Knowledge + Practice

CCNA Cism Security Program Questions

53 of 128 questions · Page 2/2 · Cism Security Program topic · Answers revealed

Practice these questions Exam hub All questions

76

MCQhard

An organization has a security program that is aligned with ISO 27001. During an internal audit, it is discovered that several controls are not being applied consistently across all departments. The MOST effective corrective action is to:

A.Update the information security policy

B.Establish a centralized security oversight function

C.Increase security awareness training frequency

D.Conduct a risk assessment for each department

AnswerB

Why this answer

The core issue is inconsistent control application across departments, which indicates a lack of governance and oversight rather than a policy or awareness deficiency. Establishing a centralized security oversight function directly addresses this by creating a single authority to enforce, monitor, and standardize control implementation, ensuring alignment with ISO 27001 requirements for management commitment and resource allocation (Clause 5.1 and 7.1). This corrective action provides the necessary organizational structure to drive consistent execution, which is the most effective long-term solution.

Exam trap

The trap here is that candidates confuse the symptom (inconsistent application) with the root cause (lack of governance), leading them to choose awareness training or policy updates, which are tactical fixes rather than strategic corrective actions.

Why the other options are wrong

A

Policy likely exists; issue is execution.

C

Training addresses knowledge, not enforcement.

D

Risk assessment would identify gaps but not fix consistency.

Practice this question →

77

Matchingmedium

Match each CISM domain to its focus area.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Establish and maintain a framework to align security with business objectives

Identify and manage information risk to achieve business objectives

Design and implement a security program to manage risk

Plan and manage the incident response process

Oversee and improve the security program's performance

Why these pairings

The CISM domains are: Governance (strategy alignment), Risk Management (risk identification and management), Program Development (design and implementation), and Incident Management (detection and response). Common confusions include swapping program development with governance and incident management with risk management.

Practice this question →

78

MCQmedium

An organization's information security program has been in place for two years. During a recent audit, several findings indicated that security controls are not consistently applied across business units. The CISO has been asked to improve the program. Which of the following should the CISO do FIRST?

A.Automate security compliance monitoring across all business units.

B.Update the information security policy to mandate compliance.

C.Conduct a risk assessment to identify gaps and prioritize remediation.

D.Implement additional security controls across all business units.

AnswerC

A risk assessment provides the basis for prioritizing controls and ensuring consistent application based on risk.

Why this answer

Conducting a risk assessment first (Option C) is the correct initial step because it systematically identifies where controls are failing or missing across business units, quantifies the associated risks, and prioritizes remediation based on business impact. Without this foundational analysis, any subsequent actions—such as automation, policy updates, or new controls—would lack direction and could waste resources on low-priority areas. This aligns with the CISM program lifecycle, where risk assessment drives all other program improvements.

Exam trap

ISACA often tests the principle that a risk assessment must precede any control implementation or policy change, tempting candidates to jump to automation or enforcement actions without first understanding the specific gaps.

How to eliminate wrong answers

Option A is wrong because automating compliance monitoring without first understanding which controls are inconsistently applied and why would simply automate the detection of known gaps without addressing root causes or prioritizing fixes. Option B is wrong because updating the policy to mandate compliance does not address the underlying issue of inconsistent application; it only reiterates requirements without providing a mechanism to identify or remediate the specific gaps. Option D is wrong because implementing additional controls across all business units without a prior risk assessment could introduce unnecessary complexity, increase costs, and fail to target the actual weaknesses, potentially creating new compliance gaps.

Practice this question →

79

MCQeasy

Which of the following is the most important factor for ensuring the long-term success of an information security program?

A.Deployment of advanced security technologies.

B.Comprehensive security awareness training.

C.Strong support from top management.

D.Regular penetration testing.

AnswerC

Why this answer

Strong support from top management is the most important factor because it ensures the information security program receives adequate budget, organizational authority, and strategic alignment with business objectives. Without executive sponsorship, even the best technical controls can be undermined by resource constraints, policy non-compliance, or lack of cross-departmental cooperation. The CISM framework emphasizes that governance and leadership commitment are foundational to sustaining a security program over time.

Exam trap

The trap here is that candidates often mistake operational effectiveness (e.g., training or testing) for strategic success, overlooking that without top management support, no security initiative can be sustained or enforced across the organization.

Why the other options are wrong

A

Technology is a tool, not the foundation; it requires management support to be effective.

B

Training is important but not the most critical factor; without management support, training may lack resources.

D

Penetration testing is a tactical activity; it does not ensure program success without executive backing.

Practice this question →

80

MCQhard

A security program lacks executive support. What is the best strategy to gain support?

A.Hire a security consultant to advise

B.Implement quick-win security improvements

C.Show risk quantification in business terms

D.Threaten regulatory fines for non-compliance

AnswerC

Quantified risk connects security to business impact, gaining executive attention.

Why this answer

C is correct because executive stakeholders prioritize business outcomes over technical details. By quantifying risks in financial terms (e.g., potential loss exposure, ROI of mitigation), the security manager aligns with the organization's strategic language, making the case for investment compelling and actionable. This approach directly addresses the root cause—lack of perceived business value—rather than relying on technical arguments or fear.

Exam trap

ISACA CISM tests the misconception that technical demonstrations or fear-based tactics (like regulatory threats) are more effective than business-aligned communication, when in reality, executives require risk expressed in financial terms to justify resource allocation.

How to eliminate wrong answers

Option A is wrong because hiring a consultant may provide expertise but does not inherently build executive buy-in; it can even be seen as an external cost without demonstrated internal alignment. Option B is wrong because quick-win improvements, while visible, often address low-impact risks and can create a false sense of security, failing to address the systemic lack of executive engagement. Option D is wrong because threatening regulatory fines introduces a negative, adversarial tone that can damage trust and collaboration; executives may view it as coercion rather than a partnership in risk management.

Practice this question →

81

Multi-Selectmedium

During an audit of the information security program, the auditor identifies that several critical systems are not included in the incident response plan. Which of the following are the MOST appropriate actions for the security manager to take? (Select TWO.)

Select 2 answers

A.Implement compensating controls on the excluded systems

B.Document the finding and accept the risk

C.Immediately remove the excluded systems from production

D.Update the incident response plan to include all critical systems

E.Escalate the issue to senior management for decision

AnswersD, E

Updating the plan directly closes the gap identified in the audit.

Why this answer

The incident response plan must be a living document that covers all critical systems to ensure a coordinated and effective response during a security incident. Excluding critical systems from the plan creates a blind spot that could lead to delayed containment, increased damage, or non-compliance with regulatory requirements. Updating the plan to include these systems is a direct corrective action that aligns with the CISM principle of maintaining an up-to-date incident response capability.

Exam trap

The CISM exam often tests the misconception that accepting risk or implementing compensating controls is a valid substitute for updating the incident response plan, when in fact the plan must be comprehensive and inclusive of all critical assets to be effective.

Practice this question →

82

MCQeasy

An organization is updating its information security program to align with business objectives. Which of the following is the PRIMARY benefit of integrating security risk management into the strategic planning process?

A.Aligns security investments with business priorities

B.Reduces the number of security incidents

C.Increases employee awareness of security policies

D.Ensures compliance with regulatory requirements

AnswerA

Integration ensures that security resources are allocated to risks most critical to business objectives.

Why this answer

Integrating security risk management into strategic planning ensures that security investments are directly tied to the organization's business priorities and risk appetite. This alignment allows for optimal allocation of resources to protect the most critical assets and processes, rather than spending on generic or low-priority controls. The primary benefit is that security becomes a business enabler, not a cost center, by focusing on what matters most to the organization's objectives.

Exam trap

The trap here is that candidates often confuse operational benefits (like incident reduction or compliance) with the strategic, business-alignment benefit that is the core purpose of integrating risk management into planning.

How to eliminate wrong answers

Option B is wrong because reducing the number of security incidents is an operational outcome of effective controls, not the primary strategic benefit of integrating risk management into planning; incidents can still occur despite alignment. Option C is wrong because increasing employee awareness is a tactical training or communication activity, not a strategic planning outcome, and it does not directly tie security to business goals. Option D is wrong because ensuring compliance with regulatory requirements is a baseline necessity and a tactical obligation, but it is not the primary benefit of strategic integration; compliance alone does not guarantee alignment with business objectives or optimized investment.

