75 of 162 questions · Page 2/3 · Information Security Programme · Answers revealed
What is the primary function of a Security Operations Center (SOC)?
SOC analysts monitor alerts and respond to incidents.
Why this answer
A SOC is responsible for monitoring, detecting, and responding to security incidents.
A security manager is selecting controls for a new application. Which TWO controls are most important to include in a defense-in-depth strategy? (Select TWO)
Restricts access to authorized users only.
Why this answer
Defense-in-depth requires multiple layers; input validation prevents injection attacks, and access control ensures least privilege.
Which of the following is the BEST reporting structure for a CISO to ensure independent oversight and alignment with business strategy?
This provides independence and direct alignment with business strategy.
Why this answer
Reporting to the CEO or board ensures the CISO has the authority and independence to influence security strategy without conflicting priorities from IT operations.
An organization uses CIS Controls v8. They are a small business with limited cybersecurity resources. Which implementation group (IG) should they prioritize?
IG1 is the foundational set suitable for small businesses.
Why this answer
IG1 is the basic set of cyber hygiene controls designed for organizations with limited resources.
Which control framework is most appropriate for an organization that wants a prioritized set of controls based on implementation groups (IG1, IG2, IG3)?
CIS Controls v8 organizes controls into Implementation Groups (IG1, IG2, IG3) for prioritization.
Why this answer
CIS Controls v8 explicitly defines implementation groups to help organizations prioritize controls based on their risk profile and resources.
In a security operations center (SOC), which function is PRIMARILY responsible for analyzing alerts and determining whether they represent actual security incidents?
Handles escalated alerts and incident analysis.
Why this answer
Tier 2 SOC analysts are primarily responsible for deep-dive analysis of alerts escalated from Tier 1, using threat intelligence, log correlation, and forensic techniques to determine if an alert represents a genuine security incident. They possess the technical expertise to differentiate false positives from true positives by examining raw packet captures, endpoint artifacts, and SIEM event details that Tier 1 analysts may lack the context or authority to investigate fully.
Exam trap
The trap here is that candidates often confuse the initial triage role of Tier 1 analysts with the confirmatory analysis role of Tier 2, mistakenly thinking Tier 1 determines incidents, whereas Tier 1 only filters and escalates.
How to eliminate wrong answers
Option A is wrong because Tier 1 SOC analysts perform initial triage and categorization of alerts, but they lack the advanced analytical skills and authority to confirm incidents; their role is to escalate suspicious alerts to Tier 2. Option B is wrong because the incident response manager coordinates the response plan, communication, and resource allocation after an incident is confirmed, not the initial analysis of alerts. Option D is wrong because the security architect designs and reviews security controls and infrastructure, but does not perform real-time alert analysis or incident validation in the SOC.
In a third-party risk management programme, what is the primary purpose of vendor tiering?
High-risk vendors get more scrutiny; low-risk may have lighter processes.
Why this answer
Vendor tiering categorizes vendors based on the criticality of services and data access to determine the appropriate level of due diligence and monitoring. This ensures resources are focused on high-risk vendors.
A security manager is developing a security scorecard for the CISO. Which THREE of the following metrics are considered LEADING indicators?
Measures proactive vulnerability remediation.
Why this answer
Leading indicators predict future incidents. Patch compliance, access review completion, and phishing click rate are proactive measures.
Which of the following is the PRIMARY purpose of a security awareness program?
Behavior change directly reduces risks like phishing and social engineering.
Why this answer
The primary purpose is to change employee behavior to reduce human-related security risks, such as phishing susceptibility.
A security architect is designing a defense-in-depth strategy. Which combination of controls best exemplifies this approach?
Correct. All four represent different layers: network, host, data, and human.
Why this answer
Defense-in-depth uses multiple layers of security. Firewall (network), antivirus (host), encryption (data), and security awareness (human) provide overlapping layers.
An organization is selecting security controls from NIST SP 800-53. Which TWO control families are most directly related to access control? (Select TWO)
Covers user identification and authentication mechanisms.
Why this answer
Access Control (AC) and Identification and Authentication (IA) are the primary families governing access management.
