CISM Information Security Program Practice Question
A company has a small security team and limited budget. Which initial investment provides the MOST value for building an effective security program?
⚠ Common exam trap
The trap here is that candidates often overvalue technical controls like penetration tests or automated enforcement, assuming they provide immediate risk reduction, while underestimating the foundational role of human-centric controls in a budget-constrained environment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conduct security awareness training for all employees
Security awareness training is the most cost-effective initial investment because human error remains the leading cause of security incidents, especially in resource-constrained environments. By educating employees on phishing, social engineering, and safe data handling, the organization reduces the attack surface without requiring expensive tools or specialized staff. This foundational control directly addresses the most common threat vector—user behavior—which automated systems alone cannot fully mitigate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement an automated policy enforcement system
Why it's wrong here
Policy enforcement tools can be costly to implement and maintain.
- ✗
Deploy an asset inventory management tool
Why it's wrong here
Asset inventory is foundational but may require more budget and maintenance.
- ✓
Conduct security awareness training for all employees
Why this is correct
Awareness training is cost-effective and reduces phishing and other user-related risks.
- ✗
Perform a comprehensive penetration test
Why it's wrong here
Pen testing is valuable but provides only a snapshot and is relatively expensive.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.