Practice this question →

83

MCQhard

After a data breach, the CISO reviews the security program. The breach exploited a known vulnerability in a legacy system that was deemed 'acceptable risk' two years ago. What should the CISO do to improve the program?

A.Establish a policy that legacy systems must be upgraded annually.

B.Disconnect the legacy system from the network immediately.

C.Implement a process for periodic reassessment of accepted risks.

D.Require immediate remediation of all legacy systems.

AnswerC

Ensures that risk acceptance stays current with evolving threats and business context.

Why this answer

Risk acceptance is not a one-time decision; it must be periodically reassessed to account for changes in the threat landscape, business context, or compensating controls. The breach exploited a known vulnerability that was accepted two years ago, indicating the risk environment has shifted (e.g., new exploit code, increased attacker interest). Implementing a periodic reassessment process ensures that accepted risks are re-evaluated against current threats and vulnerabilities, allowing the organization to either renew acceptance, apply mitigations, or retire the system.

Exam trap

The trap here is that candidates confuse risk acceptance with a permanent decision, failing to recognize that accepted risks must be periodically re-evaluated as part of a continuous risk management process.

How to eliminate wrong answers

Option A is wrong because a blanket annual upgrade policy is impractical for legacy systems that may lack vendor support or compatible upgrades, and it does not address the root cause of failing to reassess risk. Option B is wrong because immediately disconnecting the legacy system may disrupt critical business operations without a planned migration or compensating control, and it is a reactive rather than programmatic improvement. Option D is wrong because requiring immediate remediation of all legacy systems is often infeasible due to cost, operational dependencies, or lack of patches, and it ignores the risk management principle of prioritizing based on current risk appetite.

Practice this question →

84

MCQhard

A large financial institution is maturing its information security program and wants to move from a reactive to a proactive posture. Which of the following initiatives would best support this transition?

A.Deploy an automated compliance monitoring tool.

B.Implement a bug bounty program to uncover vulnerabilities.

C.Establish a threat intelligence unit that analyzes adversary tactics and shares indicators across the organization.

D.Increase the number of security operations center (SOC) analysts.

AnswerC

Threat intelligence provides actionable information to prevent attacks before they occur.

Why this answer

Establishing a threat intelligence unit directly supports a proactive posture by enabling the organization to anticipate and prepare for emerging threats based on adversary tactics, techniques, and procedures (TTPs). Unlike reactive measures, this initiative shifts focus from responding to incidents to preventing them by sharing actionable indicators across the enterprise, aligning with the CISM goal of maturing the security program toward proactive risk management.

Exam trap

The trap here is that candidates often confuse proactive security with reactive vulnerability management or detection improvements, mistakenly selecting bug bounty programs or SOC staffing increases because they seem forward-looking, when in fact only threat intelligence directly addresses the proactive shift by focusing on adversary behavior and prevention.

How to eliminate wrong answers

Option A is wrong because deploying an automated compliance monitoring tool is primarily a reactive or detective control that ensures adherence to existing policies and regulations, not a proactive initiative that anticipates or prevents threats. Option B is wrong because implementing a bug bounty program is a reactive vulnerability discovery mechanism that relies on external researchers to find flaws after deployment, rather than proactively analyzing adversary behavior to prevent attacks. Option D is wrong because increasing the number of SOC analysts enhances incident detection and response capabilities, which is still a reactive function focused on handling alerts and incidents as they occur, not on proactively identifying and mitigating threats before they materialize.

Practice this question →

85

MCQmedium

A company's security program includes a policy that all employees must use strong passwords and change them every 90 days. However, the recent internal audit shows that 60% of employees have passwords that do not meet the strength requirements. What is the most effective corrective action?

A.Conduct quarterly password audits with manual checks

B.Increase the frequency of security awareness training

C.Implement technical controls to enforce password strength

D.Extend the password change interval to 180 days

AnswerC

Technical enforcement (e.g., complexity rules) ensures compliance.

Why this answer

Implementing technical controls, such as password complexity requirements and automated enforcement, ensures compliance without relying solely on user behavior. Option A is wrong because manual audits detect non-compliance but do not prevent it. Option B is wrong because training alone is insufficient to enforce policy.

Option D is wrong because extending the password change interval does not address the root cause of weak passwords.

Practice this question →

86

MCQeasy

Which is a key component of an information security program?

A.Encryption technology

C.Antivirus software

D.Security policy

AnswerD

Policies establish the governance framework for the program.

Why this answer

A security policy is the foundational component of an information security program because it defines the organization's strategic direction, governance structure, and high-level principles for protecting information assets. Unlike specific technologies (encryption, firewalls, antivirus), the policy establishes the rules, roles, and responsibilities that drive the selection and implementation of all security controls. Without a policy, technical measures lack context, authority, and alignment with business objectives.

Exam trap

CISM often tests the distinction between governance (policy) and operational controls (technology), trapping candidates who confuse a tactical tool like a firewall or antivirus with the strategic program component that defines the security program's scope and authority.

How to eliminate wrong answers

Option A is wrong because encryption technology is a specific technical control that protects data confidentiality, but it is not a program-level component; it is a tool deployed under the policy's guidance. Option B is wrong because a firewall is a network security device that filters traffic based on rules, but it is an operational control, not a strategic program component. Option C is wrong because antivirus software is a host-based endpoint protection tool that detects and removes malware, but it is a tactical solution, not a governance element of the security program.

Practice this question →

87

MCQmedium

Based on the exhibit, what is the most significant security gap in this configuration?

A.The intrusion detection system is set to alert-only, so it cannot block attacks.

B.The vendor baseline is CIS Level 1, which may be too permissive.

C.The firewall allows inbound HTTPS from any source to web servers.

D.The database port 3306 is exposed to web servers without encryption.

AnswerA

Without prevention, attacks may succeed before manual response.

Why this answer

The intrusion detection system (IDS) is configured in alert-only mode, meaning it can only generate alerts and cannot take action to block or drop malicious traffic. This is a significant security gap because, unlike an intrusion prevention system (IPS), an IDS operates out-of-band and relies on manual intervention or separate security controls to stop attacks, leaving the network vulnerable during the response delay.

Exam trap

ISACA often tests the distinction between IDS (alert-only) and IPS (inline blocking) to catch candidates who assume any detection system can automatically stop attacks.

How to eliminate wrong answers

Option B is wrong because CIS Level 1 is a foundational baseline that focuses on essential security controls with minimal operational impact; it is not inherently 'too permissive' and is widely recommended as a starting point for hardening. Option C is wrong because allowing inbound HTTPS (TCP/443) from any source to web servers is a standard and necessary configuration for public-facing web services, provided the web servers are properly hardened and patched. Option D is wrong because exposing database port 3306 (MySQL) to web servers without encryption is a risk, but it is less significant than the IDS being unable to block attacks; database traffic can be encrypted with TLS or SSH tunneling, and the web server is a trusted internal component in many architectures.

Practice this question →

88

MCQmedium

A company is implementing a new security program. The CISO wants to ensure alignment with business objectives. Which approach is best?

A.Implement technical controls

B.Develop policies based on industry standards

C.Perform a risk assessment

D.Use the COBIT framework

AnswerD

COBIT is designed for governance and alignment of IT with business objectives.

Why this answer

The COBIT framework (Control Objectives for Information and Related Technologies) is specifically designed to bridge the gap between IT governance and business goals, providing a comprehensive set of controls and processes that align security program objectives with enterprise strategy. Unlike other options, COBIT directly addresses governance, risk management, and performance measurement in a way that ensures the security program supports business objectives rather than operating in isolation.

Exam trap

The trap here is that candidates often choose 'Perform a risk assessment' (Option C) because risk assessment is a foundational security activity, but the question asks for the 'best approach' to ensure alignment with business objectives, which requires a governance framework like COBIT that systematically links risk management to strategy, not just a one-time assessment.

