hardMultiple SelectObjective-mapped
CISM Practice Question: Which THREE of the following are essential roles…
Which THREE of the following are essential roles in an effective information security governance structure? (Choose three.)
⚠ Common exam trap
Many exam-takers confuse operational or technical roles (help desk manager, network administrator) with governance roles, failing to recognize that governance requires strategic oversight and accountability, not hands-on technical execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Board of directors.
The board of directors is essential because it holds ultimate accountability for the organization's risk posture and must approve the information security strategy, policies, and resource allocation. Without board-level oversight, security governance lacks the authority to enforce compliance and align security objectives with business goals. This aligns with the CISM framework's emphasis on top-down governance, where the board provides strategic direction and ensures adequate funding for security initiatives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Help desk manager.
Why it's wrong here
Operational support role, not governance.
- ✓
Board of directors.
Why this is correct
Provides strategic oversight and direction.
- ✗
Network administrator.
Why it's wrong here
Technical role, not part of governance structure.
- ✓
Security steering committee.
Why this is correct
Provides cross-functional governance oversight.
- ✓
Chief information security officer (CISO).
Why this is correct
Leads the security program and reports to governance.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.