A financial institution uses CIS Controls v8 and must prioritize implementation. The organization has limited resources and high exposure to ransomware. Which implementation group should be addressed FIRST?
IG1 includes basic cyber hygiene controls that prevent common attacks like ransomware.
Why this answer
IG1 consists of essential controls (e.g., inventory, malware defenses) that address the most common attacks, including ransomware.
An organization is redesigning its information security program to better align with business objectives. The CISO reports to the CIO, but business leaders feel security decisions are too IT-centric. Which reporting structure would best address this concern?
Direct reporting to the CEO or Board ensures security is independent and aligned with business objectives.
Why this answer
Reporting to the CEO or Board gives the CISO independence from IT and better alignment with business strategy.
An organization is implementing a security champions program to improve application security. Which THREE of the following are key success factors for such a program?
Authority to block releases gives them real influence.
Why this answer
Security champions need dedicated time, training, and management support to be effective. Champions act as liaisons between security and development.
Which control selection framework includes implementation groups (IG1, IG2, IG3) that help organizations prioritize controls based on their risk profile?
CIS Controls v8 uses IG1, IG2, IG3 for prioritization.
Why this answer
CIS Controls v8 organizes controls into Implementation Groups (IG1, IG2, IG3) to guide prioritization. NIST SP 800-53 uses families, and ISO 27001 uses Annex A controls.
A CISO is evaluating security metrics for reporting to the board. Which TWO of the following are leading indicators?
Leading indicator of user awareness.
Why this answer
Leading indicators are proactive measures. Phishing click rate predicts future breaches, and patch compliance indicates current vulnerability posture. Breach count and MTTD are lagging, and number of security tools is not a performance metric.
A CISO wants to present a high-level security status to the board using a one-page dashboard. Which of the following metrics is MOST appropriate for this audience?
Leading indicators that show risk trends and control effectiveness.
Why this answer
Leading indicators like phishing click rate and patch compliance are actionable and forward-looking, suitable for board-level oversight.
Which role within a security team is primarily responsible for designing and reviewing security architectures to ensure alignment with business requirements and security standards?
Security architects design and review security solutions and architectures.
Why this answer
The security architect designs and reviews the security architecture, ensuring it meets business needs and security requirements. Other roles focus on operations, analysis, or awareness.
Which security team role is primarily responsible for defining and maintaining security architecture standards?
The security architect defines security architecture and standards.
Why this answer
The security architect designs the security architecture, ensuring that security controls are integrated into systems and networks.
Which control framework is structured around Implementation Groups (IG1, IG2, IG3) to help organizations prioritize security controls based on risk?
CIS Controls v8 uses IG1 (basic), IG2 (intermediate), and IG3 (advanced) for prioritization.
Why this answer
The CIS Controls v8 framework is uniquely structured around Implementation Groups (IG1, IG2, IG3) to provide a prioritized, risk-based approach to security control implementation. IG1 represents basic cyber hygiene for organizations with limited resources, IG2 adds more advanced controls for those with moderate risk, and IG3 includes comprehensive controls for high-risk environments. This tiered structure directly aligns with the CISM focus on aligning security controls with business risk and resource constraints.
Exam trap
The trap in the CISM exam is that candidates often confuse the CIS Controls Implementation Groups with NIST SP 800-53's impact-based baselines (Low, Moderate, High), but the key distinction is that IG1/IG2/IG3 are risk-prioritized tiers based on organizational resources and threat exposure, not just data impact levels.
How to eliminate wrong answers
Option B (COBIT 2019) is wrong because it is a governance and management framework focused on IT processes and objectives, not a control framework structured around Implementation Groups; it uses a capability maturity model and process reference model instead. Option C (ISO 27001 Annex A) is wrong because it is a list of control objectives and controls for an Information Security Management System (ISMS), but it does not define Implementation Groups; organizations must determine applicability based on their own risk assessment, not a predefined tiered grouping. Option D (NIST SP 800-53) is wrong because it provides a comprehensive catalog of security and privacy controls for federal information systems, organized by control families (e.g., Access Control, Audit and Accountability), not by Implementation Groups; it uses baselines (Low, Moderate, High) but these are impact-based, not risk-prioritized tiers like IG1/IG2/IG3.