How to eliminate wrong answers

Option A is wrong because implementing technical controls without first understanding business objectives and risk appetite can lead to misaligned security measures that either over-constrain operations or leave critical assets unprotected. Option B is wrong because developing policies based solely on industry standards (e.g., ISO 27001, NIST) may achieve compliance but does not inherently ensure alignment with the company's specific business goals, strategic priorities, or risk tolerance. Option C is wrong because performing a risk assessment is a critical input to alignment but is a tactical activity, not a governance framework; it identifies risks but does not provide the structured governance mechanisms to continuously align security program decisions with business objectives.

Practice this question →

89

MCQmedium

Which of the following best describes the primary purpose of a security program's governance framework?

A.To implement technical security controls

B.To provide oversight and alignment with business objectives

C.To conduct vulnerability assessments

D.To manage security incidents

AnswerB

Why this answer

The primary purpose of a security program's governance framework is to provide oversight and ensure that security activities are aligned with business objectives, risk appetite, and regulatory requirements. It establishes the policies, roles, and accountability structures that guide decision-making, rather than directly executing technical tasks. This alignment is critical for the program to be sustainable and supported by executive management.

Exam trap

The trap here is that candidates confuse the governance framework with the operational security program itself, mistakenly selecting a tactical activity (like implementing controls or managing incidents) instead of recognizing that governance is the strategic oversight layer that directs and constrains those activities.

Why the other options are wrong

A

Technical controls are operational, not governance.

C

Vulnerability assessments are part of ongoing operations.

D

Incident management is a process within the program.

Practice this question →

90

MCQhard

After a data breach, the CISO is updating the incident response plan. Which of the following is MOST critical to include?

A.Communication templates for stakeholders

B.Technical forensic procedures

C.Root cause analysis methodology

D.Legal hold instructions for data preservation

AnswerA

Effective communication is vital to control damage and meet legal obligations.

Why this answer

After a data breach, the incident response plan must prioritize clear, consistent communication to manage stakeholder expectations, regulatory notifications, and legal repercussions. Communication templates ensure that notifications to customers, regulators, and executives are accurate, timely, and compliant with breach notification laws (e.g., GDPR Article 33, state-specific 72-hour requirements). Without predefined templates, the response team risks delays or inconsistent messaging, which can exacerbate reputational damage and legal liability.

Exam trap

CISM often tests the distinction between strategic plan components (like communication templates) and tactical/operational details (like forensic procedures or root cause analysis), tempting candidates to choose a technically detailed option that is not the most critical for the plan's immediate post-breach effectiveness.

How to eliminate wrong answers

Option B is wrong because technical forensic procedures are operational details typically documented in a separate forensic playbook or standard operating procedure, not in the high-level incident response plan; the plan should reference the need for forensics but not include the step-by-step commands or tools. Option C is wrong because root cause analysis methodology is part of the post-incident review phase, not the immediate response phase; including it in the plan would clutter the critical response steps and delay time-sensitive actions. Option D is wrong because legal hold instructions are a legal process managed by the legal team and are typically covered in a data preservation policy or legal hold notice, not in the incident response plan itself; the plan should note the requirement to preserve evidence but not the detailed hold instructions.

Practice this question →

91

MCQhard

During a merger, the acquiring company's security program must integrate with the target company's program. What is the HIGHEST priority action?

A.Consolidate all security tools

B.Conduct a comprehensive risk assessment of the target

C.Merge the security teams into one reporting structure

D.Standardize security policies immediately

AnswerB

Risk assessment provides the basis for all integration decisions.

Why this answer

A comprehensive risk assessment of the target company's environment identifies integration risks and informs the integration plan. Option A is premature without understanding risks. Option C and D are tactical steps that should follow risk assessment.

Practice this question →

92

MCQeasy

Which of the following is the PRIMARY purpose of a security program's key performance indicators (KPIs)?

A.To ensure compliance with regulations

B.To assign accountability to individuals

C.To track the budget for security initiatives

D.To measure the effectiveness of security controls

AnswerD

KPIs provide quantifiable measures of control performance and program outcomes.

Why this answer

KPIs are designed to provide measurable evidence of how well the security program is achieving its objectives, specifically by quantifying the effectiveness of security controls. For example, a KPI like 'mean time to detect (MTTD)' directly measures the performance of detection controls, enabling data-driven decisions on control improvements. This aligns with the CISM focus on governance and performance management, not just compliance or budgeting.

Exam trap

The trap here is that candidates often confuse KPIs with compliance metrics or operational tasks, mistakenly thinking the primary purpose is to ensure regulatory adherence rather than to measure and improve the effectiveness of security controls.

How to eliminate wrong answers

Option A is wrong because compliance with regulations is a baseline requirement, not the primary purpose of KPIs; KPIs measure performance beyond mere compliance, such as control effectiveness. Option B is wrong because assigning accountability is a function of roles and responsibilities within the governance structure, not a direct purpose of KPIs, which are metrics, not assignment tools. Option C is wrong because tracking the budget for security initiatives is a financial management activity, typically measured by cost-related metrics (e.g., cost per incident), not the primary purpose of KPIs, which focus on operational and strategic effectiveness.

Practice this question →

93

MCQhard

A large financial institution is updating its information security program to align with a new regulatory framework. The program currently has a decentralized governance model. Which of the following is the MOST significant risk of maintaining a decentralized model?

A.Slower incident response

B.Inconsistent security levels across business units

C.Higher cost of compliance

D.Duplication of controls

AnswerB

Inconsistency can create security gaps and regulatory non-compliance.

Why this answer

Decentralized governance leads to inconsistent security levels across business units, which is a major regulatory and risk concern. Option A is possible but less critical. Option C may increase but is a consequence.

Option D may be slower but inconsistent security is more fundamental.

Practice this question →

94

MCQmedium

A security manager is designing a metrics dashboard for executive management. Which of the following metrics is MOST useful for demonstrating the value of the security program?

A.Percentage of budget spent on security

B.Number of security patches applied

C.Number of security policies created

D.Mean time to detect incidents

AnswerD

MTTD measures the program's effectiveness in identifying threats, demonstrating proactive value.

Why this answer

Mean time to detect (MTTD) incidents is a direct measure of the security program's effectiveness in identifying threats, which demonstrates its value by showing how quickly the organization can respond to potential breaches. Metrics like budget percentage (A), patches applied (B), or policies created (C) are operational or input-focused and do not reflect the program's outcome or business impact.

Practice this question →

95

MCQeasy

You are the CISO of a mid-sized manufacturing company. The company has grown rapidly through acquisitions, and each subsidiary has its own information security program. There is no centralized governance, and recent security incidents have occurred due to inconsistent policies. The board has asked you to create a unified information security program that balances flexibility with control. Each subsidiary has unique operational processes and varying levels of security maturity. You have limited budget and cannot replace all local security teams. Which approach should you take?

A.Immediately mandate compliance with a new enterprise-wide security policy.

B.Develop a minimum security standard (MSS) and a phased implementation roadmap based on risk.

C.Centralize all security operations and disband local teams.

D.Adopt the most mature subsidiary's program as the enterprise standard.

AnswerB

Provides baseline while allowing flexibility and phased adoption.

Why this answer

Correct answer is B because developing a minimum security standard (MSS) and a phased implementation roadmap based on risk allows each subsidiary to implement controls based on their unique risk profiles while ensuring a common baseline. This approach balances flexibility with control, respects varying maturity levels, and avoids disruption. Option A (immediate enterprise-wide policy) ignores diverse operational processes and may cause resistance.

Option C (centralize all security operations) is costly and impractical given the budget and local teams. Option D (adopt the most mature subsidiary's program) may not fit the context of less mature units.

Practice this question →

96

Multi-Selecteasy

Which THREE of the following are typically included in an information security program budget?

Select 3 answers

A.Incident response retainer

B.Security awareness training materials

C.Vulnerability assessment tools

D.Marketing and advertising campaigns

E.Employee salaries

AnswersA, B, C

External service cost part of program.

Why this answer

Options A, B, and C are correct as they are common line items in an information security program budget. Incident response retainers cover external support for security incidents, security awareness training materials are essential for educating employees, and vulnerability assessment tools are used to identify weaknesses. Option D (marketing) is not a security cost, and Option E (employee salaries) is typically part of operational budgets, not the specific security program budget.

