How should I use these Information Security Program practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Information Security Program questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Information Security Program domain.

CISM · topic practice

Information Security Program practice questions

This domain covers building, governing, and continuously improving an information security program. CISM questions here test how you align security with business objectives, assign ownership, apply policies and standards, and move an organization from reactive to proactive. Expect scenario-based questions about governance structures, data classification, metrics, and program maturity rather than hands-on tool configuration.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Information Security Program

Practice 10 questions Browse domain →

What the exam tests

What to know about Information Security Program

You must be able to select governance, policy, and program-management actions that align security with business goals and enforce standards. The single most important thing is to identify who owns the risk and the control, then choose the action that improves accountability and proactive risk management.

Aligning security strategy, policies, and standards with business objectives and risk appetite

Assigning security roles, responsibilities, and accountability across business units and the CISO

Establishing data classification, ownership, and handling standards, and enforcing compliance

Using metrics, audits, and maturity models to move from reactive to proactive security

Why learners struggle

Why Information Security Program questions are commonly missed

RAM questions are commonly missed because learners confuse physical form factors (DIMM vs SO-DIMM) and fail to distinguish between memory speed (MHz) and latency (CL).

·DIMM vs SO-DIMM — desktop vs laptop form factor confusion
·DDR3 vs DDR4 vs DDR5 — notch position and voltage differences
·MHz vs CL — speed vs latency trade-offs in performance
·Single-channel vs dual-channel — bandwidth impact misconception
·ECC vs non-ECC — error correction support in servers vs desktops
·32-bit vs 64-bit — maximum addressable RAM limit

Watch out for

Common Information Security Program exam traps

▸Choosing a technical control or tool when the real issue is governance, policy enforcement, or unclear ownership.
▸Treating policy noncompliance as a training problem instead of an accountability and enforcement gap.
▸Selecting a reactive activity, such as incident response, when the question asks for a proactive program initiative.

Practice set

Information Security Program questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Information Security Program explanation →

Match the following security program components with their primary purpose by dragging each component to the correct description.

Trap 1: Security Policy

Matching item, not directly evaluated here.

Trap 2: Incident Response Plan

Matching item.

Trap 3: Risk Assessment

Matching item.

Study all Information Security Program common traps →

A
Security Policy
Why it fails: Matching item, not directly evaluated here.
B
Incident Response Plan
Why it fails: Matching item.
C
Risk Assessment
Why it fails: Matching item.
D
Describes the organization's high-level security objectives and management commitment
Why it fails: Correct match for Security Policy.
E
Provides step-by-step actions to detect, respond, and recover from security incidents
Why it fails: Correct match for Incident Response Plan.
F
Identifies threats, vulnerabilities, and impacts to determine risk levels
Why it fails: Correct match for Risk Assessment.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Information Security Program explanation →

An organization has implemented a balanced scorecard to measure the effectiveness of its information security program. Which of the following metrics would be MOST appropriate for the 'internal processes' perspective?

Trap 1: Percentage of systems compliant with baseline

Compliance rate is more aligned with the governance or regulatory perspective, not internal processes.

Trap 2: Percentage of users who completed security awareness training

Awareness training completion measures the learning and growth perspective, addressing workforce competence rather than process execution. It is tempting because training metrics are easy to collect and often reported alongside security KPIs, but the internal processes perspective requires operational measures such as baseline compliance, patch latency or control effectiveness.

Trap 3: Number of security incidents reported to management

Incidents reported to management measure outcomes and oversight, aligning with the learning and growth or customer perspective rather than internal processes. Internal process metrics address operational efficiency, such as percentage of vulnerabilities remediated within agreed service levels.

