CISM Information Security Programme Practice Question
A security manager is designing a security budget for a mid-sized company. Which TWO of the following are typical components of a security budget?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Technology costs for security tools and infrastructure.
Option A is correct because a security budget must include technology costs for security tools and infrastructure such as firewalls, IDS/IPS, SIEM, endpoint protection, and related hardware/software licensing and maintenance. Option E is correct because personnel costs for security staff salaries and benefits are a core, recurring component of any security budget, covering roles like security analysts, engineers, and managers. Legal fees for contract reviews (B) are typically part of general legal or procurement budgets, not the security budget, unless tied to a specific security incident or compliance matter. A marketing budget for security awareness campaigns (C) is usually categorized under marketing or HR/training, though awareness is security-related, it is not a standard security budget line. Office renovation for a security operations center (D) is a capital facilities expense, not a typical recurring security budget component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Technology costs for security tools and infrastructure.
Why this is correct
Security tools and infrastructure are capital and operating outlays that directly enable detective, preventive and corrective capabilities. Without them, no control can be operated, making technology spend a core, recurring line item alongside staffing and services in any mid-sized security budget.
- ✗
Legal fees for contract reviews.
Why it's wrong here
Legal fees for contract reviews sit under general legal or procurement spend, not the security budget, which covers controls, staffing and compliance tooling. It is tempting because security does review vendor contracts for data protection clauses, yet that cost is normally borne by legal or the business owner, not the security function.
- ✗
Marketing budget for security awareness campaigns.
Why it's wrong here
Marketing spend promotes campaigns but is not a security control component; budgets cover staffing, tools, licensing, training and compliance. It is tempting because awareness campaigns are genuine security activities, and would be correct if the question asked about awareness programme funding rather than budget components.
- ✗
Office renovation for security operations center.
Why it's wrong here
Renovating a security operations centre is a capital facilities project, not a recurring security budget component such as staffing, licensing or training. It is tempting because physical SOC space genuinely matters when standing up a new monitoring capability, but that belongs in a capital expenditure request, not the operational security budget.
- ✓
Personnel costs for security staff salaries and benefits.
Why this is correct
Salaries and benefits for analysts, engineers and managers typically consume the largest share of a security budget. People operate every control, so personnel cost is a fundamental, recurring component rather than an optional extra, and must be forecast alongside technology and training spend.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.