Practice this question →

97

MCQhard

A multinational corporation is designing a global information security program. Which governance structure best ensures consistent security while allowing regional flexibility?

A.Outsource security governance to a managed security service provider (MSSP).

B.Fully centralized security governance with global standards enforced uniformly.

C.Federated governance: global standards with local implementation and oversight.

D.Fully decentralized security governance, each region independent.

AnswerC

Provides consistency while allowing adaptations for local regulations and culture.

Why this answer

Federated governance (Option C) is the correct choice because it establishes a global security framework with mandatory standards (e.g., ISO 27001 controls, encryption baselines like AES-256) while delegating implementation and oversight to regional units. This structure balances consistency with local legal requirements (e.g., GDPR in Europe, PIPL in China) and operational needs, avoiding the rigidity of full centralization or the fragmentation of full decentralization.

Exam trap

The trap here is that candidates often confuse 'federated governance' with 'decentralized governance' (Option D). In the context of ISACA CISM, federated governance enforces a mandatory global baseline (e.g., security standards, risk management framework) while permitting local adaptation to comply with regional laws and operational needs. Decentralized governance lacks any central authority or consistent standards, which is unacceptable for a global program.

How to eliminate wrong answers

Option A is wrong because outsourcing security governance to an MSSP abdicates strategic control and does not inherently provide a structure for consistent global standards with regional flexibility; MSSPs typically execute operational tasks (e.g., SIEM monitoring) rather than define governance frameworks. Option B is wrong because fully centralized governance with uniform enforcement ignores regional legal variations (e.g., data residency laws) and local risk appetites, leading to non-compliance or operational friction. Option D is wrong because fully decentralized governance creates inconsistent security postures, making it impossible to enforce global baselines (e.g., minimum encryption standards or incident response timelines) and increasing overall risk exposure.

Practice this question →

98

MCQhard

A multinational corporation is designing its information security program and must decide how to balance security with business agility. The company operates in highly regulated industries with varying legal requirements. Which of the following approaches BEST aligns with industry best practices for such an environment?

A.Implement the strictest regulatory requirements globally to ensure compliance everywhere.

B.Adopt a baseline of controls that meet the lowest common denominator of all regulations.

C.Develop a risk-based framework that allows for tailored controls based on local risk assessments.

D.Allow each business unit to define its own security controls based on local requirements.

AnswerC

A risk-based approach provides flexibility while ensuring that controls are appropriate for the risks.

Why this answer

A risk-based framework, such as ISO 27001 or NIST SP 800-53, allows the organization to establish a baseline of controls while tailoring them to address specific local legal requirements and risk profiles. This approach balances security and business agility by avoiding unnecessary overhead from overly strict global mandates while ensuring that critical regulatory obligations are met through localized risk assessments.

Exam trap

The trap here is that candidates often confuse 'strictest globally' (Option A) with 'best practice' due to a desire for simplicity, but CISM emphasizes that a risk-based approach is the only method that effectively balances compliance, security, and business agility in a multi-regulatory environment.

How to eliminate wrong answers

Option A is wrong because implementing the strictest regulatory requirements globally (e.g., GDPR's data protection rules applied in jurisdictions with less stringent laws) can introduce excessive operational friction, reduce business agility, and may conflict with local laws that permit different practices. Option B is wrong because adopting a baseline that meets the lowest common denominator of all regulations (e.g., only complying with the weakest privacy law) would leave the organization non-compliant with stricter regulations like GDPR or HIPAA, exposing it to significant legal and financial penalties. Option D is wrong because allowing each business unit to define its own security controls based on local requirements without a centralized governance framework leads to inconsistent security postures, gaps in coverage, and increased risk of regulatory non-compliance across the multinational enterprise.

Practice this question →

99

MCQmedium

A company is implementing an information security program. Which of the following is the PRIMARY reason to align the program with business objectives?

A.To ensure regulatory compliance

B.To improve technical controls

C.To reduce overall security costs

D.To gain management buy-in and support

AnswerD

Aligning with business objectives demonstrates value, securing management commitment.

Why this answer

Aligning the information security program with business objectives is primarily aimed at gaining management buy-in and support. When security initiatives are directly tied to business goals, management is more likely to understand their value and provide the necessary resources and authority. Regulatory compliance (A) is a requirement but not the primary reason; technical controls (B) are a means to an end; cost reduction (C) may be a secondary benefit but not the main driver.

Practice this question →

100

Multi-Selecthard

Which TWO of the following are key performance indicators (KPIs) that demonstrate the effectiveness of a security awareness program?

Select 2 answers

A.Percentage of employees who correctly identify a phishing email in simulations

B.Number of employees who report suspicious emails

C.Frequency of phishing simulation tests

D.Number of training sessions completed per quarter

E.Reduction in the number of security incidents caused by human error

AnswersA, E

Directly measures knowledge retention.

Why this answer

The percentage of employees who correctly identify a phishing email in simulations directly measures the behavioral outcome of the awareness program. A high detection rate indicates that employees are applying the training to recognize social engineering tactics, such as spoofed sender addresses or malicious links, which is a key performance indicator (KPI) for program effectiveness.

Exam trap

The trap here is that candidates often confuse activity metrics (e.g., number of training sessions or test frequency) with outcome-based KPIs, leading them to select options like C or D instead of focusing on behavioral change and incident reduction.

Practice this question →

101

MCQhard

You are the director of information security at a multinational corporation that operates in many countries with conflicting data privacy laws. The company's information security program includes a data classification policy and a data retention schedule, but there is no consistent method for handling cross-border data flows. Recently, a regulator in Country A fined the company for transferring personal data to Country B, which does not provide adequate protection. The legal department recommends implementing a binding corporate rules (BCR) approach, but the IT department says it would be too complex to implement across all systems. You must update the program to ensure compliance while minimizing operational impact. The board wants a solution that can be implemented within one year with reasonable cost. What should you do?

A.Implement binding corporate rules (BCR) across all entities as recommended by legal.

B.Rely on standard contractual clauses (SCCs) for all cross-border data flows.

C.Conduct a data mapping exercise and implement a data classification tagging system to automate controls on sensitive data flows.

D.Stop all cross-border data transfers until compliant mechanisms are fully implemented.

AnswerC

Provides visibility and enables automated enforcement, scalable within one year.

Why this answer

Correct answer is C because a data mapping exercise with automated tagging provides the foundation to enforce controls without manual effort. This approach allows the company to understand where sensitive data flows, apply appropriate protections (such as BCR or SCCs) only where needed, and minimize operational impact. Option A (implement BCR globally) is complex and time-consuming.

Option B (rely on standard contractual clauses for all flows) may not be sufficient for all jurisdictions and is administrative heavy. Option D (stop all cross-border transfers) is impractical and would harm business operations.

Practice this question →

102

MCQhard

An organization has implemented a balanced scorecard to measure the effectiveness of its information security program. Which of the following metrics would be MOST appropriate for the 'internal processes' perspective?

A.Percentage of systems compliant with baseline

B.Mean time to detect and respond to incidents

C.Percentage of users who completed security awareness training

D.Number of security incidents reported to management

AnswerB

Why this answer

The 'internal processes' perspective of a balanced scorecard focuses on the efficiency and effectiveness of the operational workflows that deliver the security program. Mean time to detect (MTTD) and mean time to respond (MTTR) directly measure the performance of the incident response process, which is a core internal process. This metric reflects how quickly the organization can identify and contain threats, making it the most appropriate choice for this perspective.

Exam trap

The trap here is that candidates confuse the 'internal processes' perspective with compliance or training metrics, mistakenly selecting A or C because they seem operational, but the balanced scorecard framework specifically ties 'internal processes' to the efficiency of core security workflows like incident response, not static compliance or awareness rates.

Why the other options are wrong

A

Compliance rate is more aligned with the governance or regulatory perspective, not internal processes.

C

This is a learning and growth metric, not internal processes.

D

This is more of an output metric, not specifically internal process efficiency.

