CISM Information Security Governance Practice Test 5 — 15 Questions

Question 1

A multinational corporation is designing an information security strategy to support its global operations. Which approach best ensures that the strategy is actionable and measurable?

Accepted Answer

Define KPIs and KRIs aligned with business goals. Defining key performance indicators (KPIs) and key risk indicators (KRIs) tied to business goals allows the organization to track progress and effectiveness. Option A relies solely on external best practices, which may not fit the specific context. Option B focuses on cost-benefit analysis, which is important but not sufficient for actionability. Option D addresses technology adoption without a measurement framework.

Answer

Conduct a cost-benefit analysis of security controls

Answer

Base the strategy on industry best practices

Answer

Adopt a leading-edge technology roadmap

Question 2

An organization's information security governance committee has not met for the past six months. Which of the following is the most significant risk associated with this situation?

Accepted Answer

Lack of oversight leading to misalignment with business strategy. Without regular governance committee meetings, there is no oversight of security activities, leading to potential misalignment with business objectives. Option A (increased costs) could occur but is not the primary risk. Option C (delayed incident response) is operational. Option D (regulatory fines) is a possible consequence but less immediate than loss of strategic alignment.

Answer

Increased operational costs due to uncoordinated security investments

Answer

Regulatory fines from noncompliance

Answer

Delayed response to security incidents

Question 3

An organization plans to implement ISO/IEC 27001 to formalize its information security management system. Which step is most critical to ensure successful implementation?

Accepted Answer

Obtain commitment from top management. ISO 27001 emphasizes top management commitment as a key success factor. Without it, resources, authority, and support may be lacking. Option B (risk assessment) is important but comes after commitment. Option C (policy development) and D (training) are subsequent steps.

Answer

Conduct a comprehensive risk assessment

Answer

Develop detailed information security policies

Answer

Train all employees on security awareness

Question 4

A multinational corporation must comply with both GDPR and CCPA. Which governance approach is most effective?

Accepted Answer

Develop a unified data protection framework with regional adjustments. A unified data protection framework with regional adjustments allows consistency while meeting specific requirements. Option A (separate programs) increases complexity and cost. Option B (rigid unified policy) may not satisfy all local laws. Option D (outsource) shifts responsibility but does not ensure governance effectiveness.

Answer

Create a single rigid unified policy applicable everywhere

Answer

Implement separate compliance programs for each regulation

Answer

Outsource compliance to a third-party service provider

Question 5

During an internal audit, it is discovered that business units frequently purchase cloud services without involving the IT security department. Which governance deficiency does this scenario most clearly demonstrate?

Accepted Answer

Absence of a procurement security policy. The lack of a procurement security policy that mandates involvement of IT security indicates a gap in governance controls. Option A (weak access controls) might be a consequence but not the root deficiency. Option B (inadequate training) is not primary. Option C (lack of incident response) is unrelated to procurement.

Answer

Inadequate security awareness training

Answer

Lack of an incident response plan

Answer

Weak access control over cloud resources

Question 6

Which of the following is the best indicator that an organization has effective information security governance?

Accepted Answer

Security metrics are reviewed by the board quarterly. Review of security metrics by the board demonstrates governance oversight and strategic alignment. Option A (low incident count) could be due to luck. Option C (high budget) does not guarantee effectiveness. Option D (certifications) indicates compliance, not necessarily governance performance.

Answer

Achievement of ISO 27001 certification

Answer

The security budget has increased year over year

Answer

Low number of security incidents

Question 7

A company's security steering committee includes representatives from Human Resources, Legal, and Risk Management, but not from Business Operations. What is the most likely consequence of this membership gap?

Accepted Answer

Security policies may not align with operational processes. Without operations, security policies may not align with day-to-day business processes, leading to inefficiencies or resistance. Option B (increased costs) could occur but is not the most direct consequence. Option C (data breaches) is less likely. Option D (regulatory non-compliance) is possible but secondary.

Answer

Data breaches will occur more frequently

Answer

Security spending will increase unexpectedly

Answer

The company will face regulatory fines

Question 8

After a merger, the combined organization has two different risk tolerance levels: one entity is risk-averse, the other is risk-taking. What is the best governance action?