Study all Information Security Program common traps →

A
Percentage of systems compliant with baseline
Why it fails: Compliance rate is more aligned with the governance or regulatory perspective, not internal processes.
B
Mean time to detect and respond to incidents
Mean time to detect and respond to incidents measures the efficiency of security operations, directly reflecting the internal processes perspective's focus on operational effectiveness. It satisfies the stem's requirement for a process-oriented metric, unlike outcome or financial measures, by quantifying how well detection and response workflows perform.
C
Percentage of users who completed security awareness training
Why it fails: Awareness training completion measures the learning and growth perspective, addressing workforce competence rather than process execution. It is tempting because training metrics are easy to collect and often reported alongside security KPIs, but the internal processes perspective requires operational measures such as baseline compliance, patch latency or control effectiveness.
D
Number of security incidents reported to management
Why it fails: Incidents reported to management measure outcomes and oversight, aligning with the learning and growth or customer perspective rather than internal processes. Internal process metrics address operational efficiency, such as percentage of vulnerabilities remediated within agreed service levels.

Full breakdown with real-world context →

Question 3mediummulti select

Read the full Information Security Program explanation →

An information security manager is developing a security program for a multinational organization. Which of the following should be considered when defining the program scope? (Select THREE)

Trap 1: Current technology architecture

Architecture is a design element, not a scope determinant.

Study all Information Security Program common traps →

B
Current technology architecture
Why it fails: Architecture is a design element, not a scope determinant.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Information Security Program explanation →

Match each information security program component with its correct description.

Trap 1: High-level statement of management intent

A policy is indeed a high-level statement of management intent, so this pairing is correct rather than a distractor. It is tempting to confuse policy with standards or procedures, which specify mandatory controls and step-by-step instructions respectively, but the description given matches policy precisely.

Trap 2: Recommended practice or advisory action

A guideline is a recommended practice or advisory action, which is a standard, not a component of an information security programme such as policy, awareness or monitoring. It is tempting because guidelines genuinely are advisory, and this description would be correct if the stem asked which document type gives non-mandatory recommendations.

Trap 3: Detailed step-by-step instructions

Procedures are the step-by-step documents that implement a policy, so pairing them with this description is accurate, not a mismatch. The stem requires matching each component to its own description; a procedure is precisely detailed instructions, making this pairing correct rather than the intended alternative.

Study all Information Security Program common traps →

A
High-level statement of management intent
Why it fails: A policy is indeed a high-level statement of management intent, so this pairing is correct rather than a distractor. It is tempting to confuse policy with standards or procedures, which specify mandatory controls and step-by-step instructions respectively, but the description given matches policy precisely.
C
Recommended practice or advisory action
Why it fails: A guideline is a recommended practice or advisory action, which is a standard, not a component of an information security programme such as policy, awareness or monitoring. It is tempting because guidelines genuinely are advisory, and this description would be correct if the stem asked which document type gives non-mandatory recommendations.
D
Detailed step-by-step instructions
Why it fails: Procedures are the step-by-step documents that implement a policy, so pairing them with this description is accurate, not a mismatch. The stem requires matching each component to its own description; a procedure is precisely detailed instructions, making this pairing correct rather than the intended alternative.

Full breakdown with real-world context →

Question 5hardmulti select

Read the full Information Security Program explanation →

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

Trap 1: Security awareness training for all employees.

Training is important but not directly a continuity integration.

Trap 2: Vulnerability scanning schedules.

Vulnerability scanning is proactive security, not continuity.

Study all Information Security Program common traps →

B
Security awareness training for all employees.
Why it fails: Training is important but not directly a continuity integration.
D
Vulnerability scanning schedules.
Why it fails: Vulnerability scanning is proactive security, not continuity.

Full breakdown with real-world context →

Question 6mediummultiple choice

Read the full Information Security Program explanation →

An information security manager is developing a program metric to report to senior management. Which metric best demonstrates the effectiveness of the information security program?

Trap 1: Number of security incidents reported

Does not show effectiveness; could indicate increased reporting.

Trap 2: Percentage of systems with up-to-date patches

Operational metric, not strategic for senior management.

Trap 3: Number of security awareness training sessions held

Activity metric, not outcome-based.

Study all Information Security Program common traps →

A
Number of security incidents reported
Why it fails: Does not show effectiveness; could indicate increased reporting.
B
Percentage of systems with up-to-date patches
Why it fails: Operational metric, not strategic for senior management.
D
Number of security awareness training sessions held
Why it fails: Activity metric, not outcome-based.

Full breakdown with real-world context →

Question 7hardmultiple choice

Read the full Information Security Program explanation →

Match each information security program component to its primary focus area.