Practice this question →

103

MCQeasy

An organization has just completed a risk assessment and identified several high-risk vulnerabilities. The security program manager needs to prioritize remediation efforts. Which of the following should be the primary factor in determining priority?

A.Regulatory requirements only

B.Likelihood of exploitation

C.Risk level (likelihood × impact)

D.Ease of remediation

AnswerC

Risk level gives a holistic prioritization.

Why this answer

Risk level, calculated as likelihood multiplied by impact, is the primary factor for prioritizing remediation because it quantifies the overall exposure to the organization. While regulatory requirements, likelihood alone, or ease of remediation are important considerations, they do not capture the combined effect of both probability and consequence, which is essential for effective risk management in an information security program.

Exam trap

The trap here is that candidates often choose 'Likelihood of exploitation' (Option B) because they confuse frequency with overall risk, ignoring that a high-likelihood but low-impact vulnerability (e.g., a minor misconfiguration) may be less critical than a low-likelihood but catastrophic one (e.g., a zero-day in a core database).

How to eliminate wrong answers

Option A is wrong because regulatory requirements are only one component of risk prioritization; focusing solely on them ignores vulnerabilities with high business impact that may not be regulated. Option B is wrong because likelihood of exploitation alone does not account for the severity of the impact, leading to misallocation of resources toward frequent but low-damage threats. Option D is wrong because ease of remediation prioritizes quick fixes over addressing the most critical risks, which can leave high-risk vulnerabilities unmitigated.

Practice this question →

104

MCQeasy

The security team is designing a security awareness program. Which topic should be prioritized FIRST?

A.Phishing recognition and reporting

B.Password creation and management

C.Incident reporting procedures

D.Data classification and handling

AnswerA

Phishing is a top threat; early training can prevent many incidents.

Why this answer

Phishing is a common initial attack vector, and training users to recognize it can immediately reduce risk. Option B is wrong password policies are important but often covered later. Option C is wrong incident reporting is critical but follows awareness of threats.

Option D is wrong data classification is more advanced.

Practice this question →

105

MCQeasy

Based on the exhibit, which of the following is true about traffic from the internet to the internal network 10.0.0.0/8?

A.Internet traffic to 10.0.0.5 is permitted only if from 192.168.1.0/24.

B.All traffic from the internet to the internal network is denied.

C.Traffic from the internet to 10.0.0.5 port 80 is permitted.

D.Traffic from 192.168.1.0/24 to 10.0.0.5 port 80 is permitted.

AnswerB

First rule denies all IP traffic to 10.0.0.0/8.

Why this answer

The exhibit shows an access control list (ACL) that denies all traffic from any source to the 10.0.0.0/8 network. Since the ACL is applied inbound on the internet-facing interface, any traffic originating from the internet destined for the internal network 10.0.0.0/8 is implicitly denied by the explicit deny statement. Therefore, option B is correct: all traffic from the internet to the internal network is denied.

Exam trap

The trap here is that candidates often misread the direction of the ACL permit statement (10.0.0.0/8 to 192.168.1.0/24) and incorrectly assume it permits traffic from the internet to the internal network, when in fact it only permits outbound traffic from the internal network to the specified destination.

How to eliminate wrong answers

Option A is wrong because the ACL does not permit any traffic from 192.168.1.0/24 to 10.0.0.5; the only permit statement is for traffic from 10.0.0.0/8 to 192.168.1.0/24, not the reverse. Option C is wrong because the ACL contains no permit statement for traffic from the internet to 10.0.0.5 port 80; the only permit is for traffic from 10.0.0.0/8 to 192.168.1.0/24, and the explicit deny blocks all other traffic. Option D is wrong because the permit statement allows traffic from 10.0.0.0/8 to 192.168.1.0/24, not from 192.168.1.0/24 to 10.0.0.5; the direction is reversed, and the ACL does not permit any inbound traffic to the 10.0.0.0/8 network.

Practice this question →

106

MCQeasy

Which metric is most indicative of security program effectiveness?

A.Security budget spent

B.Time to patch critical vulnerabilities

C.Number of security tools deployed

D.Number of security incidents

AnswerB

This metric shows how quickly the organization mitigates high-risk exposures.

Why this answer

Time to patch critical vulnerabilities directly reflects the organization's ability to reduce exposure to known exploits, which is a key outcome of an effective security program. Unlike input metrics (budget, tools) or lagging indicators (incident count), this metric measures the speed of a critical risk-reduction process, aligning with CISM's focus on program governance and risk management.

Exam trap

The trap here is that candidates confuse activity metrics (budget spent, tools deployed) with outcome-based metrics, failing to recognize that CISM emphasizes measuring the effectiveness of risk management processes, not the volume of resources or incidents.

How to eliminate wrong answers

Option A is wrong because security budget spent is an input metric that does not measure effectiveness; a program can spend heavily yet fail to reduce risk due to poor allocation or execution. Option C is wrong because the number of security tools deployed is a vanity metric; more tools can increase complexity and blind spots without improving security posture. Option D is wrong because the number of security incidents is a lagging indicator that can be influenced by detection capabilities; a low incident count may reflect poor detection rather than true program effectiveness.

Practice this question →

107

MCQmedium

An organization's security program has been in place for two years, but recently several security incidents occurred due to lack of user awareness. What is the most likely root cause?

A.The awareness program is not regularly updated or evaluated for effectiveness.

B.Lack of a security awareness program.

C.Insufficient budget for security tools.

D.Insufficient firewall rules.

AnswerA

Continuous improvement is needed; without updates, awareness decays.

Why this answer

The scenario states the security program has been in place for two years, yet incidents persist due to lack of user awareness. This indicates the awareness program exists but is not being regularly updated or evaluated for effectiveness, which is a common root cause in mature programs where content becomes stale and fails to address evolving threats like phishing or social engineering.

Exam trap

The trap here is that candidates assume any security program automatically includes an effective awareness component, but CISM emphasizes that programs must be evaluated and updated regularly; a static program is as ineffective as having none.

How to eliminate wrong answers

Option B is wrong because the scenario implies a security program exists, so the root cause is not the absence of an awareness program but its lack of updates or evaluation. Option C is wrong because insufficient budget for security tools does not directly address user awareness failures; the incidents are due to human behavior, not tooling gaps. Option D is wrong because insufficient firewall rules are a technical control issue unrelated to user awareness; firewall misconfigurations would not cause incidents stemming from a lack of user knowledge.

Practice this question →

108

Drag & Dropmedium

Arrange the steps in order for conducting a business impact analysis (BIA) in business continuity management.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

A BIA first identifies critical functions, then determines acceptable downtime, assesses impact, prioritizes recovery, and finally documents findings.

Practice this question →

109

MCQhard

You are the CISO of a mid-sized financial services firm that processes credit card transactions. The company has recently expanded its operations to include a mobile payment application that stores payment credentials in the cloud. The current information security program was designed primarily for the on-premises environment and has not been updated to address cloud-specific risks. The internal audit team has identified that the cloud service provider (CSP) does not have an independent third-party audit report (e.g., SOC 2) available for review. Additionally, the mobile app development team has been deploying code without formal security review, citing the need for rapid releases to compete in the market. The CEO has expressed concern about the potential for a data breach and has asked you to recommend immediate actions to strengthen the security program while minimizing business disruption. Which of the following should you recommend as the FIRST course of action?

A.Encrypt all data in transit and at rest using the organization's own encryption keys.

B.Implement compensating controls such as tokenization for all cardholder data stored in the cloud.

C.Conduct a detailed security assessment of the cloud service provider's controls and contractually require an annual SOC 2 Type II report.

D.Require the mobile app development team to undergo formal security training and implement a peer review process for all code deployments.

AnswerC

This directly addresses the gap in oversight and provides assurance over the CSP's controls.

Why this answer

The correct first course of action because the absence of an independent third-party audit report (e.g., SOC 2 Type II) means the organization has no verified assurance that the cloud service provider (CSP) has adequate security controls in place. As CISO, you must immediately assess the CSP's security posture and contractually mandate a SOC 2 Type II report to gain visibility into the effectiveness of the CSP's controls over time, which is foundational before implementing any compensating technical controls. This aligns with the CISM domain of Information Security Program governance, where vendor risk management and due diligence are critical first steps when expanding into cloud environments.

