500 questions total · 7pages · All types, answers revealed
Page 7 of 7
Which TWO of the following are risk treatment strategies as defined in ISO 27005?
Avoidance is a risk treatment strategy.
Why this answer
Risk avoidance and risk transfer are standard treatment strategies. Risk analysis, risk communication, and risk monitoring are not treatment strategies but are part of the risk management process.
Which TWO of the following are recommended practices when conducting a post-incident review? (Select TWO)
Lessons learned improve future response.
Why this answer
Correct: Identifying root cause (B) and documenting lessons learned (C) are key. Assigning blame (A) is discouraged. Updating the IRP (D) is a result, but not the review itself.
Reimaging systems (E) is recovery, not review.
An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)
Why this answer
Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.
Exam trap
ISACA often tests the distinction between governance (strategy, culture, compliance) and management (architecture, tools, implementation), leading candidates to mistakenly select technology architecture as a governance factor.
Why the other options are wrong
Technology architecture is an operational concern, not governance.
A security analyst notices unusual outbound traffic from a server that is not scheduled for any data transfers. Which step should the analyst take FIRST?
Proper escalation ensures formal handling.
Why this answer
Option B is correct because starting documentation and escalation is the proper first step per incident response procedures. Option A is wrong because isolating without analysis may disrupt services. Option C is wrong because ignoring is dangerous.
Option D is wrong because blocking without understanding may hide the issue.
Which TWO of the following are key indicators that an organization's information security governance is effective?
This shows that governance decisions are being executed.
Why this answer
Options B and D are correct. A high percentage of risk treatment plan implementation (B) shows governance execution, and board-level security dashboards (D) indicate oversight. Option A is wrong because the number of policies is not a measure of effectiveness.
Option C is wrong because low budget variance does not equal good governance. Option E is wrong because awareness training completion is operational.
Which TWO of the following are valid risk treatment options according to ISO 31000? (Choose two.)
Avoiding the risk by not undertaking the activity.
Why this answer
Options B and C are correct: risk avoidance and risk retention (acceptance) are treatment options. Option A is incorrect because risk measurement is not treatment. Option D is incorrect because risk identification is part of assessment.
Option E is incorrect because risk communication is ongoing.
A company is designing its information security program and wants to ensure that it meets regulatory requirements across multiple jurisdictions. Which of the following approaches is most appropriate?
Maps controls to regulations, ensuring comprehensive and consistent compliance.
Why this answer
Correct answer is D because a regulatory compliance framework provides a structured, comprehensive approach. Option A (ISO 27001) is a standard but not specifically tailored to multi-jurisdictional regulations. Option B (minimal compliance to save costs) is risky.
Option C (legal review only) lacks sustained program management.
An organization's information security program is based on a risk management framework. Which of the following BEST describes the role of the information security manager in this context?
Why this answer
The information security manager is responsible for designing and managing the security program based on the risk management framework. This includes translating risk assessment results into security controls, policies, and procedures, and ensuring the program aligns with the organization's risk posture. The manager does not set risk appetite (that is a board-level decision) nor own all risks (risk owners are business process owners).
Exam trap
The trap here is confusing the information security manager's operational role with strategic or assurance roles, leading candidates to select 'setting risk appetite' or 'conducting internal audits' instead of the correct program management function.
Why the other options are wrong
Risk appetite is set by the board of directors, not the security manager.
Risk ownership resides with business process owners; the security manager facilitates risk management.
Internal audits are performed by audit function, not security management.
Which THREE elements should be included in an incident response plan to ensure effective communication during a security incident?
Escalation ensures timely involvement of decision-makers.
Why this answer
Option A is correct because escalation procedures define the specific thresholds and contact paths for notifying management and legal teams when an incident exceeds predefined severity levels. This ensures that decision-makers are informed promptly to authorize critical actions like legal holds or regulatory notifications, preventing delays that could worsen the incident's impact.
Exam trap
The trap here is that candidates confuse operational data (like affected systems) with communication plan elements, or they mistakenly think a full public relations strategy must be embedded in the IR plan rather than referenced as a separate document.
Which THREE are essential steps in incident containment? (Choose three.)
Disabling accounts stops attacker access through valid credentials.
Why this answer
Isolating affected systems, disabling compromised accounts, and preserving forensic evidence are critical containment steps. Root cause analysis is part of investigation, and notifying regulators is a post-containment step.