Component: 1. Risk Assessment, 2. Security Awareness Training, 3. Incident Response Plan, 4. Policy Framework

Focus Areas: A. Human factors and behavior B. Structured response to events C. Identification and analysis of threats D. Governance and compliance requirements

Drag each component to its matching focus area.

Trap 1: C

This is correct matching; but in JSON we mark all false and use pbq_config.

Study all Information Security Program common traps →

A
C. Identification and analysis of threats
Why it fails: This is correct matching; but in JSON we mark all false and use pbq_config.

Full breakdown with real-world context →

Question 8mediumdrag order

Read the full Information Security Program explanation →

Arrange the steps in order for conducting a business impact analysis (BIA) in business continuity management.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Trap 1: Identify critical business functions, then assess impact of…

This is incorrect because impact assessment should come after determining acceptable downtime. You need to know the allowable outage time before you can measure the actual impact of exceeding it.

Trap 2: Identify critical business functions, then document findings, then…

This is incorrect because documentation is the final step. Performing it early means you would document incomplete or preliminary information, and you cannot properly assess downtime or impact before documenting.

Trap 3: Document findings, then prioritize recovery of critical functions,…

This is incorrect because it reverses the entire process. A BIA must start by identifying critical functions and end with documentation; you cannot document or prioritize before you know what is critical and what the impacts are.

Study all Information Security Program common traps →

A
Identify critical business functions, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions, then document findings
This is correct because a BIA first identifies what is critical, then establishes the maximum tolerable outage, then evaluates the consequences, then ranks recovery priorities based on that analysis, and finally records the results.
B
Identify critical business functions, then assess impact of disruptions, then determine acceptable downtime, then prioritize recovery of critical functions, then document findings
Why it fails: This is incorrect because impact assessment should come after determining acceptable downtime. You need to know the allowable outage time before you can measure the actual impact of exceeding it.
C
Identify critical business functions, then document findings, then determine acceptable downtime, then assess impact of disruptions, then prioritize recovery of critical functions
Why it fails: This is incorrect because documentation is the final step. Performing it early means you would document incomplete or preliminary information, and you cannot properly assess downtime or impact before documenting.
D
Document findings, then prioritize recovery of critical functions, then assess impact of disruptions, then determine acceptable downtime, then identify critical business functions
Why it fails: This is incorrect because it reverses the entire process. A BIA must start by identifying critical functions and end with documentation; you cannot document or prioritize before you know what is critical and what the impacts are.

Full breakdown with real-world context →

Question 9mediummatching

Read the full Information Security Program explanation →

Match each CISM domain to its focus area.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Establish and maintain a framework to align security with business objectives

Identify and manage information risk to achieve business objectives

Design and implement a security program to manage risk

Plan and manage the incident response process

Oversee and improve the security program's performance

Trap 1: Information Security Governance: Designing and implementing…

Incorrect — this describes Information Security Program Development and Management, not Governance.

Trap 2: Information Risk Management: Responding to security incidents.

Incorrect — this describes Information Security Incident Management, not Risk Management.

Study all Information Security Program common traps →

A
Information Security Governance: Establishing and maintaining a framework to ensure information security strategies are aligned with business objectives.
This is the correct focus of Information Security Governance as per CISM.
B
Information Risk Management: Identifying and managing information risks to achieve business objectives.
This is the correct focus of Information Risk Management as per CISM.
C
Information Security Program Development and Management: Designing, implementing, and managing the information security program.
This is the correct focus of Information Security Program Development and Management as per CISM.
D
Information Security Incident Management: Planning, establishing, and managing the capability to detect, respond to, and recover from incidents.
This is the correct focus of Information Security Incident Management as per CISM.
E
Information Security Governance: Designing and implementing security solutions.
Why it fails: Incorrect — this describes Information Security Program Development and Management, not Governance.
F
Information Risk Management: Responding to security incidents.
Why it fails: Incorrect — this describes Information Security Incident Management, not Risk Management.