A security manager is designing an executive security report. Which content is most appropriate for a one-page C-suite dashboard?
Provides actionable insight at a strategic level.
Why this answer
C-suite executives need high-level strategic insights, not operational details. Top risks and key metrics (e.g., risk posture, critical incidents) are suitable for a dashboard.
When implementing security controls, which approach ensures that multiple layers of defense are applied so that if one control fails, others compensate?
Defense-in-depth uses multiple layers of defense to protect assets.
Why this answer
Defense-in-depth (option D) is the correct approach because it implements multiple, overlapping layers of security controls (e.g., firewalls, IDS/IPS, endpoint protection, access controls) so that if one layer fails or is bypassed, subsequent layers continue to provide protection. This layered strategy reduces the likelihood of a single point of failure compromising the entire security posture, aligning with the CISM principle of risk mitigation through redundancy.
Exam trap
The trap here is that candidates often confuse 'compensating controls' (which are alternative controls for a specific requirement or deficiency) with the broader 'defense-in-depth' strategy. In the CISM context, defense-in-depth is the layered approach that uses multiple controls to provide redundancy, so that if one fails, others still provide protection. Compensating controls are a subset used when primary controls cannot be implemented, not the overall layered strategy.
How to eliminate wrong answers
Option A is wrong because business-enabling controls are designed to support business objectives (e.g., enabling remote access) rather than providing redundant layers of defense; they focus on functionality, not compensating for failures. Option B is wrong because 'critical controls first' refers to prioritizing implementation of the most important controls (e.g., from the CIS Critical Security Controls), but it does not inherently ensure multiple layers or compensation if one fails—it's a prioritization strategy, not a layered defense model. Option C is wrong because compensating controls are specific alternative controls used when a primary control cannot be implemented (e.g., using additional logging instead of encryption), but they are not a comprehensive layered approach; defense-in-depth encompasses multiple layers, including compensating controls as one possible element, not the overarching strategy.
A security manager is designing a vulnerability management program. Which TWO of the following are essential processes?
Scanning identifies vulnerabilities.
Why this answer
Vulnerability management includes regular scanning and a prioritization process to remediate based on risk. Patching is part of remediation, but scanning and prioritization are foundational.
Which role is primarily responsible for developing and maintaining the organization's security architecture?
The Security Architect designs security structures and ensures they align with business needs.
Why this answer
The security architect designs and oversees the implementation of security architecture.
A security manager is evaluating OKRs for the vulnerability management team. Which key result best aligns with an objective to reduce risk from vulnerabilities?
Directly measures improvement in reducing vulnerability exposure.
Why this answer
Mean time to remediate critical vulnerabilities directly measures risk reduction, as faster remediation lowers exposure.
An organization is implementing a third-party risk management (TPRM) program. Which approach best addresses nth-party risk?
Cascading requirements help mitigate nth-party risk.
Why this answer
Nth-party risk refers to risks from suppliers of your suppliers. Contractual requirements that cascade down the supply chain are essential to manage this risk.
A CISO is preparing the security budget for the next fiscal year. The current IT budget is $10 million. For a mature security program, what is the recommended security budget range?
Correct. 10-15% of $10 million is $1-1.5 million.
Why this answer
Best practice for a mature security program is to allocate 10-15% of the IT budget to security. For a $10 million IT budget, that is $1 million to $1.5 million.
In a defence-in-depth strategy, which control is considered a compensating control when a critical application cannot be patched immediately due to operational constraints?
Segmenting the vulnerable application restricts access and reduces risk while patching is delayed.
Why this answer
Compensating controls provide alternative protection when a primary control cannot be applied. Network segmentation limits the blast radius and reduces the attack surface until patching can occur.
What is the primary purpose of a vulnerability management program?
This is the core function of vulnerability management.
Why this answer
Vulnerability management aims to identify, classify, and remediate vulnerabilities to reduce the attack surface.