A small business without a dedicated incident response team experiences a suspected breach. Who should be primarily responsible for leading the incident response efforts?
Correct: Brings specialized skills and experience.
Why this answer
Option B is correct because external cybersecurity consultants have the expertise needed. The IT administrator may lack training, the CEO is management, and legal counsel provides advice, not leadership.
Match each information security program component to its primary focus area. Component: 1. Risk Assessment, 2. Security Awareness Training, 3. Incident Response Plan, 4. Policy Framework Focus Areas: A. Human factors and behavior B. Structured response to events C. Identification and analysis of threats D. Governance and compliance requirements Drag each component to its matching focus area.
Why this answer
Risk Assessment focuses on identifying and analyzing threats. Security Awareness Training addresses human factors. Incident Response Plan provides structured response.
Policy Framework establishes governance and compliance.
Exam trap
Candidates often confuse Incident Response Plan with Risk Assessment, but incident response is about reaction, not identification.
Why the other options are wrong
This is correct matching; but in JSON we mark all false and use pbq_config.
A company's information security manager is tasked with ensuring that security initiatives align with business goals. Which of the following best demonstrates this alignment?
This directly ties security outcomes to business success, demonstrating alignment.
Why this answer
Option D is correct because linking security metrics to business KPIs directly shows how security supports business objectives. Option A is wrong because compliance alone does not guarantee alignment with business goals. Option B is wrong because focusing only on technical risks ignores business context.
Option C is wrong because budget allocation should be based on risk and business value, not just equal distribution.
A risk manager is establishing risk appetite for a new product line. Which of the following best describes the relationship between risk appetite and risk tolerance?
This correctly distinguishes between appetite and tolerance.
Why this answer
Risk appetite is the general approach to risk at the enterprise level, while risk tolerance defines the acceptable variation in performance around objectives. Specific limits are part of tolerance, not appetite. Regulatory bodies may set constraints but do not define appetite.
Which THREE of the following are key components of an incident response plan? (Select THREE)
Clear communication paths are critical during an incident.
Why this answer
Correct: Response procedures (A), communication escalation (B), and roles and responsibilities (C) are essential. A budget (D) is not typically part of the plan itself. A list of all employees (E) is too detailed and not a core component.
A global financial services firm with 15,000 employees has recently experienced a significant data breach due to inadequate oversight of third-party vendors. The breach originated from a cloud service provider that had been granted elevated access without a formal risk assessment or contract review. The board has directed the CISO to overhaul the information security governance framework to prevent recurrence. Currently, the organization has a decentralized security model where each business unit manages its own vendor relationships. The CISO proposes a centralized governance body. Which of the following is the BEST course of action to establish effective governance over third-party risk?
Centralized program ensures consistent governance and oversight of all vendor relationships.
Why this answer
Option C is correct because it directly addresses the root cause: lack of oversight. A formal third-party risk management (TPRM) program with centralized policies and vendor assessments provides consistent governance. Option A (contract clauses) is reactive and not comprehensive; Option B (training) addresses awareness but not process; Option D (penetration testing) is a technical control, not governance.
A manufacturing company has an incident response plan that includes a communication plan. However, during a recent ransomware incident, the team realized that the external legal counsel was not listed in the plan. The incident requires consultation with legal due to potential regulatory implications. The incident response manager needs to address this gap quickly. What should the manager do?
Updating the plan to include all necessary stakeholders is essential for effective communication.
Why this answer
The manager should add legal counsel to the communication plan immediately to ensure they are included in future incidents. Ignoring them or delaying notification could worsen regulatory consequences. Using internal legal might not be sufficient for external counsel needs.
After detecting a ransomware infection on a file server, the incident response team performs containment and eradication. Which step should be prioritized during the recovery phase to minimize business impact?
Restoring from backups is the primary recovery method.
Why this answer
Restoring data from clean backups is the most direct way to recover operations without paying ransom. Identifying the vulnerability (B) is part of eradication, not recovery. Negotiating with attackers (A) is discouraged.
Reimaging all servers (D) may be excessive and cause more downtime.
A security manager is evaluating risk treatment options for a high-risk vulnerability. Drag each option to the correct risk treatment category. Options: - Apply a vendor patch - Purchase cyber insurance - Decommission the system - Accept the risk with formal sign-off - Install a WAF (Web Application Firewall) Categories: - Mitigate - Transfer - Avoid - Accept
Answer options not yet available.
