How should I use these Information Security Governance practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Information Security Governance questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Information Security Governance domain.

CISM · topic practice

Information Security Governance practice questions

Practise Certified Information Security Manager CISM Information Security Governance practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Information Security Governance

Practice 10 questions Browse domain →

What the exam tests

What to know about Information Security Governance

Information Security Governance questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Information Security Governance exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Information Security Governance questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Information Security Governance explanation →

Which of the following is the PRIMARY responsibility of the board of directors regarding information security governance?

Trap 1: Performing technical vulnerability assessments

This is a technical task assigned to security engineers or analysts.

Trap 2: Approving specific security tools and technologies

This is an operational decision typically delegated to management.

Trap 3: Conducting daily security monitoring activities

This is a tactical function performed by security operations teams.

Study all Information Security Governance common traps →

A
Performing technical vulnerability assessments
Why wrong: This is a technical task assigned to security engineers or analysts.
B
Approving specific security tools and technologies
Why wrong: This is an operational decision typically delegated to management.
C
Conducting daily security monitoring activities
Why wrong: This is a tactical function performed by security operations teams.
D
Setting the strategic direction and oversight of the security programme
The board provides strategic direction and oversight, ensuring alignment with business goals.

Information Security Governance practice questions

What to know about Information Security Governance

Common Information Security Governance exam traps

Information Security Governance questions

Which of the following is the PRIMARY responsibility of the board of directors regarding information security governance?

An organization has a decentralized governance model where each business unit manages its own security. What is a key challenge of this model?

A CISO is developing a multi-year security roadmap. Which of the following should be the PRIMARY driver for prioritizing initiatives?

Which capability maturity model (CMM) level indicates that security processes are proactively measured and optimized?

An organization is implementing a new security policy. Which step should occur AFTER the policy is approved?

Which board-level metric is MOST useful for measuring the effectiveness of the incident response process?

A CISO is building a business case for a new security tool. Which approach BEST articulates the return on investment (ROI) to the board?

An organization is subject to GDPR, PCI DSS, and SOX. What is the BEST approach to manage compliance with multiple regulations?

A security awareness programme is being evaluated. Which metric BEST indicates a positive security culture?

Which of the following is the PRIMARY benefit of having a formal policy exception management process?

An organization is deciding whether to adopt a centralized or hybrid security governance model. Which factor MOST strongly favors a hybrid model?

Which of the following is the PRIMARY responsibility of the CISO in an organization?

A CISO is reporting to the board on the effectiveness of the security programme. Which TWO metrics are MOST appropriate for board-level reporting? (Select TWO)

An organization is updating its information security strategy. Which THREE elements should be included to ensure alignment with business objectives? (Select THREE)

A security policy is being developed. Which THREE steps are part of the policy development lifecycle? (Select THREE)

Which of the following is the primary responsibility of the board of directors in information security governance?

An organization is implementing a hybrid governance model for information security. Which statement best describes this approach?

A CISO is developing a multi-year security roadmap. Which approach best ensures the roadmap aligns with business strategy?

Which capability maturity model (CMM) level is characterized by security processes being standardized and documented across the organization?

A security metrics program should include key performance indicators (KPIs) for board reporting. Which metric is most appropriate for executive oversight?

Track your progress over time

Start a Information Security Governance only practice session

Related CISM topic practice pages

Information Security Program practice questions

Incident Management practice questions

Information Security Programme practice questions

Information Security Governance practice questions

Information Security Risk Management practice questions

CISM fundamentals practice questions

CISM scenario practice questions

CISM troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid