Counsel, and CISO

Question 3

An information security manager is asked to report on the effectiveness of the security program. Which metric would BEST indicate governance effectiveness?

Accepted Answer

Percentage of security initiatives directly linked to business strategy. Option A is correct because governance effectiveness is best measured by the percentage of security projects aligned with business strategy. Option B is wrong as mean time to respond is operational. Option C is wrong as vulnerability count is technical. Option D is wrong as audit findings are compliance focused.

Answer

Number of critical vulnerabilities identified

Answer

Number of audit findings per quarter

Answer

Mean time to detect and respond to incidents

Question 4

After a merger, two companies with different security cultures are being integrated. What is the BEST approach for the information security manager to achieve a unified governance structure?

Accepted Answer

Develop a new framework incorporating strengths from both companies. Option B is correct because developing a new framework that incorporates best practices from both is most effective. Option A is wrong because adopting one company's framework may cause resistance. Option C is wrong because separate frameworks hinder integration. Option D is wrong as waiting leads to confusion.

Answer

Implement a regulatory framework as the baseline

Answer

Maintain separate frameworks until a natural convergence occurs

Answer

Adopt the security framework of the acquiring company

Question 5

A financial institution is designing its information security governance to comply with multiple regulations. The board has limited risk appetite. Which approach BEST ensures effective governance while minimizing conflict?

Accepted Answer

Implement a harmonized control framework that maps to all regulations. Option D is correct because a harmonized control framework that maps to all regulations reduces duplication and conflict. Option A is wrong because siloed compliance creates inefficiency. Option B is wrong as it may miss regulatory requirements. Option C is wrong as committees without alignment cause confusion.

Answer

Assign different compliance teams for each regulation

Answer

Adopt a single regulatory framework and ignore others

Answer

Create separate governance committees for each regulation

Question 6

An information security manager is developing a security scorecard for the board. Which of the following should be included to BEST demonstrate governance performance?

Accepted Answer

Number of risk acceptances approved vs. rejected. Option B is correct because risk acceptance tracking shows how the board's risk appetite is applied. Option A is wrong because patch rate is operational. Option C is wrong as incident count is reactive. Option D is wrong as training completion is awareness, not governance.

Answer

Total number of security incidents this quarter

Answer

Percentage of systems patched within 30 days

Answer

Employee security training completion rate

Question 7

A company is restructuring its security governance due to rapid growth. The CISO reports to the CIO. What is the PRIMARY risk of this reporting structure?

Accepted Answer

Security objectives may be overridden by IT operational goals. Option B is correct because security performance may be subordinated to IT operational priorities. Option A is wrong as budget control may exist but is secondary. Option C is wrong as compliance is not directly affected. Option D is wrong because cooperation can still exist.

Answer

Compliance with regulations may become difficult

Answer

The security budget may be insufficient

Answer

Cooperation between IT and security may decrease

Question 8

An organization's governance framework requires regular reporting to the board. Which reporting frequency and format is MOST effective for a board with limited security expertise?

Accepted Answer

Quarterly report summarizing key risk indicators and business impact. Option C is correct because quarterly reports with business impact language and risk trends are tailored for board understanding. Option A is wrong because weekly is too frequent and technical. Option B is wrong because annual is too infrequent. Option D is wrong because technical depth is inappropriate.

Answer

Monthly dashboard of technical control effectiveness metrics

Answer

Annual presentation of the overall security risk register

Answer

Weekly technical briefings on incidents and vulnerabilities

Question 9

Which TWO of the following are essential components of an effective information security governance framework? (Select exactly two.)

Accepted Answer

Process for aligning security strategy with business strategy. Options A and C are correct. A governance framework must include defined roles and responsibilities (A) and a process to align security with business objectives (C). B is operational, not governance. D is tactical. E is a control, not governance component.

Answer

Implementation of a SIEM system

Answer

Automated patch management system

Answer

Intrusion prevention system (IPS)

Question 10

Which THREE of the following are key indicators of a mature information security governance process? (Select exactly three.)

Accepted Answer

Security risk appetite is defined and reported to the board. Options A, C, and E are correct. A mature governance process includes business-aligned metrics (A), board-level risk reporting (C), and regular strategy review (E). B is operational metrics. D is a reactive metric.

Answer

Mean time to patch critical vulnerabilities is under 48 hours

Answer

Number of security incidents decreased by 20% year-over-year

Question 11

Which TWO of the following are primary responsibilities of the board of directors with regard to information security governance? (Select exactly two.)

Accepted Answer

Ensuring security strategy aligns with business goals. Options B and D are correct. The board sets risk appetite (B) and ensures security is integrated with business strategy (D). A is management's role. C is management's role. E is operational.

Answer

Performing vulnerability scans

Answer

Implementing security controls

Answer

Conducting daily security monitoring

Question 12

Given the exhibit, what is the MOST appropriate action for the information security manager?

Accepted Answer

Implement the action plan to reduce KRI value. Option B is correct because the KRI is in the yellow zone (5-10%) and requires management attention and accelerated patching. Option A is wrong because escalation is for red status. Option C is wrong because immediate remediation is for critical issues. Option D is wrong because acceptance board approval is for risks that exceed appetite, but here it is within tolerance.

Answer

Request board approval to accept the risk level

Answer

Declare a security crisis and mobilize incident response

Answer

Escalate to the board for immediate decision

Question 13

Based on the exhibit, which role is missing from the governance policy that would be essential for enforcing accountability?

Accepted Answer

A role with authority to enforce compliance and impose consequences. Option D is correct because without defined consequences or enforcement responsibilities, accountability is weak. Option A is wrong because audit provides assurance, not enforcement. Option B is wrong because compliance officer may exist but isn't defined. Option C is wrong because external auditor is not internal governance.

Answer

External auditor

Answer

Internal audit function

Answer

Chief compliance officer

Question 14

Given the exhibit, what is the MOST significant governance gap in the described architecture?

Accepted Answer

No defined security governance board or oversight mechanism. Option B is correct because the architecture description does not indicate a defined ownership or governance layer for the security controls. Option A is wrong as controls exist. Option C is wrong as MFA is there. Option D is wrong as monitoring exists. The gap is governance oversight, not technical.

Answer

Weak authentication for remote access

Answer

Insufficient physical security in data centers

Answer

Lack of intrusion detection for internal traffic

Question 15

A CISO is developing an information security governance framework for a financial institution. Which of the following is the PRIMARY purpose of such a framework?

Accepted Answer

Align security with business objectives. The primary purpose of information security governance is to ensure that security strategies are aligned with business objectives, enabling the organization to meet its goals. Option A is about compliance, which is a component but not primary. Option B focuses on technology deployment, which is operational. Option D targets risk reduction, which is an outcome but not the core purpose of governance.

Answer

Minimize risks to an acceptable level

Answer

Ensure compliance with regulatory requirements

Answer

Deploy the latest security technologies