Why this answer
Risk mitigation reduces the likelihood or impact: applying a patch and installing a WAF are mitigation. Transfer shifts risk to a third party: cyber insurance. Avoid eliminates the risk by removing the system: decommissioning.
Acceptance is formal acknowledgment: accept with sign-off.
Exam trap
Candidates may misclassify insurance as mitigation because it reduces financial impact, but it is transfer. Also, decommissioning is clearly avoidance, not mitigation.
A multinational organization needs to comply with GDPR and CCPA. What is the best approach for the information security program?
A unified framework ensures compliance while maintaining efficiency.
Why this answer
Implementing a unified privacy framework that covers all regulations ensures consistency and reduces complexity. Option C is correct. Option A may cause over-compliance and inefficiency.
Option B duplicates effort. Option D increases risk.
An organization's IDS logs show multiple outbound connections to an external IP address from a server that normally communicates only internally. The logs indicate the process is running under the SYSTEM account. Which of the following BEST describes the likely root cause?
Outbound connections from SYSTEM account are a classic indicator of a backdoor or remote access Trojan (RAT) placed after initial compromise.
Why this answer
Persistent outbound connections from the SYSTEM account suggest a backdoor installed by a prior compromise that allows remote command execution. Option C is correct.
Which of the following best describes the difference between risk appetite and risk tolerance?
This is the standard definition.
Why this answer
Option A is correct because risk appetite is the broad willingness to accept risk, while risk tolerance is the acceptable deviation around specific objectives. Option B is wrong because it reverses the definitions. Option C is wrong because both are quantitative or qualitative.
Option D is wrong because tolerance is not a subset but a measurable boundary.
A technology startup has grown rapidly and its risk management practices are informal. The CEO has a very high risk appetite and frequently overrides risk management recommendations to accelerate product launches. After a serious data breach involving customer payment information, the board of directors demands a formal risk management program. The risk manager is tasked with changing the risk culture. The startup has limited resources but must meet contractual obligations to protect customer data. What is the most effective first step?
Correct; this aligns the organization's risk tolerance and guides behavior.
Why this answer
Option D is correct because developing and communicating a revised risk appetite statement aligned with the board's risk tolerance sets the foundation for a risk-aware culture. It provides clear guidance for decision-making. Option A is insufficient without a cultural shift; technical controls may be undermined.
Option B is drastic and not directly a risk management action. Option C transfers responsibility but does not change internal culture or ensure compliance.
An organization has decided to adopt a risk-based approach to information security. What is the FIRST step the information security manager should take to implement this approach?
Risk identification and assessment form the foundation.
Why this answer
The first step in implementing a risk-based approach is to identify and assess information assets along with their associated threats and vulnerabilities. This foundational activity provides the necessary context for all subsequent risk management decisions, including defining risk appetite, selecting a framework, and implementing controls. Without a clear understanding of what assets exist and what risks they face, any further steps would be based on assumptions rather than evidence.
Exam trap
The trap here is that candidates often confuse the sequence of risk management activities, mistakenly believing that defining risk appetite or selecting a framework should come first, when in fact asset identification and risk assessment are the prerequisite steps that inform all other decisions.
How to eliminate wrong answers
Option B is wrong because defining risk appetite and risk tolerance levels requires prior knowledge of the assets and risks; without asset identification, risk appetite cannot be meaningfully set. Option C is wrong because implementing controls based on industry best practices without first understanding the specific risks can lead to misallocated resources and ineffective security, violating the core principle of a risk-based approach. Option D is wrong because selecting a risk management framework (e.g., ISO 31000 or NIST RMF) is a tactical decision that should follow the initial identification and assessment of assets and risks to ensure the framework is applied to the correct scope.
An organization's incident response team has completed the initial response to a ransomware incident. During the post-incident review, they identify that the detection was delayed because security logs from different systems were not correlated. The team wants to improve detection capabilities. What should the team recommend as the primary improvement?
SIEM correlates logs from multiple sources to detect incidents in a timely manner.
Why this answer
Implementing a SIEM solution provides centralized log collection and correlation, enabling timely detection. Increasing logging without correlation still results in data silos. Hiring more analysts may help but does not address the root cause of poor correlation.
Reducing log retention would hinder forensic analysis.
