CISM Information Security Governance Practice Test 6 — 15 Questions

Question 1

A company has recently adopted COBIT 2019 as its governance framework. The board is requesting a concise report on the effectiveness of the security program. Which reporting structure best aligns with COBIT's guidance?

Accepted Answer

Dashboard showing alignment of security goals with enterprise goals, using KRIs and KPIs. Option C is correct because COBIT emphasizes linking security goals to enterprise goals and using KRIs and KPIs. Option A lists incidents but does not show alignment. Option B is too technical. Option D is compliance-focused, not governance.

Answer

List of all security incidents and their impacts

Answer

Compliance status with all applicable regulations

Answer

Detailed technical vulnerabilities discovered during penetration tests

Question 2

During an internal audit, it was found that the security policy does not address the use of personal devices for work. Which governance action should be taken first?

Accepted Answer

Develop a mobile device management policy and conduct a risk assessment. Option D is correct because governance starts with policy development based on risk assessment. Option A is reactive and may disrupt operations. Option B puts technology before policy. Option C is a partial solution.

Answer

Train users on security awareness

Answer

Purchase MDM software

Answer

Immediately ban all personal devices

Question 3

An organization's security steering committee meets quarterly but lacks decision-making authority. Projects are delayed due to lack of prioritization. What is the most effective improvement?

Accepted Answer

Empower the committee with budget and resource allocation authority. Option A is correct because empowering the committee with authority over budget and resources directly addresses the root cause. Option B increases frequency but does not solve authority issue. Option C changes personnel but not authority. Option D outsources prioritization, which may not align with business needs.

Answer

Increase meeting frequency to weekly

Answer

Outsource project prioritization to external consultants

Answer

Replace committee members with senior executives

Question 4

A financial institution is integrating a newly acquired fintech startup. The startup has a very different security culture. What governance approach best ensures integration without stifling innovation?

Accepted Answer

Use a transitional risk-based approach, phasing in critical controls while allowing flexibility. Option D is correct because a transitional risk-based approach balances control with flexibility. Option A may stifle innovation and cause resistance. Option B loses central control. Option C creates silos.

Answer

Allow the startup to maintain its own security policies indefinitely

Answer

Force the startup to adopt all of the institution's policies immediately

Answer

Create a separate security team for the startup

Question 5

A small business cannot afford a dedicated security team. Which governance model is most appropriate?

Accepted Answer

Hire a virtual CISO and outsource security operations. Option A is correct because hiring a virtual CISO and outsourcing operations provides governance expertise without full-time cost. Option B is too heavy. Option C is negligent. Option D places governance burden on an IT manager who may lack authority.

Answer

Implement a full security program based on ISO 27001

Answer

Ignore security until a breach occurs

Answer

Delegate security to the IT manager with periodic board updates

Question 6

Which TWO of the following are essential components of an information security governance framework according to ISACA's COBIT?

Accepted Answer

Value delivery. Strategic alignment (C) and value delivery (E) are key governance principles in COBIT. Performance measurement (A) is also important but not a foundational component; firewall config (B) and incident response (D) are operational.

Answer

Performance measurement

Answer

Incident response playbook

Answer

Firewall configuration

Question 7

Which TWO of the following are key indicators that an organization's information security governance is inadequate?

Accepted Answer

Frequent changes to security policies without approval. Frequent policy changes without approval (B) and absence of a risk appetite statement (D) directly indicate governance failures. High incident count (A) and low budget (C) may be symptoms but not definitive; multiple antivirus (E) is operational.

Answer

Low budget for security awareness

Answer

High number of security incidents

Answer

Use of multiple antivirus solutions

Question 8

Which THREE elements are typically included in a security governance charter?

Accepted Answer

Budget authority. Roles and responsibilities (A), reporting structure (C), and budget authority (D) are governance charter components. Technical diagrams (B) and incident procedures (E) are operational.