Full breakdown with real-world context →

Question 10mediummatching

Read the full Information Security Program explanation →

Match each security framework to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Specify requirements for an ISMS

Provide risk-based guidance for critical infrastructure

Govern and manage enterprise IT

Align IT services with business needs

Protect cardholder data

Trap 1: COBIT: A standard for information security management systems.

Incorrect — this definition describes ISO 27001, not COBIT. COBIT focuses on IT governance.

Trap 2: ISO 27001: A framework for IT governance and management.

Incorrect — this definition describes COBIT, not ISO 27001. ISO 27001 is an ISMS standard.

Study all Information Security Program common traps →

A
COBIT: A framework for IT governance and management.
COBIT is specifically designed for IT governance and management, providing a comprehensive framework for aligning IT with business goals.
B
ISO 27001: A standard for information security management systems.
ISO 27001 is an international standard that specifies requirements for establishing, implementing, and maintaining an information security management system (ISMS).
C
NIST Cybersecurity Framework: A framework to improve cybersecurity risk management.
The NIST Cybersecurity Framework provides guidance for organizations to better understand, manage, and reduce cybersecurity risks.
D
COBIT: A standard for information security management systems.
Why it fails: Incorrect — this definition describes ISO 27001, not COBIT. COBIT focuses on IT governance.
E
ISO 27001: A framework for IT governance and management.
Why it fails: Incorrect — this definition describes COBIT, not ISO 27001. ISO 27001 is an ISMS standard.

Full breakdown with real-world context →

Question 11mediummatching

Read the full Information Security Program explanation →

Match each security role to its primary responsibility.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Senior executive responsible for security strategy

Oversees daily security operations and team

Designs security infrastructure and controls

Evaluates compliance and effectiveness of controls

Executes incident response procedures

Trap 1: CISO: Evaluates security controls and ensures compliance.

Incorrect — evaluating controls is the role of the Security Auditor.

Trap 2: Security Manager: Designs security architecture.

Incorrect — designing architecture is the responsibility of the Security Architect.

Study all Information Security Program common traps →

A
CISO: Responsible for overall security strategy and program management.
The CISO is the senior executive responsible for the information security program.
B
Security Manager: Oversees daily security operations and manages security team.
The Security Manager handles day-to-day operations and team management.
C
Security Architect: Designs and implements security architecture and controls.
The Security Architect is responsible for designing security solutions.
D
Security Auditor: Evaluates security controls and ensures compliance.
The Security Auditor independently reviews controls and compliance.
E
CISO: Evaluates security controls and ensures compliance.
Why it fails: Incorrect — evaluating controls is the role of the Security Auditor.
F
Security Manager: Designs security architecture.
Why it fails: Incorrect — designing architecture is the responsibility of the Security Architect.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full Information Security Program explanation →

A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?

Trap 1: ISO/IEC 27001

ISO/IEC 27001 requires establishing, documenting and auditing a full ISMS with formal risk treatment and certification overhead, which strains a small business's limited staff. It is tempting because it is the recognised international standard for information security management, and would be correct for organisations pursuing formal certification.

Trap 2: COBIT 2019

COBIT 2019 is an enterprise IT governance framework spanning the whole organisation, demanding substantial assessment and tailoring effort. A small business with limited budget and staff cannot sustain that overhead. It is tempting because COBIT suits large enterprises needing formal governance and audit alignment across many processes.

Trap 3: PCI DSS

PCI DSS prescribes controls solely for entities storing, processing or transmitting cardholder data, so it cannot guide a general security programme. It is correct when a business must demonstrate payment card compliance, whereas a broad programme needs an overarching framework such as ISO/IEC 27001.