Which of the following best describes the primary purpose of an information security program?
Program ensures security supports business objectives.
Why this answer
Option C is correct because the program's goal is to align security with business objectives and manage risk to an acceptable level. Option A is wrong as availability is one aspect of CIA triad, not the primary purpose. Option B is wrong as security is an enabler, not an absolute obstacle.
Option D is wrong as legal compliance is a component, not the overarching goal.
An organization's governance framework requires regular reporting to the board. Which reporting frequency and format is MOST effective for a board with limited security expertise?
Balanced frequency and business context.
Why this answer
Option C is correct because quarterly reports with business impact language and risk trends are tailored for board understanding. Option A is wrong because weekly is too frequent and technical. Option B is wrong because annual is too infrequent.
Option D is wrong because technical depth is inappropriate.
A multinational corporation is expanding its cloud infrastructure across multiple regions. The risk team has identified that the shared responsibility model for cloud security is not well understood by business units. After a recent audit, several misconfigurations led to a data exposure incident that affected one region. The CISO wants to implement a risk management program that ensures consistent control across all regions. As the risk manager, what is the most effective course of action to reduce the risk of similar incidents?
Standards and audits address the root cause by ensuring consistent understanding and adherence.
Why this answer
Developing and enforcing cloud security baseline standards and conducting regular compliance audits directly address the root cause of misconfigurations due to lack of understanding. A CASB provides monitoring but does not enforce standards. Transferring risk to cloud providers shifts liability but does not prevent misconfigurations.
Acceptance with focus on incident response is reactive and does not reduce likelihood.
During a risk assessment, an organization identifies a critical vulnerability in a legacy system that cannot be patched. The system's availability is crucial for business operations. Which of the following risk treatment strategies is MOST appropriate?
Why this answer
When a critical vulnerability cannot be patched and the system must remain available for business operations, risk acceptance is the most appropriate strategy because it formally acknowledges the residual risk after all feasible controls have been considered. Senior management sign-off is required because the risk exceeds the organization's risk appetite, and acceptance documents the decision to operate with the known vulnerability. This approach aligns with the CISM principle that risk acceptance is a valid treatment when the cost of other treatments exceeds the benefit or when no other treatment is feasible.
Exam trap
The trap here is that candidates often choose risk mitigation (compensating controls) because it seems proactive, but the question explicitly states the vulnerability 'cannot be patched' and the system is 'crucial for business operations,' making formal acceptance by senior management the required CISM answer when residual risk remains after all feasible controls.
Why the other options are wrong
Compensating controls are a form of mitigation, but the question says the system cannot be patched; however, compensating controls can still reduce risk. The key is that the vulnerability cannot be fixed, so mitigation may not be fully effective. The best answer is acceptance if no controls are cost-effective.
Insurance transfers financial risk but not operational risk; the vulnerability remains.
Decommissioning would avoid risk but is not acceptable because the system is critical.
A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?
Flexible and adaptable, with tiers for maturity.
Why this answer
Option C is correct because NIST CSF is scalable, risk-based, and suitable for organizations of all sizes. Option A is wrong as ISO 27001 is comprehensive but resource-intensive. Option B is wrong as COBIT is focused on IT governance, not specifically security.
Option D is wrong as PCI DSS applies only to credit card data.
An organization experiences a data breach involving personal information. Which TWO actions should be taken as part of incident response? (Choose two.)
Option B is correct as it is required by regulations.
Why this answer
Options B and D are correct. B is required by regulations; D is best practice. Option A is wrong; Option C is wrong because logs are needed for investigation; Option E is wrong because press release should be coordinated.
During an incident investigation, the team discovers that an attacker used a valid user's credentials to access a sensitive database. The user's account had multi-factor authentication (MFA) enabled. How is this MOST likely possible?
Attackers can bombard users with MFA requests until they approve one.
Why this answer
MFA fatigue attacks involve repeatedly sending push notifications until the user approves one. Option A is less likely; Option C would not bypass MFA; Option D is not direct.
A risk manager is evaluating a control that reduces the likelihood of a threat from high to low. The cost of the control is $100,000 annually. The expected loss without the control is $500,000 per year. Which of the following should the risk manager recommend?
Net benefit: $400,000 loss reduction minus $100,000 cost = $300,000 savings.