Answer

Incident response procedures

Answer

Technical architecture diagrams

Question 9

Acme Corp, a global manufacturer, has a decentralized security governance model. Each business unit manages its own security, resulting in inconsistent policies and repeated audit findings. The new CISO proposes a federated model where a central team sets minimum standards and each unit can add local controls. However, the European unit's head insists on full autonomy due to GDPR strictness. The board is concerned about compliance costs. What should the CISO do first?

Accepted Answer

Conduct a risk assessment to identify where local controls are truly needed. Option C is correct because conducting a risk assessment will identify where local controls are truly necessary and justify the federated model. Option A ignores local concerns. Option B undermines the federation goal. Option D is a tactical fix, not strategic.

Answer

Implement the federated model immediately and require all units to comply

Answer

Allow the European unit to keep full autonomy while others follow the model

Answer

Hire a GDPR expert for the European unit

Question 10

TechStart, a cloud-based startup, has rapidly grown from 50 to 500 employees. It lacks a formal security governance structure. The CEO asks the CISO to develop one. The CISO finds that the company's culture values speed over compliance. The board expects a governance framework within three months. What is the most practical approach?

Accepted Answer

Start with a lean governance model, focusing on critical assets and compliance requirements. Option A is correct because starting with a lean governance model focusing on critical assets and compliance requirements is achievable and respects the culture. Option B is too heavy. Option C neglects governance. Option D postpones and risks non-compliance.

Answer

Implement a full COBIT framework immediately

Answer

Defer governance until after the next product launch

Answer

Focus solely on technical controls like firewalls and IAM

Question 11

A hospital chain has separate security teams for each facility. There is no central coordination, leading to duplicate efforts and inconsistent patient data protection. The system's CISO wants to improve governance with minimal disruption. What should he do?

Accepted Answer

Create a governance committee with representatives from each facility. Option B is correct because a governance committee with representatives fosters coordination without major reorganization. Option A is disruptive. Option C ignores local needs. Option D outsources responsibility.

Answer

Merge all teams into one central unit

Answer

Implement a top-down mandate for all policies

Answer

Outsource security to a third party

Question 12

BankOne has a mature security governance program but recently failed a regulatory audit because the board had not formally approved the risk appetite statement. The CISO argues that risk appetite is reviewed annually and was verbally approved. To prevent recurrence, what governance change is most effective?

Accepted Answer

Require board resolution for risk appetite annually. Option D is correct because requiring a formal board resolution annually ensures documented approval. Option A is passive. Option B automates but does not address approval. Option C reduces indicators, which may be counterproductive.

Answer

Automate risk appetite monitoring

Answer

Reduce the number of risk indicators

Answer

Document all board approvals in minutes

Question 13

A government agency is criticized for poor security governance after a data breach. An external review finds that security policies are not aligned with agency's mission. The director wants to implement a governance framework that ties security to strategic objectives. Which framework is most suitable?

Accepted Answer

COBIT 2019. Option C is correct because COBIT is designed for governance and alignment with enterprise goals. Option A is a management system. Option B is operational. Option D is industry-specific.

Answer

NIST Cybersecurity Framework

Answer

PCI DSS

Answer

ISO 27001

Question 14

A retail company's security governance includes a policy that all software must be approved by a security committee. This delays critical business applications. The CIO complains. How should the CISO adjust governance?

Accepted Answer

Implement a risk-based approval process with expedited paths. Option B is correct because a risk-based approval process with expedited paths balances security and agility. Option A removes control. Option C automates but may not address the root. Option D increases frequency but not efficiency.

Answer

Increase committee meeting frequency

Answer

Remove the approval requirement

Answer

Automate software approval

Question 15

Which TWO of the following are typically considered key components of an information security governance framework?

Accepted Answer

Adoption of a formal risk management process. Correct: B and D. A performance measurement system (B) ensures governance effectiveness, and a risk management process (D) is core to governance. Option A (specific technical controls) is too narrow; C (detailed incident response plan) is operational; E (penetration testing schedule) is a tactic, not a governance component.

Answer

Scheduling of regular penetration tests

Answer

Development of a detailed incident response plan

Answer

Implementation of specific technical controls