CISM

Which of the following is the PRIMARY purpose of an information security governance framework?

• ATo ensure compliance with all regulatory requirements
• BTo align information security with business objectives and strategy
• CTo establish technical security controls across all systems
• DTo prevent all security breaches and cyber attacks

A newly appointed CISO is developing an information security strategy. Which of the following should be the FIRST step?

• ASelecting appropriate security technologies and tools
• BIdentifying and understanding the organization's business objectives
• CConducting a comprehensive vulnerability assessment
• DDeveloping detailed security policies and procedures

Which of the following is the MOST effective approach for ensuring that information security policies remain relevant and effective?

• AReviewing policies annually regardless of changes in the environment
• BEstablishing a policy review cycle triggered by business or regulatory changes
• CUpdating policies only after a security incident occurs
• DHaving legal counsel review all policies once every three years

In a large multinational organization, which of the following is the PRIMARY responsibility of the board of directors regarding information security?

• AApproving all technical security controls
• BOverseeing the management of information security risks at the strategic level
• CConducting regular penetration testing
• DDeveloping and implementing security awareness training

Which of the following security metrics would be MOST valuable for reporting to senior management?

• ANumber of firewall rules implemented
• BReduction in business risk achieved through security investments
• CNumber of antivirus signatures updated daily
• DPercentage of servers patched within 30 days

An organization operates in multiple jurisdictions with varying data protection regulations. What is the MOST effective approach to ensure compliance?

• AImplementing the most restrictive requirements across all jurisdictions
• BEstablishing a baseline framework that meets common requirements and adding jurisdiction-…
• CCreating entirely separate security programs for each jurisdiction
• DFocusing only on the jurisdiction with the strictest penalties

A cloud service provider is being evaluated for handling sensitive customer data. Which of the following is the MOST important governance consideration?

• AThe provider's brand recognition in the market
• BClearly defined roles and responsibilities for security between the organization and prov…
• CThe provider's geographic location
• DThe lowest cost option available

Which of the following BEST describes the relationship between information security governance and risk management?

• AGovernance and risk management are separate functions with no overlap
• BGovernance provides the framework and oversight for risk management activities
• CRisk management is a subset of technical security operations
• DGovernance focuses only on compliance while risk management handles all threats

An organization is integrating a newly acquired subsidiary. What should be the FIRST security governance activity?

• AImmediately implementing the parent company's security controls
• BAssessing the subsidiary's current security posture and aligning it with business integra…
• CTerminating all existing security staff at the subsidiary
• DRequiring the subsidiary to achieve compliance within 30 days

Which of the following is the PRIMARY objective of an information risk assessment?

• ATo eliminate all identified risks
• BTo identify and evaluate risks to support informed decision-making
• CTo ensure compliance with industry standards
• DTo justify the purchase of security tools

A risk assessment has identified a high likelihood of data breach due to outdated systems. The cost to upgrade would exceed the potential loss. What is the MOST appropriate action?

• AAccept the risk and document the decision
• BTransfer the risk through cyber insurance
• CImplement compensating controls to reduce the risk
• DIgnore the risk since upgrading is not cost-effective

Which of the following is the MOST important factor when determining risk ownership?

• AThe technical expertise of potential risk owners
• BThe ability to influence and control the risk
• CThe seniority level of the individual in the organization
• DThe length of time the individual has been with the company

An organization needs to prioritize remediation efforts across multiple vulnerabilities. Which approach is MOST appropriate?

• AAddress vulnerabilities based on CVSS scores alone
• BConsider both the technical severity and the business context of affected assets
• CFix vulnerabilities in the order they were discovered
• DFocus only on vulnerabilities that have known exploits

Which of the following is the PRIMARY purpose of maintaining an information asset inventory?

• ATo track hardware for depreciation purposes
• BTo understand what needs to be protected and prioritize security efforts
• CTo ensure software licenses are current
• DTo document network topology

A risk register should be reviewed and updated at what frequency?

• AOnly during annual audits
• BContinuously as risks change or new information becomes available
• CEvery five years to align with strategic planning
• DOnly when requested by the board of directors

When selecting risk treatment options, which of the following should be the PRIMARY consideration?

• AThe cost of the treatment option
• BAlignment with the organization's risk appetite and business objectives
• CWhat other organizations in the same industry are doing
• DThe preferences of the IT security team