Exam trap

The trap here is that candidates often jump to implementing a technical control (like encryption or tokenization) as the immediate fix, but the CISM exam emphasizes that governance and vendor risk management—specifically obtaining independent assurance of the CSP's controls—must come first before deploying compensating technical measures.

How to eliminate wrong answers

Option A is wrong because encrypting data with the organization's own keys (client-side encryption) does not address the root cause—lack of visibility into the CSP's overall security posture; encryption is a compensating control that should follow a proper vendor risk assessment. Option B is wrong because implementing tokenization for cardholder data is a tactical data-centric control that does not resolve the immediate governance gap of having no independent audit report on the CSP; tokenization should be considered after contractual assurance is established. Option D is wrong because requiring security training and peer review for the mobile app development team, while beneficial, does not address the most critical risk—the unverified cloud provider—and would not be the first priority when the CSP's controls are completely unknown.

Practice this question →

110

MCQhard

Refer to the exhibit. An audit reveals that 20% of privileged accounts were approved by the same manager without secondary review. Which control deficiency is MOST relevant to this finding?

A.Segregation of duties

B.Access review frequency

C.Provisioning delay

D.Audit log retention

AnswerA

One person approving without oversight is a segregation of duties deficiency.

Why this answer

The finding that 20% of privileged accounts were approved by the same manager without secondary review directly violates the principle of segregation of duties (SoD). In privileged access management (PAM), SoD requires that the approval of privileged account access be performed by a different individual than the requester or the manager who supervises the requester, to prevent a single point of failure and reduce the risk of unauthorized access or fraud. Without a secondary review, a single manager could approve accounts for themselves or their subordinates without independent oversight, undermining the control objective of preventing conflicts of interest.

Exam trap

The CISM exam often tests the distinction between a process control (like requiring a second approver) and a detective control (like access reviews or log retention), and candidates mistakenly choose access review frequency because they think 'review' solves the approval gap, but reviews happen after the fact and cannot prevent the initial improper approval.

How to eliminate wrong answers

Option B (Access review frequency) is wrong because the issue is not about how often access reviews occur (e.g., quarterly or annually), but about the lack of a secondary approval during the initial provisioning process; even frequent reviews would not catch a single manager approving their own accounts without oversight. Option C (Provisioning delay) is wrong because the finding does not relate to the timeliness of account creation or modification; a delay in provisioning does not address the control deficiency of a single manager approving privileged accounts without a second reviewer. Option D (Audit log retention) is wrong because the problem is not about how long logs are kept (e.g., 90 days vs. 1 year), but about the absence of a mandatory secondary approval step; even with perfect log retention, the control deficiency of a single approver remains unaddressed.

Practice this question →

111

MCQhard

A company's security program includes a policy that prohibits the use of personal devices for work. However, the CISO discovers that several executives are using personal tablets to access corporate email. What is the most appropriate action for the CISO to take?

A.Block all personal devices from the network

B.Continue monitoring but take no action

C.Update the policy to allow personal devices under strict controls

D.Discipline the executives for policy violation

AnswerC

Balances security with usability through mobile device management.

Why this answer

The CISO must align security controls with business reality. Rather than enforcing an unworkable policy that executives are already circumventing, the CISO should update the policy to incorporate a mobile device management (MDM) solution that enforces device encryption, remote wipe, and conditional access via Azure AD or similar identity provider. This approach reduces risk by bringing personal devices under formal governance while maintaining executive productivity.

Exam trap

The trap here is that candidates often choose Option D (discipline) because they confuse policy enforcement with security governance, failing to recognize that the CISO's primary role is to manage risk through adaptive controls, not to punish users for using technology that the policy failed to anticipate.

How to eliminate wrong answers

Option A is wrong because blocking all personal devices from the network is technically infeasible without a network access control (NAC) solution that can fingerprint every device, and it would disrupt legitimate business operations without addressing the root cause of policy non-compliance. Option B is wrong because continued monitoring without action violates the principle of risk acceptance—the CISO has a fiduciary duty to remediate known risks, and ignoring the gap exposes the company to data breach liability under regulations like GDPR or HIPAA. Option D is wrong because disciplining executives ignores the underlying business need for mobile access and fails to address the technical gap; it may also create cultural resistance without actually securing the devices.

Practice this question →

112

MCQhard

After a major security incident, the board of directors requests a review of the information security program. Which of the following metrics would be MOST useful to demonstrate the effectiveness of the program over the past year?

A.Percentage of employees who completed security awareness training

B.Number of security incidents detected and contained within defined SLAs

C.Total cost of security investments compared to industry benchmarks

D.Number of vulnerabilities identified in the latest penetration test

AnswerB

Why this answer

The number of incidents detected and contained within defined SLAs directly measures the program's ability to detect and respond to threats, which is a key indicator of operational effectiveness. Other metrics may be useful but do not directly measure the program's performance in protecting the organization.

Exam trap

Candidates often choose 'Percentage of employees completing security training' because training is a common control, but it doesn't measure actual incident response effectiveness.

Why the other options are wrong

A

Training completion is a leading indicator but does not measure program effectiveness in handling incidents.

C

Cost comparison does not indicate how well the program performed.

D

Vulnerability counts are point-in-time and not a comprehensive measure of program effectiveness.

Practice this question →

113

Matchingmedium

Match each security framework to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Specify requirements for an ISMS

Provide risk-based guidance for critical infrastructure

Govern and manage enterprise IT

Align IT services with business needs

Protect cardholder data

Why these pairings

COBIT is for IT governance, ISO 27001 for ISMS, and NIST CSF for cybersecurity risk management. The distractors swap definitions between COBIT and ISO 27001.

Practice this question →

114

MCQmedium

A security manager is tasked with building a business case for a new security program. Which metric is most persuasive to senior management?

A.Number of security incidents detected per month.

B.Estimated financial exposure from unmitigated risks.

C.Percentage of systems patched within 30 days.

D.Hours spent on security training.

AnswerB

Quantified risk exposure resonates with leadership.

Why this answer

Senior management is primarily concerned with financial impact and risk exposure. Estimated financial exposure from unmitigated risks directly translates technical vulnerabilities into monetary terms, enabling informed budget decisions. This aligns with the CISM focus on aligning security programs with business objectives.

Exam trap

ISACA CISM often tests the distinction between operational/technical metrics and business/risk metrics, trapping candidates who confuse activity-based measures (e.g., training hours) with outcome-based financial justification.

How to eliminate wrong answers

Option A is wrong because the number of incidents detected per month is an operational metric that does not convey financial risk or business impact; it can even be misleading if detection capabilities improve. Option C is wrong because patch compliance percentage is a tactical, IT-focused metric that does not quantify residual risk or financial exposure to the organization. Option D is wrong because hours spent on training is an activity metric, not an outcome metric; it measures effort rather than risk reduction or financial benefit.

Practice this question →

115

Multi-Selectmedium

Which of the following are essential components of an information security program governance framework? (Select TWO.)

Select 2 answers

A.A security steering committee with executive representation.

B.A formal risk appetite statement.

C.Documented information security policies and procedures.

D.An incident response plan.

AnswersA, C

Why this answer

A security steering committee with executive representation is essential because it provides strategic oversight, aligns security initiatives with business objectives, and ensures resource allocation and governance accountability. This committee typically includes C-level executives who approve security policies, review risk posture, and enforce compliance across the organization.

Exam trap

ISACA often tests the distinction between governance components (steering committee, policies) and operational or risk management artifacts (risk appetite statement, incident response plan), leading candidates to select familiar but incorrect operational items.

Why the other options are wrong

B

Risk appetite is part of risk management, not governance framework per se.

D

Operational plan, not a governance component.

Practice this question →

116

MCQhard

During a security program review, the auditor finds that incident response procedures have not been tested in over two years. What is the MOST significant risk arising from this finding?

A.Non-compliance with regulatory requirements

B.Higher financial costs due to inefficiencies

C.Increased recovery time after an incident

D.Ineffective response leading to greater damage during an incident

AnswerD

Without testing, the plan may not work, causing extended damage.