A security manager is developing metrics for the C-suite dashboard. Which combination of metrics would provide the best view of security program effectiveness, including both leading and lagging indicators?
Phishing click rate is a leading indicator of user awareness; MTTD is a lagging indicator of detection capability.
Why this answer
Phishing click rate is a leading indicator that measures user awareness and proactive security posture, while mean time to detect (MTTD) is a lagging indicator that reflects the efficiency of detection processes. Together, they provide a balanced view of program effectiveness for executive oversight.
A CISO is evaluating a cloud provider's security posture. Which of the following should be the MOST important consideration in the vendor risk assessment?
Independent audits validate security measures.
Why this answer
The provider's certifications and independent audits provide objective evidence of security controls, which is critical for trust.
An organization is designing a third-party risk management (TPRM) program. They have identified a vendor that stores sensitive customer data. According to best practices, what should be the minimum requirement for this vendor's contract?
Correct. Contracts should include security requirements and audit rights for high-risk vendors.
Why this answer
For vendors handling sensitive customer data, the contract must include security requirements such as data protection clauses, incident notification timelines, and the right to audit. This ensures contractual enforceability of security controls.
A company is designing a third-party risk management (TPRM) program. Which THREE of the following are essential components of the ongoing monitoring phase for a critical vendor?
Annual reassessment is part of ongoing monitoring cycle.
Why this answer
Ongoing monitoring includes continuous assessment of security posture. Annual reassessment is part of the cycle, but ongoing monitoring includes more frequent checks. Contractual requirements are set during onboarding, not monitored ongoing.
Exit procedures are for termination.
An organization is designing a security operations center (SOC). Which of the following functions is PRIMARILY responsible for analyzing alerts and determining if they represent genuine threats?
Analysts analyze alerts and escalate incidents.
Why this answer
Security analysts are responsible for alert triage and investigation.
A security manager needs to justify an increase in the security budget to the board. The current budget is 0.15% of revenue. Which approach would most effectively demonstrate the need for additional funding?
Using industry benchmarks and risk implications provides a clear, objective justification.
Why this answer
Benchmarking against industry standards (0.2-0.5% of revenue) and showing the gap provides a compelling case.
Which of the following is a LEADING indicator of security performance?
Patch compliance is a leading indicator of vulnerability management effectiveness.
Why this answer
Leading indicators predict future performance; patch compliance measures proactive risk reduction.
An organization wants to establish a security champions program. What is the primary benefit of embedding security advocates in development teams?
Champions advocate for security and help integrate it into development.
Why this answer
Security champions serve as liaisons, promoting security practices and facilitating communication between security and development teams.
A SOC analyst receives an alert about a potential malware infection on a critical server. Which step should the analyst take FIRST?
Triage confirms the alert and guides next steps.
Why this answer
The first step in incident response is to investigate and confirm the alert (triage) to avoid acting on false positives.
Which of the following is the PRIMARY benefit of a security champions program?
Champions provide on-the-ground support and influence.
Why this answer
Security champions act as liaisons within development teams, promoting security best practices and improving collaboration.
A security dashboard is being designed for the C-suite. Which metric is most appropriate for a one-page executive summary?
Provides a concise, high-level status of security posture.
Why this answer
The security scorecard with overall risk level is the most appropriate metric for a one-page executive summary because it provides a high-level, aggregated view of the organization's security posture. Executives need a concise, actionable summary that distills complex security data into a single risk indicator, enabling quick decision-making without technical details.
Exam trap
The trap here is that candidates often confuse operational metrics (like patch compliance or incident counts) with strategic metrics, failing to recognize that the C-suite requires a synthesized risk indicator rather than detailed technical data.
How to eliminate wrong answers
Option A is wrong because the number of phishing simulation campaigns is a tactical metric that measures training activity, not the overall security risk or program effectiveness; it lacks the strategic context needed for executive oversight. Option B is wrong because a list of all security incidents in the quarter is too granular and operational, overwhelming executives with raw data rather than summarizing risk trends or impact. Option D is wrong because detailed patch compliance by system is a technical, system-level metric that belongs in operational reports for IT teams, not in a one-page executive summary that requires a synthesized view of risk.