Accepted Answer

Reassess risk appetite and approve a single unified statement. The board should reassess and approve a single, unified risk appetite statement to provide clear direction. Option A (keeping separate) leads to inconsistency. Option B (always using the more conservative) may stifle innovation. Option D (using the less restrictive) could expose the organization to excessive risk.

Answer

Adopt the less restrictive risk tolerance

Answer

Maintain separate risk tolerance levels for each legacy entity

Answer

Adopt the more conservative risk tolerance across the board

Question 9

Which TWO of the following are key elements of an information security governance framework, as defined by COBIT?

Accepted Answer

Value delivery. Strategic alignment and value delivery are two of the five key governance areas per COBIT. Compliance and resource management are also elements, but the question asks which TWO are specifically key. Incident response is operational, not a governance element.

Answer

Incident response

Answer

Resource management

Answer

Risk management

Question 10

Which THREE of the following are responsibilities of the board of directors regarding information security governance?

Accepted Answer

Approve the information security strategy. The board is responsible for approving the security strategy, setting risk appetite, and authorizing the budget. Conducting vulnerability scans is an operational task for technical staff. Responding to incidents is management's responsibility.

Answer

Respond to security incidents

Answer

Conduct vulnerability scans

Question 11

Which THREE of the following are challenges in implementing information security governance in a decentralized organization?

Accepted Answer

Redundant security controls and tools. Decentralized organizations often face inconsistent policy enforcement (A), redundant security controls (B), and diverse regulatory compliance (D). Centralized incident response (C) is typically not a challenge; it may be absent, but the challenge is lack of centralization. Unified risk reporting (E) is a goal, not a challenge.

Answer

Unified risk reporting

Answer

Centralized incident response

Question 12

Refer to the exhibit. A security administrator reports that the VPN tunnel to the remote peer (10.1.1.1) intermittently fails. Based on the configuration, which of the following is the most likely cause?

Accepted Answer

Improper NAT traversal configuration. The configuration is missing the 'set pfs' command and does not include NAT traversal settings. Intermittent failure often occurs when NAT is involved and no NAT traversal is configured. Option A (mismatched IKE parameters) would cause constant failure. Option B (incorrect ACL) would prevent specific traffic, not intermittent. Option C (expired certificate) is irrelevant as pre-shared key is used.

Answer

Mismatched IKE phase 1 parameters

Answer

Expired digital certificate

Answer

Incorrect access-list 101

Question 13

Refer to the exhibit. A company implements this data classification scheme. Which risk is most likely introduced by this scheme?

Accepted Answer

Under-classification of internal data, leading to exposure. The classification scheme lacks an 'Internal' label for data that is not public but not highly sensitive. Employees may misclassify internal data as Public or Confidential, leading to under- or over-classification. Specifically, internal data (e.g., internal memos) may be incorrectly labeled as Public (under-classification) because there is no appropriate label. Option A (over-classification) would happen if Confidential is used for internal data, but the greater risk is under-classification of internal data.

Answer

Over-classification of data, increasing administrative burden

Answer

Inability to audit data access

Answer

Inconsistent handling of confidential data

Question 14

Refer to the exhibit. This error log indicates a failure in which component of information security governance?

Accepted Answer

Access control. The error shows that a user lacks privileges to update a policy, indicating a breakdown in access control. Option A (segregation of duties) is about dividing tasks to prevent fraud, not about insufficient privileges. Option C (policy enforcement) is broader and refers to compliance with policies, not updating them. Option D (audit trail) is about logging, which is functioning as the error was logged.

Answer

Policy enforcement

Answer

Segregation of duties

Answer

Audit trail

Question 15

A multinational corporation is experiencing significant security incidents due to inconsistent security policies across subsidiaries. The CISO proposes implementing a centralized governance model. However, business unit leaders argue that local regulations require autonomy. Which approach best balances governance with local compliance?

Accepted Answer

Develop a framework of minimum security requirements, allowing local augmentation. Option B is correct because it allows a minimum set of requirements while enabling local augmentation to meet specific regulatory needs. Option A is too rigid and may conflict with local laws. Option C gives up central control entirely. Option D outsources governance, which may not address local nuances.

Answer

Implement a single global security policy with mandatory compliance

Answer

Delegate all security decisions to local business units

Answer

Outsource security governance to a third-party managed service