Why this answer

Untested incident response procedures may be ineffective or outdated, leading to a failed response during an actual incident, which can result in greater damage. This is the most significant risk because it directly impacts the organization's ability to contain and mitigate incidents. Option A (non-compliance) is possible but not the most significant risk.

Option B (higher costs) is a secondary consequence. Option C (increased recovery time) is a symptom of ineffective response but not as severe as the potential for greater damage.

Practice this question →

117

MCQmedium

An information security manager is developing a program metric to measure the effectiveness of the security awareness training. Which metric is most appropriate?

A.Percentage of employees who completed the training.

B.Number of security incidents caused by human error.

C.Average score on post-training tests.

D.Time taken to complete the training modules.

AnswerB

Why this answer

The most appropriate metric for measuring the effectiveness of security awareness training is the reduction in security incidents caused by human error. While completion rates and test scores measure participation and knowledge retention, they do not directly indicate whether the training has changed employee behavior and reduced real-world risk. A decrease in human-error-related incidents provides direct evidence that the training is effectively influencing secure practices.

Exam trap

The trap here is that candidates often confuse training completion or test scores with effectiveness, but CISM emphasizes outcome-based metrics that demonstrate actual risk reduction, not just activity completion.

Why the other options are wrong

A

Completion does not measure learning or behavior change.

C

Test scores measure knowledge retention, but not application in real situations.

D

Time is irrelevant to effectiveness; fast completion may indicate skipping content.

Practice this question →

118

Multi-Selectmedium

An information security manager is designing a security program for a multinational organization. Which factors should be considered when developing the program governance structure? (Select 3)

Select 3 answers

A.Legal and regulatory requirements across jurisdictions

B.Current technology architecture

C.Business strategy and objectives

D.Organizational culture and risk appetite

AnswersA, C, D

Why this answer

Legal and regulatory requirements across jurisdictions are foundational because a multinational organization must comply with diverse data protection laws (e.g., GDPR in Europe, CCPA in California, LGPD in Brazil) that directly dictate security controls, breach notification timelines, and data residency rules. The governance structure must incorporate these obligations to avoid legal penalties and ensure consistent policy enforcement across borders.

Exam trap

ISACA often tests the distinction between governance (strategy, culture, compliance) and management (architecture, tools, implementation), leading candidates to mistakenly select technology architecture as a governance factor.

Why the other options are wrong

B

Technology architecture is an operational concern, not governance.

Practice this question →

119

MCQmedium

A company is designing its information security program and wants to ensure that it meets regulatory requirements across multiple jurisdictions. Which of the following approaches is most appropriate?

A.Adopt ISO 27001 as the sole framework for the program.

B.Implement a regulatory compliance framework that maps controls to applicable laws and standards.

C.Comply with the strictest regulation and ignore others.

D.Engage external legal counsel to review policies quarterly.

AnswerB

Maps controls to regulations, ensuring comprehensive and consistent compliance.

Why this answer

A regulatory compliance framework that maps controls to applicable laws and standards provides a structured, auditable method to address multiple, sometimes conflicting, jurisdictional requirements. This approach ensures that each control is explicitly linked to a specific legal or regulatory obligation, facilitating compliance verification and reducing the risk of oversight. It is the most comprehensive and adaptable method for a multi-jurisdictional environment, as it allows the organization to manage overlapping and unique requirements without relying on a single standard or external review alone.

Exam trap

A common mistake in CISM is assuming that adopting a single, comprehensive standard like ISO 27001 is sufficient for multi-jurisdictional compliance, when in reality it must be supplemented with a mapping framework to address specific legal requirements.

How to eliminate wrong answers

Option A is wrong because adopting ISO 27001 as the sole framework does not guarantee compliance with specific jurisdictional laws (e.g., GDPR, HIPAA, PCI DSS) that have unique requirements beyond the general controls of ISO 27001; it provides a management system but not a direct mapping to each regulation. Option C is wrong because complying with the strictest regulation and ignoring others can lead to non-compliance with laws that have different or additional requirements not covered by the strictest one, such as data localization rules in one jurisdiction that are not addressed by another's stricter privacy law. Option D is wrong because engaging external legal counsel to review policies quarterly is a reactive, periodic check that does not provide a continuous, integrated framework for managing and demonstrating compliance across multiple jurisdictions; it lacks the proactive control mapping and ongoing governance needed for a comprehensive program.

Practice this question →

120

MCQmedium

An organization's information security program is based on a risk management framework. Which of the following BEST describes the role of the information security manager in this context?

A.Setting the organization's risk appetite

B.Designing and managing the security program

C.Owning all information security risks

D.Conducting internal audits of controls

AnswerB

Why this answer

The information security manager is responsible for designing and managing the security program based on the risk management framework. This includes translating risk assessment results into security controls, policies, and procedures, and ensuring the program aligns with the organization's risk posture. The manager does not set risk appetite (that is a board-level decision) nor own all risks (risk owners are business process owners).

Exam trap

The trap here is confusing the information security manager's operational role with strategic or assurance roles, leading candidates to select 'setting risk appetite' or 'conducting internal audits' instead of the correct program management function.

Why the other options are wrong

A

Risk appetite is set by the board of directors, not the security manager.

C

Risk ownership resides with business process owners; the security manager facilitates risk management.

D

Internal audits are performed by audit function, not security management.

Practice this question →

121

MCQhard

A multinational organization needs to comply with GDPR and CCPA. What is the best approach for the information security program?

A.Implement a unified privacy framework covering all regulations

B.Adopt the most restrictive requirements from any regulation

C.Outsource compliance to a third-party provider

D.Create separate security programs for each region

AnswerA

A unified framework ensures compliance while maintaining efficiency.

Why this answer

A unified privacy framework (e.g., ISO/IEC 27701 or NIST Privacy Framework) allows the organization to map overlapping requirements from GDPR and CCPA into a single set of controls, reducing duplication and ensuring consistent data protection across jurisdictions. This approach leverages common principles like data minimization, consent management, and breach notification, which are foundational to both regulations, while accommodating specific differences such as GDPR's 72-hour breach notification versus CCPA's broader definition of personal information.

Exam trap

ISACA often tests the misconception that 'most restrictive' is always best, but the trap here is that regulatory compliance requires a tailored, risk-based approach rather than a blanket adoption of the strictest rule, which can lead to inefficiency and non-compliance with specific regional obligations.

How to eliminate wrong answers

Option B is wrong because adopting the most restrictive requirements from any regulation (e.g., GDPR's stricter consent rules) may impose unnecessary operational overhead and cost without addressing unique CCPA obligations like the right to opt out of data sales, leading to compliance gaps. Option C is wrong because outsourcing compliance to a third-party provider transfers accountability but not liability; the organization remains legally responsible under both GDPR (Article 28) and CCPA (Section 1798.140) for data processing activities, and a third party cannot fully manage internal security program governance. Option D is wrong because creating separate security programs for each region introduces fragmentation, increasing complexity and risk of inconsistent data handling, which contradicts the principle of a unified information security program and may violate GDPR's requirement for a single Data Protection Officer (DPO) overseeing cross-border operations.

Practice this question →

122

MCQeasy

Which of the following best describes the primary purpose of an information security program?

A.To ensure 100% system availability

B.To eliminate all security risks

C.To manage security risks in alignment with business strategy

D.To achieve compliance with all applicable regulations

AnswerC

Program ensures security supports business objectives.

Why this answer

The primary purpose of an information security program is to manage security risks in alignment with business strategy, ensuring that security controls and investments support organizational objectives while balancing risk acceptance, mitigation, transfer, and avoidance. This aligns with the CISM framework, which emphasizes that security is a business enabler, not a technical silo. A program that fails to align with business strategy may over-prioritize technical controls, leading to wasted resources or misaligned risk tolerance levels.

Exam trap

A common trap in the CISM exam is the misconception that compliance equals security, leading candidates to choose Option D, but the CISM framework emphasizes that compliance is a baseline, not a comprehensive risk management strategy.