Why this answer
Option B is correct because the control reduces loss to $100,000, saving $400,000, but costs $100,000, net benefit $300,000. Option A is wrong because controlling may be cost-effective. Option C is wrong because transfer might be more expensive.
Option D is wrong because avoidance may not be necessary.
A financial institution's security program must comply with PCI DSS, GDPR, and SOX. Which approach is MOST efficient to manage overlapping compliance requirements?
A unified control framework eliminates redundancy and streamlines compliance.
Why this answer
Option A is correct because implementing a single set of controls mapped to multiple regulations reduces duplication and simplifies management. Option B is wrong focusing only on the strictest may miss unique requirements. Option C is wrong separate sets are inefficient.
Option D is wrong outsourcing does not address overlap.
A company experiences ransomware that encrypts critical servers. Backups are available but were taken 2 weeks ago. What is the best course?
Correct: Ensures a clean environment before restoration.
Why this answer
Restore from backups after verifying no residual malware and performing security scans to ensure clean restoration.
An organization has implemented a data classification policy but notices that employees often mark documents as 'internal use only' even when they contain personally identifiable information (PII). Which of the following is the most effective corrective action for the information security program?
Automates classification, reducing user error and ensuring consistent labeling.
Why this answer
Correct answer is C because automating classification based on content reduces reliance on user discretion. Option A (more training) may help but is not as effective as automation. Option B (auditing and reprimanding) is punitive and may not address root cause.
Option D (policy revision) alone does not enforce compliance.
Which TWO are common challenges in incident management?
Correct: Poor communication leads to delays and errors.
Why this answer
Lack of executive support and inadequate communication between teams are frequent obstacles.
An organization has a distributed incident response team across multiple time zones. During a critical incident, communication delays occur due to different work hours. Which strategy BEST improves coordination and response time?
Follow-the-sun ensures continuous coverage by handing off between regions.
Why this answer
Implementing a follow-the-sun model ensures that a team is always available during business hours, reducing delays. A single point of contact (A) creates a bottleneck. Overlapping schedules (B) helps but not as comprehensive as follow-the-sun.
Outsourcing (D) may introduce new issues.
During a review of the information security program, the security manager discovers that the program's objectives are not aligned with the organization's strategic business goals. What is the best course of action?
Why this answer
The CISM framework emphasizes that an information security program must be directly aligned with the organization's strategic business goals to ensure that security investments support business objectives rather than hinder them. Revising the program objectives to align with business goals (Option B) is the correct course of action because it ensures that security controls, risk appetite, and resource allocation are driven by business needs, not isolated technical requirements. This alignment is a core principle of the Information Security Program domain, as misalignment can lead to wasted resources, reduced executive support, and increased business risk.
Exam trap
ISACA often tests the misconception that adding more controls or escalating issues can substitute for strategic alignment, but the CISM exam specifically requires candidates to recognize that program objectives must be revised to match business goals before any other action is taken.
Why the other options are wrong
This does not address the misalignment; the objectives should be revised to match business goals.
Adding controls does not fix the strategic misalignment.
Escalation is not the first step; the manager should propose a solution.
Refer to the exhibit. An analyst sees this alert on the network. What is the most appropriate immediate action?
Correct: The internal system is likely compromised and needs examination.
Why this answer
The source IP is internal, so the analyst should investigate the internal system for compromise.
A multinational financial institution uses a third-party Managed Security Service Provider (MSSP) for 24/7 monitoring of its security infrastructure. During a targeted attack, the MSSP’s analysts detected anomalous activity on a critical server at 2:00 AM. However, due to the service level agreement (SLA) which allows up to 12 hours for notification of lower-priority incidents, the MSSP classified the incident as medium severity and did not notify the internal incident response team until 2:00 PM. By then, the attacker had exfiltrated sensitive customer data. The internal team is conducting a post-incident review. What is the PRIMARY issue that led to the delay?
The SLA allowed a 12-hour delay which was exploited by the attacker.
Why this answer
The SLA had a notification window that was too long for this type of incident. The classification as medium severity might have been appropriate, but the SLA aggravated the delay. The team's availability and the MSSP's technical skills are secondary or not the root cause.
Which THREE are components of the Plan phase in a security program lifecycle (e.g., ISO 27001 PDCA)?
Risk assessment is foundational to planning.
Why this answer
Risk assessment, policy development, and strategy alignment are all part of planning. Options A, B, and E are correct. Option C (implementation) belongs to the Do phase.
