CISM Information Security Programme Practice Question
A mature security program allocates 12% of IT budget to security. Which combination of budget components is most balanced for a program seeking to improve detection and response capabilities?
⚠ Common exam trap
CISM often tests the misconception that technology alone can solve detection and response challenges, leading candidates to choose options with higher technology allocation, when in fact personnel and process are equally critical.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Personnel 40%, Technology 30%, Services 20%, Training 10%
A balanced security budget for improving detection and response typically allocates the largest portion to personnel (40%), since skilled analysts are critical for threat hunting, incident response, and security operations. Technology (30%) supports tools like SIEM, EDR, and SOAR, while services (20%) provide specialized expertise, and training (10%) ensures staff remain proficient. This distribution avoids over-reliance on technology or personnel alone, aligning with CISM's emphasis on balanced program management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Personnel 40%, Technology 30%, Services 20%, Training 10%
Why this is correct
Allocating 40% to personnel, 30% to technology, 20% to services and 10% to training balances skilled analyst capacity with tooling and external expertise. This satisfies the detection-and-response constraint, since detection depends primarily on staffing and monitoring services rather than technology alone.
- ✗
Personnel 20%, Technology 50%, Services 20%, Training 10%
Why it's wrong here
Technology at 50% over-weights tooling while personnel and services stay thin, so detection engineering and response staffing remain underfunded. It is tempting because buying sensors feels like progress, and would be correct for a program whose gap is purely tooling coverage rather than analyst capacity.
- ✗
Personnel 50%, Technology 20%, Services 20%, Training 10%
Why it's wrong here
Personnel at 50% starves technology and services, leaving detection tooling and response support underfunded despite ample staff. It is tempting because skilled analysts matter most, and would be correct for a program whose shortfall is recruitment and retention rather than platform capability.
- ✗
Personnel 30%, Technology 30%, Services 30%, Training 10%
Why it's wrong here
Splitting personnel, technology and services evenly spreads investment without prioritising the analyst capacity and service expertise that detection and response depend on. It is tempting as an apparently fair allocation, and would be correct for a program with no identified capability gap needing targeted funding.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 924-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.