Study all Information Security Program common traps →

A
ISO/IEC 27001
Why it fails: ISO/IEC 27001 requires establishing, documenting and auditing a full ISMS with formal risk treatment and certification overhead, which strains a small business's limited staff. It is tempting because it is the recognised international standard for information security management, and would be correct for organisations pursuing formal certification.
B
NIST Cybersecurity Framework
The NIST Cybersecurity Framework suits a small business because it is voluntary, outcome-based and scalable, requiring no costly certification or dedicated compliance staff. It maps existing practises to five core functions, letting the owner prioritise spending against the stem's limited budget and staffing constraints.
C
COBIT 2019
Why it fails: COBIT 2019 is an enterprise IT governance framework spanning the whole organisation, demanding substantial assessment and tailoring effort. A small business with limited budget and staff cannot sustain that overhead. It is tempting because COBIT suits large enterprises needing formal governance and audit alignment across many processes.
D
PCI DSS
Why it fails: PCI DSS prescribes controls solely for entities storing, processing or transmitting cardholder data, so it cannot guide a general security programme. It is correct when a business must demonstrate payment card compliance, whereas a broad programme needs an overarching framework such as ISO/IEC 27001.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full Information Security Program explanation →

A company's security program includes a policy that prohibits the use of personal devices for work. However, the CISO discovers that several executives are using personal tablets to access corporate email. What is the most appropriate action for the CISO to take?

Trap 1: Block all personal devices from the network

Technical enforcement without policy change may harm productivity.

Trap 2: Continue monitoring but take no action

Inaction decays security culture.

Trap 3: Discipline the executives for policy violation

May create resistance and does not address business need.

Study all Information Security Program common traps →

A
Block all personal devices from the network
Why it fails: Technical enforcement without policy change may harm productivity.
B
Continue monitoring but take no action
Why it fails: Inaction decays security culture.
C
Update the policy to allow personal devices under strict controls
Balances security with usability through mobile device management.
D
Discipline the executives for policy violation
Why it fails: May create resistance and does not address business need.

Full breakdown with real-world context →

Question 14easymultiple choice

Read the full Information Security Program explanation →

Which of the following best describes the primary purpose of an information security program?

Trap 1: To ensure 100% system availability

Availability is one component of the CIA triad, and no system achieves 100% uptime, so it cannot define the programme's purpose. It is tempting because outages are highly visible and availability is a genuine security objective, but the programme's primary purpose is protecting confidentiality, integrity and availability of information overall.

Trap 2: To eliminate all security risks

Risk can be managed, transferred or accepted, but never eliminated, so this states an impossible objective. It is tempting because security programmes do aim to reduce risk exposure, and in a threat-free or fully air-gapped environment with no residual risk appetite, elimination-style goals could appear achievable.

Trap 3: To achieve compliance with all applicable regulations

Compliance is an outcome that a security programme helps satisfy, but regulations vary and change, so it cannot be the primary purpose. It is tempting because audits and regulatory obligations often drive programme funding, yet the programme exists to manage risk to information assets, with compliance as a by-product.

Study all Information Security Program common traps →

A
To ensure 100% system availability
Why it fails: Availability is one component of the CIA triad, and no system achieves 100% uptime, so it cannot define the programme's purpose. It is tempting because outages are highly visible and availability is a genuine security objective, but the programme's primary purpose is protecting confidentiality, integrity and availability of information overall.
B
To eliminate all security risks
Why it fails: Risk can be managed, transferred or accepted, but never eliminated, so this states an impossible objective. It is tempting because security programmes do aim to reduce risk exposure, and in a threat-free or fully air-gapped environment with no residual risk appetite, elimination-style goals could appear achievable.
C
To manage security risks in alignment with business strategy
An information security programme exists to identify, treat and monitor risk so that it stays within the organisation's risk appetite while enabling business objectives. Frameworks and controls are instruments; aligning risk management with business strategy is the primary purpose.
D
To achieve compliance with all applicable regulations
Why it fails: Compliance is an outcome that a security programme helps satisfy, but regulations vary and change, so it cannot be the primary purpose. It is tempting because audits and regulatory obligations often drive programme funding, yet the programme exists to manage risk to information assets, with compliance as a by-product.

Full breakdown with real-world context →

Question 15hardmulti select

Read the full Information Security Program explanation →

Which TWO of the following are key performance indicators (KPIs) that demonstrate the effectiveness of a security awareness program?

Trap 1: Number of employees who report suspicious emails

Positive behavior but not a direct measure of program effectiveness.

Trap 2: Frequency of phishing simulation tests

Phishing simulation frequency counts how often tests run, an activity measure of programme effort, not of staff behaviour or risk reduction. It is tempting because simulations underpin awareness, and would be correct as a programme activity metric, not a KPI of effectiveness.

