CISM Information Security Program Practice Question
A company's security program includes a policy that all employees must use strong passwords and change them every 90 days. However, the recent internal audit shows that 60% of employees have passwords that do not meet the strength requirements. What is the most effective corrective action?
⚠ Common exam trap
CISM often tests the difference between preventive, detective, and corrective controls, and candidates may choose training or audits over technical enforcement, not realizing that technical controls are preventive and most effective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement technical controls to enforce password strength
The most effective corrective action is to implement technical controls to enforce password strength. This ensures that all passwords meet the policy requirements by preventing users from setting weak passwords. Technical controls are more reliable than manual audits or training because they automatically enforce compliance and reduce the risk of human error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conduct quarterly password audits with manual checks
Why it's wrong here
Manual quarterly checks detect weak passwords after the fact and cannot scale to the whole workforce, leaving the 60% non-compliance unaddressed between audits. It tempts because auditing verifies policy adherence, and in a small environment with few accounts, periodic manual review of password strength is a workable detective control.
- ✗
Increase the frequency of security awareness training
Why it's wrong here
Training raises awareness but relies on voluntary behaviour, so it cannot enforce complexity on the 60% of accounts already failing the requirement. It tempts because the finding is behavioural, and where non-compliance stems from users not understanding the policy, awareness campaigns are the appropriate corrective measure.
- ✓
Implement technical controls to enforce password strength
Why this is correct
Technical enforcement removes reliance on user behaviour, which the audit proved unreliable at 60% non-compliance. Password complexity filters and expiry settings applied through directory policy or Microsoft Entra ID password protection automatically block weak credentials, directly correcting the gap rather than merely restating the requirement through training or revised policy.
- ✗
Extend the password change interval to 180 days
Why it's wrong here
Lengthening the interval leaves non-compliant passwords in place longer and does nothing to enforce complexity, so the 60% gap persists. It tempts because frequent forced changes drive weak, predictable passwords, and where audit findings show users defeating complexity through incremental variation, reducing change frequency is a legitimate compensating control.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.