A security awareness manager is designing role-based training. Which training is most appropriate for software developers?
Directly addresses the risk they introduce in code.
Why this answer
Developers need specialized training on secure coding practices to reduce vulnerabilities in applications.
Which of the following is the primary objective of a security champions programme?
Security champions serve as liaisons and advocates within their teams.
Why this answer
A security champions programme embeds security advocates within development teams to promote secure practices, improve communication, and embed security into daily work, rather than incident response or policy enforcement.
Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?
Click rate measures user susceptibility and is predictive of future breaches.
Why this answer
Phishing click rate is a leading indicator because it predicts future incidents by measuring current behavior.
An organization is implementing a security controls framework and needs to prioritize which controls to implement first. According to CIS Controls v8, which approach aligns with the principle of 'implementation groups'?
IG1 represents basic cyber hygiene controls that are essential for all organizations.
Why this answer
CIS Controls v8 defines Implementation Groups (IG1, IG2, IG3) that prioritize controls based on organizational maturity, starting with the most foundational and critical controls.
Which of the following is the PRIMARY purpose of a security champions program?
Champions serve as bridges between security and development.
Why this answer
Security champions act as liaisons in development teams, promoting security practices and facilitating communication with the security team.
Which of the following security team roles is primarily responsible for designing and implementing security solutions to protect an organization's systems and data?
Designs and oversees implementation of security solutions.
Why this answer
The security architect designs the overall security structure, including policies, technologies, and controls. Other roles focus on operations, analysis, or governance.
An organization is defining objectives and key results (OKRs) for the security program. Which TWO of the following are examples of leading indicators that could be used as key results?
Correct. Leading indicator of user awareness.
Why this answer
Leading indicators are proactive and predictive. Phishing click rate (user behavior) and patch compliance (vulnerability management) are leading indicators.
A large organization is implementing a security controls framework and wants to prioritize controls that provide the greatest risk reduction with the least operational friction. Which approach should the security manager adopt?
This risk-based approach ensures resources are focused on the most impactful controls.
Why this answer
Prioritizing critical controls first, especially those that address the most significant risks and are business-enabling, aligns with defense-in-depth and risk-based decision making.
A security manager is developing OKRs for the security team. Which TWO key results are appropriate leading indicators? (Select TWO)
Access review completion is a leading indicator for IAM governance.
Why this answer
Leading indicators are proactive; patch compliance reflects current security posture, and access review completion indicates governance effectiveness.
An organization's SOC team is measured on mean time to detect (MTTD) and mean time to respond (MTTR). The security manager notices that MTTD is low but MTTR is high. What is the most likely cause?
Slow response despite quick detection points to process or automation gaps.
Why this answer
Low detection time but high response time indicates that while alerts are generated quickly, the response process is slow due to inefficiencies in triage or remediation.
Which of the following is a key objective of a Security Operations Center (SOC)?
This is the core function of a SOC.
Why this answer
The SOC's primary objectives include monitoring, detection, and response to security incidents. Risk assessment is typically a GRC function, and policy creation is a governance function.
In a vendor risk assessment, a third-party vendor will have access to sensitive customer data. According to TPRM best practices, what should the organization do first?
Risk assessment determines the level of due diligence needed.
Why this answer
A risk assessment is performed to understand the risks before defining contract requirements and ongoing monitoring.
When designing phishing simulations, which approach best balances user learning and operational disruption?
This approach educates users and improves detection skills gradually.
Why this answer
Progressive difficulty and remediation training for clickers helps users learn while minimizing negative impact on productivity.
A company is assessing nth-party risk from a critical cloud provider. Which approach should be taken to manage this risk effectively?
Correct. This extends risk management to the provider's supply chain.
Why this answer
Managing nth-party risk requires understanding the cloud provider's supply chain. Contractual requirements for the provider to manage their subcontractors and regular audits help mitigate downstream risks.
When selecting security controls, a company must prioritize which controls first?
Risk-based prioritization ensures resources are focused on most impactful areas.