Trap 3: Number of training sessions completed per quarter

Training sessions completed per quarter measures delivery volume, an activity metric showing effort expended rather than whether behaviour or security posture improved. It is tempting because completion tracking is easy, and would be correct for monitoring programme coverage, not effectiveness.

Study all Information Security Program common traps →

A
Percentage of employees who correctly identify a phishing email in simulations
Simulation results measure whether employees actually apply awareness training when confronted with a realistic phishing attempt. This directly evidences behavioural change, the intended outcome of the programme, rather than attendance or completion metrics, making it a genuine effectiveness KPI.
B
Number of employees who report suspicious emails
Why it fails: Positive behavior but not a direct measure of program effectiveness.
C
Frequency of phishing simulation tests
Why it fails: Phishing simulation frequency counts how often tests run, an activity measure of programme effort, not of staff behaviour or risk reduction. It is tempting because simulations underpin awareness, and would be correct as a programme activity metric, not a KPI of effectiveness.
D
Number of training sessions completed per quarter
Why it fails: Training sessions completed per quarter measures delivery volume, an activity metric showing effort expended rather than whether behaviour or security posture improved. It is tempting because completion tracking is easy, and would be correct for monitoring programme coverage, not effectiveness.
E
Reduction in the number of security incidents caused by human error
Human-error incident counts show whether awareness training reduced real-world breaches over time. This outcome-based measure links the programme to reduced organisational risk, satisfying the KPI requirement for demonstrable effectiveness rather than activity or coverage statistics.

Full breakdown with real-world context →

Question 16easymulti select

Read the full Information Security Program explanation →

Which THREE of the following are typically included in an information security program budget?

Trap 1: Marketing and advertising campaigns

Not part of security program.

Trap 2: Employee salaries

Operational expense, not program budget line item.

Study all Information Security Program common traps →

A
Incident response retainer
External service cost part of program.
B
Security awareness training materials
Direct program cost.
C
Vulnerability assessment tools
Technical control costs.
D
Marketing and advertising campaigns
Why it fails: Not part of security program.
E
Employee salaries
Why it fails: Operational expense, not program budget line item.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Information Security Program explanation →

Which of the following is the primary purpose of an information security program?

Trap 1: Implement firewalls and antivirus software.

Firewalls and antivirus are technical controls that support specific protections; they do not define governance, risk alignment or policy direction, so they cannot be the programme's primary purpose. It is tempting because these controls are visible, tangible outputs of security work, and in a purely tactical remediation scenario deploying them would be the correct action.

Trap 2: Achieve compliance with regulations only.

Compliance is an outcome that a security programme helps satisfy, not its purpose; regulations set minimum baselines and lag behind emerging threats, so compliance alone leaves material risk untreated. It is tempting because regulatory obligations are mandatory and auditable, and in a heavily regulated scenario meeting a specific mandate would be the correct immediate objective.

Trap 3: Eliminate all security risks.

Risk can be reduced and managed but never fully eliminated, since threats, vulnerabilities and human behaviour persist; a programme aims to keep risk within appetite. It is tempting because zero risk sounds like the ideal end state, and in a narrow scenario such as decommissioning an isolated legacy system, eliminating its risk entirely would be achievable.

Study all Information Security Program common traps →

A
Implement firewalls and antivirus software.
Why it fails: Firewalls and antivirus are technical controls that support specific protections; they do not define governance, risk alignment or policy direction, so they cannot be the programme's primary purpose. It is tempting because these controls are visible, tangible outputs of security work, and in a purely tactical remediation scenario deploying them would be the correct action.
B
Achieve compliance with regulations only.
Why it fails: Compliance is an outcome that a security programme helps satisfy, not its purpose; regulations set minimum baselines and lag behind emerging threats, so compliance alone leaves material risk untreated. It is tempting because regulatory obligations are mandatory and auditable, and in a heavily regulated scenario meeting a specific mandate would be the correct immediate objective.
C
Eliminate all security risks.
Why it fails: Risk can be reduced and managed but never fully eliminated, since threats, vulnerabilities and human behaviour persist; a programme aims to keep risk within appetite. It is tempting because zero risk sounds like the ideal end state, and in a narrow scenario such as decommissioning an isolated legacy system, eliminating its risk entirely would be achievable.
D
Protect the confidentiality, integrity, and availability of information assets.
Protecting confidentiality, integrity and availability directly satisfies the stem's demand for the programme's primary purpose: CIA underpins every control, policy and risk decision an information security programme exists to deliver. Governance, compliance and awareness activities all serve this end rather than constituting it, making CIA the foundational objective.

