CISM Information Security Program Practice Question
Which TWO are essential elements of an information security program?
⚠ Common exam trap
ISACA often tests the distinction between program-level elements (like processes and plans) and operational tools or controls (like firewalls or scanners), leading candidates to mistakenly select technical solutions as essential program components.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security awareness training
Security awareness training is an essential element of an information security program because it directly addresses the human factor, which is often the weakest link in security. A formal, ongoing training program ensures that employees understand policies, recognize threats like phishing, and follow secure behaviors, thereby reducing risk. Without it, technical controls alone cannot prevent social engineering or user errors, making it a foundational component of any security program.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Vulnerability scanning tools
Why it's wrong here
Tools are supporting technologies, not program elements.
- ✗
Risk management process
Why it's wrong here
While important, this question focuses on other elements; risk management is often considered part of governance.
- ✗
Network firewall
Why it's wrong here
A firewall is a control, not a program element.
- ✓
Security awareness training
Why this is correct
Education is a key element of a security program.
- ✓
Incident response plan
Why this is correct
A defined IR plan is essential for program completeness.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.