Why this answer
Critical controls that address the most significant risks should be implemented first.
During a security architecture review, the security architect identifies that a new application stores sensitive customer data in plaintext in the database. The application owner argues that performance requirements prevent encryption. What is the most appropriate compensating control to reduce risk?
DAM monitors and alerts on suspicious database queries, compensating for lack of encryption.
Why this answer
Database activity monitoring (DAM) can detect unauthorized access or exfiltration attempts, providing visibility and alerting without impacting performance. Encryption at rest is preferred, but DAM is a compensating control when encryption is not feasible.
A company uses a SaaS provider that processes sensitive customer data. The provider undergoes annual SOC 2 audits. Which additional step is essential to manage nth-party risk?
This ensures visibility into the extended supply chain.
Why this answer
Nth-party risk requires understanding the provider's subcontractors; requiring disclosure and assessment of their vendors is key.
A CISO is deciding on the organizational structure for the information security team. Which reporting structure is most likely to ensure the security function has sufficient independence and authority?
This structure provides independence from IT and operations, enhancing authority and objectivity.
Why this answer
Reporting to the CEO or board of directors ensures the information security function operates independently from operational and IT management, preventing conflicts of interest where security decisions could be overridden by cost or performance pressures. This structure aligns with the CISM principle that the CISO must have sufficient authority to enforce security policies across the entire organization without reporting to a function that may prioritize other objectives over security.
Exam trap
ISACA often tests the misconception that reporting to the CIO is acceptable because IT and security are closely related, but the CISM exam emphasizes that independence from IT is critical to avoid conflicts of interest in risk management decisions.
How to eliminate wrong answers
Option A is wrong because reporting to the CIO creates a conflict of interest where the security team may be pressured to approve insecure IT projects or bypass controls to meet delivery deadlines, undermining independent risk assessment. Option B is wrong because the COO focuses on operational efficiency and cost reduction, which can lead to underinvestment in security controls that are perceived as slowing down business processes. Option C is wrong because the CFO prioritizes financial performance and cost containment, which may result in security budget cuts or delayed implementation of critical security measures to meet short-term financial targets.
An information security manager is designing a security awareness program. Which approach BEST addresses the different learning needs of various employee groups?
Role-based training addresses specific risks associated with each role.
Why this answer
Role-based training ensures that each group receives content relevant to their responsibilities.
An organization is implementing a security champions program. What is the primary purpose of this initiative?
Champions act as liaisons, promoting security in day-to-day development.
Why this answer
Security champions embed security advocates within development teams to promote secure practices.
An organization is implementing CIS Controls v8. Which THREE of the following are implementation groups (IGs) defined in the CIS Controls?
IG1 is the foundational group.
Why this answer
CIS Controls v8 defines three implementation groups: IG1 (basic cyber hygiene), IG2 (intermediate), and IG3 (advanced) based on organization size and risk.
Which of the following is a leading indicator for measuring the effectiveness of a security awareness program?
Phishing click rate is a leading indicator that shows how well employees are able to identify phishing attempts.
Why this answer
Leading indicators are proactive measures that predict future performance; phishing click rate reflects current behavior that influences future security incidents.
A multinational organization is implementing a vendor risk management programme. Which THREE of the following should be included in the programme to effectively manage nth-party risk? (Select THREE.)
Flow-down clauses ensure requirements extend to subcontractors.
Why this answer
To manage nth-party risk, the programme should require vendors to disclose their subcontractors, include contractual clauses flowing down security requirements, and have the right to audit subcontractors. Assessing all suppliers' suppliers is impractical; focusing on high-risk vendors is more feasible.
Which TWO are key elements of a security awareness program designed to change employee behavior?
Relevant training increases engagement and retention.
Why this answer
Role-based training tailors content to job functions, and phishing simulations with remediation training reinforce learning.
A security manager is developing a security scorecard for the C-suite. Which combination of metrics would be MOST appropriate for a one-page dashboard?
These are key leading and lagging indicators suitable for executives.
Why this answer
A one-page dashboard for the C-suite should include both leading and lagging indicators that provide a high-level view of security posture, such as patch compliance (leading) and mean time to detect (lagging).