Full breakdown with real-world context →

Question 18hardmulti select

Read the full Information Security Program explanation →

Which THREE of the following are critical success factors for implementing an information security program?

Trap 1: Compliance as the primary driver.

May lead to checkbox approach; should be risk-driven.

Trap 2: Deployment of the latest security technology.

Technology is a means, not a success factor.

Study all Information Security Program common traps →

A
Compliance as the primary driver.
Why it fails: May lead to checkbox approach; should be risk-driven.
B
Risk-based approach to prioritize controls.
Focuses resources on highest risk.
C
Executive management sponsorship and support.
Provides authority and resources.
D
Deployment of the latest security technology.
Why it fails: Technology is a means, not a success factor.
E
Alignment with business objectives.
Ensures relevance and acceptance.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full Information Security Program explanation →

Based on the exhibit, what is the most likely vulnerability that an attacker could exploit?

Exhibit

Refer to the exhibit.

Exhibit: Network Architecture Description

The network consists of three zones: External, DMZ, and Internal. The external interface connects to the internet. The DMZ hosts public-facing web servers and an email relay. The internal zone hosts database servers and application servers. A firewall separates External from DMZ, and another firewall separates DMZ from Internal. The firewall rules are:
- External to DMZ: allow HTTP, HTTPS, SMTP.
- DMZ to Internal: allow MySQL (3306) from web servers to database servers, and allow LDAP (389) from application servers to domain controllers.
- Internal to External: allow outbound HTTP/HTTPS from application servers.
- All other traffic is denied.
The IDS is placed on the DMZ segment, monitoring traffic between DMZ and Internal. The IDS signatures include critical, high, and medium severity, and the action is 'alert and log'.

Trap 1: An attacker could perform a DDoS attack on the external interface…

Possible but not the most likely vulnerability; email may have mitigation.

Trap 2: An attacker could exploit the SMTP service to send spam.

Spam is not a data breach; less likely as a primary exploit.

Trap 3: An attacker could sniff traffic on the DMZ segment to capture LDAP…

LDAP is between application servers and domain controllers; not directly exploitable from external.

Study all Information Security Program common traps →

A
An attacker could perform a DDoS attack on the external interface to disrupt email services.
Why it fails: Possible but not the most likely vulnerability; email may have mitigation.
B
An attacker could use SQL injection on the web server to extract data directly from the database via the permitted MySQL traffic.
The MySQL rule allows direct database access from web; SQL injection can leverage this.
C
An attacker could exploit the SMTP service to send spam.
Why it fails: Spam is not a data breach; less likely as a primary exploit.
D
An attacker could sniff traffic on the DMZ segment to capture LDAP credentials.
Why it fails: LDAP is between application servers and domain controllers; not directly exploitable from external.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full Information Security Program explanation →

A company is implementing an information security program. Which of the following is the PRIMARY reason to align the program with business objectives?

Trap 1: To ensure regulatory compliance

Regulatory compliance is a mandated obligation, not the primary driver; alignment exists so security enables and supports business goals and risk appetite. It is tempting because compliance is a common programme justification, and would be the answer if the stem asked why specific controls are implemented.

Trap 2: To improve technical controls

Improving technical controls is a tactical activity, not the primary reason; alignment ties security strategy to business objectives and risk appetite. It is tempting because controls are the visible output of a programme, and control improvement would be correct if the stem asked how to remediate a specific technical gap.

Trap 3: To reduce overall security costs

Cost reduction is an outcome, not the primary reason; alignment ensures security investment supports business objectives and risk tolerance. It is tempting because security programmes often face budget scrutiny, and cost optimisation would be correct if the stem asked about justifying spend to finance.