Option D (monitoring) belongs to Check/Act.
An organization's incident response team is conducting a lessons learned meeting after a major incident. Which outcome is MOST critical to document?
Root cause identifies underlying issues to prevent recurrence.
Why this answer
Option B is correct because root cause analysis prevents recurrence. Option A is wrong although timeline is useful, root cause is more critical. Option C is wrong because cost is not the primary learning objective.
Option D is wrong because tool list is less strategic.
A financial institution is hit by a Distributed Denial of Service (DDoS) attack that is overwhelming their internet-facing services. The incident response team activates the plan, but the attack continues to escalate. The CEO is under pressure and asks the incident response manager whether they should pay the ransom demand (the attackers also sent an extortion note demanding payment to stop the attack). The manager must advise the CEO on the best course of action.
Scrubbing services can absorb and filter attack traffic while allowing legitimate traffic.
Why this answer
Using DDoS scrubbing services (cloud-based or on-premise) is the recommended technical defense. Paying the ransom encourages future attacks and does not guarantee the attack will stop. Rate limiting may affect legitimate traffic.
Shutting down external access is too drastic and impacts business.
Which of the following is the PRIMARY goal of incident containment?
Core objective of containment.
Why this answer
Option C is correct because containment aims to prevent further damage and limit scope. Options A, B, D are goals of other phases.
After a security incident, the board holds the CISO accountable. The CISO argues that the incident was caused by a failure in the third-party risk management process. Which of the following governance deficiencies is most likely the root cause?
Governance requires board-level policies to define expectations and oversight.
Why this answer
Option D is correct because without board-level oversight of third-party risk, governance cannot ensure proper management. Option A is wrong because technical failures are not governance deficiencies. Option B is wrong because vendor selection is operational, not governance.
Option C is wrong because incident response is post-event; the root cause is lack of governance oversight.
An information security manager is asked to report on the effectiveness of the security program. Which metric would BEST indicate governance effectiveness?
Directly measures governance alignment.
Why this answer
Option A is correct because governance effectiveness is best measured by the percentage of security projects aligned with business strategy. Option B is wrong as mean time to respond is operational. Option C is wrong as vulnerability count is technical.
Option D is wrong as audit findings are compliance focused.
Which TWO of the following are key components of an information security program governance structure? (Select TWO.)
A steering committee ensures alignment with business strategy and provides oversight.
Why this answer
A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.
Exam trap
ISACA often tests the distinction between governance (strategic oversight and decision-making) and management (operational execution and controls), so candidates mistakenly select operational items like incident response plans or vulnerability schedules as governance components.
An organization uses the ISO 31000 risk management framework. During the risk evaluation phase, it determines that a certain risk has a low likelihood but very high impact. The organization's risk appetite is moderate. Which of the following is the MOST appropriate risk treatment decision?
Mitigation reduces the impact to an acceptable level, aligning with moderate risk appetite.
Why this answer
Option A is correct because even low likelihood risks with high impact may need mitigation to align with moderate risk appetite. Option B is wrong because acceptance is only appropriate if risk is within appetite. Option C is wrong because avoidance is extreme unless no other controls exist.
Option D is wrong because transfer may not fully address the impact.
Which of the following is the PRIMARY role of the board of directors in information security governance?
The board ensures security aligns with business strategy.
Why this answer
The board of directors holds the ultimate fiduciary responsibility for the organization, including its information security posture. Their primary role is to provide strategic direction and oversight, ensuring that the security program aligns with business objectives, risk appetite, and regulatory requirements. This includes approving the overall security strategy, reviewing key risk indicators, and holding management accountable for security performance, not executing tactical tasks.
Exam trap
ISACA often tests the distinction between governance (board) and management (CISO/IT) roles, and the trap here is that candidates mistakenly assign tactical implementation duties to the board because they confuse oversight with execution.
How to eliminate wrong answers
Option A is wrong because managing day-to-day security operations is the responsibility of the security operations center (SOC) and operational staff, not the board. Option B is wrong because implementing security controls and technologies is a tactical function performed by security engineers and IT teams, not the board. Option D is wrong because developing detailed security policies and procedures is a management-level task typically handled by the CISO and security team, while the board provides high-level approval and oversight of the policy framework.
Page 7 of 7
Practice CISM by domain
Target a specific domain to shore up weak areas.