An organization is implementing a data security program. Which of the following is the most effective approach to protect sensitive data at rest?
Encryption directly protects data at rest.
Why this answer
Encryption is a fundamental control for protecting data at rest. While DLP and access controls are important, encryption provides direct confidentiality protection.
An organization is implementing a vendor tiering program for third-party risk management. Which TWO criteria should be used to classify vendors into high, medium, or low risk tiers? (Select TWO)
Determines potential impact if data is breached.
Why this answer
Data access and service criticality directly affect the potential impact of a vendor compromise.
An organization is implementing a defense-in-depth strategy. Which of the following is the BEST example of a compensating control?
Multi-factor authentication compensates for the inability to enforce strong passwords.
Why this answer
The best example of a compensating control because it provides an alternative security measure (multi-factor authentication) to mitigate the risk of weak or infeasible strong passwords for remote access. Compensating controls are implemented when a primary control cannot be applied due to technical or operational constraints, and they must achieve an equivalent or greater level of security. In this scenario, MFA compensates for the lack of password strength by requiring an additional authentication factor, such as a one-time passcode (OTP) or biometric, thereby reducing the likelihood of credential compromise.
Exam trap
The trap here is that candidates often confuse compensating controls with preventive or detective controls, mistakenly selecting a strong security measure like encryption or firewalls instead of recognizing that a compensating control specifically addresses a limitation or infeasibility of a primary control.
How to eliminate wrong answers
Option A is wrong because encrypting data at rest using AES-256 is a preventive control, not a compensating control; it directly protects data confidentiality without substituting for another control. Option B is wrong because installing a firewall at the network perimeter is a preventive control that enforces access policies, not a compensating control that addresses a deficiency in another control. Option D is wrong because conducting quarterly vulnerability scans is a detective control that identifies weaknesses after they exist, not a compensating control that provides an alternative safeguard when a primary control is not feasible.
An information security manager is asked to justify an increase in the security budget. Which approach BEST demonstrates the value of the security program?
ROI quantifies the financial benefit of security investments.
Why this answer
Presenting the return on investment (ROI) by quantifying avoided breach costs and compliance savings provides a business case for budget increases.
An organization is designing a security awareness program. Which TWO of the following should be included for developers?
Helps developers identify security flaws early.
Why this answer
Developers need secure coding and threat modeling to build secure applications.
Which TWO of the following are typical components of a security awareness program?
Tailored training for different roles.
Why this answer
Phishing simulations and role-based training are core components of awareness programs. Penetration testing is a technical assessment, vulnerability scanning is technical, and security architecture is a design function.
Which of the following is a LEADING indicator of security performance?
Measures proactive maintenance, predicting future incidents.
Why this answer
Leading indicators predict future performance. Patch compliance measures proactive security posture.
Which of the following best describes the role of a security architect in a security program?
The security architect focuses on designing secure systems and architectures.
Why this answer
The security architect designs and oversees the implementation of security solutions and ensures they align with the overall architecture.
A security awareness program includes phishing simulations. After six months, the click rate has decreased from 15% to 8%, but the number of reported phishing emails has also dropped. The CISO wants to measure the effectiveness of the program. Which metric would best indicate sustained improvement in security behavior?
A sustained downward trend in click rate indicates improved recognition and behavior.
Why this answer
A sustained low click rate over time, with increasing or stable reporting rates, is a leading indicator of improved security awareness. A decreasing click rate alone may be confounded by other factors, but combined with reporting trends it shows behavioral change.
A CISO is planning the security programme budget and wants to justify the investment to the CFO. The organization has a moderate risk appetite and an IT budget of $10 million. What is the most appropriate budget range for the security programme based on industry benchmarks?
This is 10-15%, the typical range for a mature programme.
Why this answer
For a mature security programme, industry benchmarks suggest 10-15% of IT budget. For a $10M IT budget, that is $1M to $1.5M. 0.2-0.5% of revenue is another benchmark but not directly applicable here without revenue data.
Ready to test yourself?
Try a timed practice session using only Information Security Programme questions.