Study all Information Security Program common traps →

A
To ensure regulatory compliance
Why it fails: Regulatory compliance is a mandated obligation, not the primary driver; alignment exists so security enables and supports business goals and risk appetite. It is tempting because compliance is a common programme justification, and would be the answer if the stem asked why specific controls are implemented.
B
To improve technical controls
Why it fails: Improving technical controls is a tactical activity, not the primary reason; alignment ties security strategy to business objectives and risk appetite. It is tempting because controls are the visible output of a programme, and control improvement would be correct if the stem asked how to remediate a specific technical gap.
C
To reduce overall security costs
Why it fails: Cost reduction is an outcome, not the primary reason; alignment ensures security investment supports business objectives and risk tolerance. It is tempting because security programmes often face budget scrutiny, and cost optimisation would be correct if the stem asked about justifying spend to finance.
D
To gain management buy-in and support
Aligning security with business objectives frames controls as enablers of organisational goals, which is what executives fund and sponsor. Management buy-in follows because the program speaks in strategic terms — revenue, risk appetite, compliance obligations — rather than technical jargon, satisfying the stem's requirement for the primary reason alignment occurs.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Information Security Program sessions

Start a Information Security Program only practice session

Every question in these sessions is drawn from the Information Security Program domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Information Security Program questions →Mixed CISM session

Frequently asked questions

What does the CISM exam test about Information Security Program?: You must be able to select governance, policy, and program-management actions that align security with business goals and enforce standards. The single most important thing is to identify who owns the risk and the control, then choose the action that improves accountability and proactive risk management.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Information Security Program questions in a focused session?: Yes — the session launcher on this page draws every question from the Information Security Program domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CISM topics?: Use the topic links above to move to related areas, or go back to the CISM question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CISM exam covers. They are not copied from any real exam or dump site.

Information Security Program only

10 questions 20 questions 30 questions 50 questions

Mixed CISM session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CISM questions Information Security Program domain overview CISM exam guide

Exam traps to avoid

▸Choosing a technical control or tool when the real issue is governance, policy enforcement, or unclear ownership.
▸Treating policy noncompliance as a training problem instead of an accountability and enforcement gap.
▸Selecting a reactive activity, such as incident response, when the question asks for a proactive program initiative.

Information Security Program practice questions

What to know about Information Security Program

Why Information Security Program questions are commonly missed

Common Information Security Program exam traps

Information Security Program questions

Match the following security program components with their primary purpose by dragging each component to the correct description.

An organization has implemented a balanced scorecard to measure the effectiveness of its information security program. Which of the following metrics would be MOST appropriate for the 'internal processes' perspective?

An information security manager is developing a security program for a multinational organization. Which of the following should be considered when defining the program scope? (Select THREE)

Match each information security program component with its correct description.

An organization is designing its information security program and needs to ensure it supports business continuity. Which TWO of the following should be integrated into the program?

An information security manager is developing a program metric to report to senior management. Which metric best demonstrates the effectiveness of the information security program?

Arrange the steps in order for conducting a business impact analysis (BIA) in business continuity management.

Match each CISM domain to its focus area.

Match each security framework to its primary purpose.

Match each security role to its primary responsibility.

A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?

A company's security program includes a policy that prohibits the use of personal devices for work. However, the CISO discovers that several executives are using personal tablets to access corporate email. What is the most appropriate action for the CISO to take?

Which of the following best describes the primary purpose of an information security program?

Which TWO of the following are key performance indicators (KPIs) that demonstrate the effectiveness of a security awareness program?

Which THREE of the following are typically included in an information security program budget?

Which of the following is the primary purpose of an information security program?

Which THREE of the following are critical success factors for implementing an information security program?

Based on the exhibit, what is the most likely vulnerability that an attacker could exploit?

Exhibit

A company is implementing an information security program. Which of the following is the PRIMARY reason to align the program with business objectives?

Track your progress over time

Start a Information Security Program only practice session

Related CISM topic practice pages

Information Security Governance practice questions

Incident Management practice questions

Information Security Programme practice questions