How to eliminate wrong answers

Option A is wrong because 100% system availability is an operational goal, not a security program objective; security programs focus on confidentiality, integrity, and availability (CIA triad) but recognize that 100% availability is neither feasible nor cost-effective, as it would require eliminating all planned maintenance and redundancy trade-offs. Option B is wrong because eliminating all security risks is impossible; the goal is to reduce risks to an acceptable level defined by the organization's risk appetite, as residual risk always remains. Option D is wrong because compliance is a subset of risk management, not the primary purpose; a security program must address risks beyond regulatory requirements, such as emerging threats or business-specific vulnerabilities not covered by regulations.

Practice this question →

123

MCQeasy

A small business owner wants to establish an information security program but has limited budget and staff. Which of the following frameworks would be most appropriate to guide the program?

A.ISO/IEC 27001

B.NIST Cybersecurity Framework

C.COBIT 2019

D.PCI DSS

AnswerB

Flexible and adaptable, with tiers for maturity.

Why this answer

The NIST Cybersecurity Framework (CSF) is the most appropriate choice because it is designed to be flexible and scalable, allowing small businesses with limited budget and staff to implement a risk-based information security program using a prioritized, outcome-driven approach. Unlike ISO/IEC 27001, which requires formal certification and extensive documentation, or COBIT 2019, which is geared toward enterprise IT governance, the NIST CSF provides a customizable set of core functions (Identify, Protect, Detect, Respond, Recover) that can be adopted incrementally without heavy resource investment.

Exam trap

The trap here is that candidates often choose ISO/IEC 27001 because it is the most well-known security standard, but they overlook its heavy documentation and certification requirements, which are impractical for a small business with limited budget and staff.

How to eliminate wrong answers

Option A is wrong because ISO/IEC 27001 is a formal management system standard that demands comprehensive documentation, internal audits, and certification processes, which are typically too resource-intensive for a small business with limited budget and staff. Option C is wrong because COBIT 2019 is a governance framework focused on aligning IT with business objectives and managing enterprise IT processes, not a lightweight security program guide suitable for a small business. Option D is wrong because PCI DSS is a specific compliance standard for organizations that handle credit card data, not a general information security framework, and it imposes rigid requirements that may not align with the business's broader security needs.

Practice this question →

124

MCQhard

A financial institution's security program must comply with PCI DSS, GDPR, and SOX. Which approach is MOST efficient to manage overlapping compliance requirements?

A.Develop three separate control sets for each regulation

B.Focus only on the requirements of the strictest regulation

C.Implement a single control set mapped to all applicable regulations

D.Engage external auditors to manage compliance for each regulation

AnswerC

A unified control framework eliminates redundancy and streamlines compliance.

Why this answer

Implementing a single control set mapped to all applicable regulations (PCI DSS, GDPR, SOX) leverages common controls to satisfy overlapping requirements efficiently. This approach reduces duplication of effort, simplifies audit preparation, and ensures consistent security posture across the organization. For example, access control requirements under PCI DSS 7.1, GDPR Article 32, and SOX Section 404 can be addressed by a unified identity and access management (IAM) policy with role-based access controls (RBAC) and logging.

Exam trap

The trap here is that candidates may think focusing on the strictest regulation (Option B) is efficient, but they overlook that each regulation has unique non-overlapping requirements (e.g., GDPR's breach notification timeline vs. PCI DSS's quarterly scans) that must be addressed separately.

How to eliminate wrong answers

Option A is wrong because developing three separate control sets for each regulation leads to redundant work, increased complexity, and potential conflicts between controls, wasting resources without improving security. Option B is wrong because focusing only on the strictest regulation (e.g., PCI DSS) may miss unique requirements from other regulations (e.g., GDPR's data subject rights or SOX's financial reporting controls), causing non-compliance. Option D is wrong because engaging external auditors to manage compliance for each regulation does not address the underlying need for an efficient internal control framework; it outsources responsibility without resolving overlapping requirements and can be cost-prohibitive.

Practice this question →

125

MCQhard

An organization has implemented a data classification policy but notices that employees often mark documents as 'internal use only' even when they contain personally identifiable information (PII). Which of the following is the most effective corrective action for the information security program?

A.Revise the data classification policy to simplify categories.

B.Conduct random audits and reprimand employees who misclassify data.

C.Increase the frequency of data classification training for all employees.

D.Deploy a data loss prevention (DLP) system that automatically classifies documents based on content inspection.

AnswerD

Automates classification, reducing user error and ensuring consistent labeling.

Why this answer

Deploying a data loss prevention (DLP) system that automatically classifies documents based on content inspection directly addresses the root cause of misclassification by removing reliance on user judgment. Option A (policy revision) alone does not enforce compliance. Option B (audits and reprimands) is punitive and may not change behavior.

Option C (training) can help but is less effective than automation for consistent classification.

Practice this question →

126

MCQhard

During a review of the information security program, the security manager discovers that the program's objectives are not aligned with the organization's strategic business goals. What is the best course of action?

A.Justify the existing objectives to management to demonstrate their value.

B.Revise the program objectives to align with business goals.

C.Implement additional security controls to compensate for the misalignment.

D.Escalate the issue to the board of directors without changes.

AnswerB

Why this answer

The CISM framework emphasizes that an information security program must be directly aligned with the organization's strategic business goals to ensure that security investments support business objectives rather than hinder them. Revising the program objectives to align with business goals (Option B) is the correct course of action because it ensures that security controls, risk appetite, and resource allocation are driven by business needs, not isolated technical requirements. This alignment is a core principle of the Information Security Program domain, as misalignment can lead to wasted resources, reduced executive support, and increased business risk.

Exam trap

ISACA often tests the misconception that adding more controls or escalating issues can substitute for strategic alignment, but the CISM exam specifically requires candidates to recognize that program objectives must be revised to match business goals before any other action is taken.

Why the other options are wrong

A

This does not address the misalignment; the objectives should be revised to match business goals.

C

Adding controls does not fix the strategic misalignment.

D

Escalation is not the first step; the manager should propose a solution.

Practice this question →

127

Multi-Selecteasy

Which THREE are components of the Plan phase in a security program lifecycle (e.g., ISO 27001 PDCA)?

Select 3 answers

A.Risk assessment

B.Strategy alignment with business objectives

C.Monitoring and review

D.Implementation of controls

E.Policy development

AnswersA, B, E

Risk assessment is foundational to planning.

Why this answer

Risk assessment is a core component of the Plan phase in the ISO 27001 PDCA (Plan-Do-Check-Act) security program lifecycle. During this phase, the organization identifies, analyzes, and evaluates information security risks to establish the context, scope, and risk treatment criteria that will guide the selection of controls and objectives. Without a formal risk assessment, the subsequent phases lack a risk-based foundation, making the program reactive rather than proactive.

Exam trap

The trap here is that candidates often confuse the Plan phase with the Do phase, incorrectly selecting 'Implementation of controls' (Option D) because they assume planning includes deploying controls, whereas in the PDCA model, implementation is strictly a Do-phase activity.

Practice this question →

128

Multi-Selectmedium

Which TWO of the following are key components of an information security program governance structure? (Select TWO.)

Select 2 answers

A.A steering committee that includes senior management and business unit leaders.

B.An incident response plan that defines roles and procedures.

C.Regular reporting to the board of directors on security metrics and risks.

D.A vulnerability scanning schedule and remediation SLAs.

E.A firewall policy that specifies allowed and denied traffic.

AnswersA, C

A steering committee ensures alignment with business strategy and provides oversight.

Why this answer

A steering committee that includes senior management and business unit leaders is a key component of an information security program governance structure because it provides strategic oversight, aligns security initiatives with business objectives, and ensures accountability at the executive level. This committee typically authorizes policies, reviews risk appetite, and approves resource allocation, which are essential for effective governance.

Exam trap

ISACA often tests the distinction between governance (strategic oversight and decision-making) and management (operational execution and controls), so candidates mistakenly select operational items like incident response plans or vulnerability schedules as governance components.

Practice this question →

← PreviousPage 2 of 2 · 128 questions total

Ready to test yourself?

Try a timed practice session using only Cism Security Program questions.

Start 20-question session