Information Security Program — CISM Practice Questions

The security programme has more initiatives than the available staff can deliver. What is the BEST response?

• A.Commit to all initiatives and rely on overtime to meet deadlines
• B.Prioritise by risk and strategy, then align resources and delivery plans
• C.Cancel all awareness activities until staffing levels increase
• D.Outsource every responsibility without first assessing internal capabilities

Why: Effective programme management requires aligning initiatives with risk priorities and available resources. By ranking work based on risk and strategic relevance, managers can create realistic delivery plans and avoid overcommitting staff. This approach balances security objectives with operational capacity. It ensures the programme focuses on the most critical objectives and matches work to realistic capacity.

A framework includes controls that are not relevant to the organization’s operating model. What is the best action the manager should take?

• A.Implement every control exactly as specified in the framework, regardless of its relevance to the organization’s operating model.
• B.Discard the framework entirely and create a new control set without considering existing standards or regulatory requirements.
• C.Tailor the controls to the organization’s business requirements, risk profile, and legal obligations, and document the rationale.
• D.Delegate the selection of baseline controls to external suppliers and adopt their recommendations without internal justification.

Why: Frameworks provide a baseline of controls, but they must be adapted to fit the organization’s specific operating model, risk environment, and legal obligations. Documenting the rationale for any tailoring ensures accountability and supports auditability. This risk‑based, documented approach balances control effectiveness with efficiency. Tailoring aligns controls with actual business needs, risk exposure, and compliance obligations while preserving traceability.

Employees continue to follow outdated procedures stored on shared drives. What is the MOST effective improvement to ensure procedures remain current and are properly used?

• A.Send a reminder email to staff to use the latest procedures stored on the shared drive
• B.Ask employees to keep local copies of the procedures for quick reference
• C.Remove outdated procedures from the shared drive without adding replacements
• D.Define owners, obtain approvals, control versions, distribute, and review periodically

Why: Effective documentation management requires defined ownership, formal approval, version control, controlled distribution, and periodic review. This governance ensures security procedures stay accurate, accessible, and aligned with policies and regulatory requirements. It establishes formal ownership, approval, version control, controlled distribution, and scheduled reviews, keeping the documentation accurate and accessible.

A company cannot identify which applications process sensitive customer data. What should be done first?

• A.Implement a data loss prevention solution before identifying data owners and classification rules
• B.Classify only the server infrastructure that hosts applications, deferring broader data discovery
• C.Assume that all cloud‑based data is publicly accessible and focus controls on on‑premise systems
• D.Establish asset and data discovery with accountable owners and classification criteria

Why: Effective information security starts with an inventory of assets and data. Assigning owners and applying classification enables risk prioritization, regulatory compliance, and appropriate control selection. Subsequent measures such as DLP, access controls, or monitoring depend on this foundational knowledge. Because without knowing where sensitive data resides and who owns it, any security controls would be misdirected; discovery and classification provide the foundation for all subsequent protections.

A proposed authentication control could block emergency access during an outage; what should the security manager do?

• A.Implement a governed break‑glass process with monitoring and periodic review
• B.Reject all emergency access requests without exception in the organization
• C.Allow shared administrator accounts for emergency situations across the enterprise
• D.Disable authentication mechanisms during outages to ensure continued access

Why: Break‑glass procedures give authorized personnel a documented way to bypass controls in emergencies while preserving traceability. Governance, monitoring, and regular review ensure the exception is used appropriately and does not become a permanent backdoor. Designing such a control aligns security objectives with operational resilience. It provides a controlled, auditable emergency access method that balances continuity with security oversight.

The CISO reports the number of security tools as the primary measure of programme success. What is the BEST improvement?

• A.Measure the total number of security tools deployed
• B.Measure only the budget allocated to security initiatives
• C.Measure outcomes like control effectiveness, risk trends, and remediation
• D.Measure compliance with security policies through checklist completion

Why: Outcome‑based metrics such as control effectiveness, risk trends, and remediation progress provide insight into how well the security program is protecting assets and reducing risk. Counting tools, spending, or checklist items can be misleading because they do not show whether security objectives are being achieved. Effective program development requires metrics that align with risk management goals. It focuses on actual security performance and risk reduction rather than on inventory counts.

A new endpoint detection and response platform has been installed, but its alerts are not integrated into incident response workflows. What is the MOST important next step?

• A.Declare the platform effective based solely on installation
• B.Purchase an additional endpoint platform to increase coverage
• C.Reduce the severity rating of alerts until integration is complete
• D.Integrate alerts into roles, escalation, and response procedures

Why: Controls must be more than technical installations; they need to be woven into the organization’s incident response processes so that alerts trigger appropriate actions. Integrating alerts into roles, escalation, and response procedures ensures timely detection, assignment, and mitigation, which is essential for an effective security program. Only by embedding alerts into defined roles, escalation paths, and response procedures can the control become operationally effective.

An owner supplies a written access‑review policy and screenshots showing that reviews were performed. What should the evaluator do?

• A.Verify that the policy document is signed and the screenshots are dated correctly.
• B.Test whether the reviews actually covered relevant access, identified exceptions, and resulted in corrective action.
• C.Confirm that the owner’s experience validates the effectiveness of the access reviews.
• D.Check that the access‑review schedule matches the organization’s defined frequency.

Why: Access‑review controls are effective only when they are applied to the appropriate accounts, any inappropriate access is identified, and corrective actions are taken. Auditors must test the actual execution and outcomes, not just policies, signatures, or schedules. It confirms operating effectiveness by examining whether the reviews were performed, found issues, and led to remediation.

Phishing simulations reveal repeated credential disclosure within a specific business function; what is the BEST response?

• A.Implement targeted training for the function and track changes in phishing-susceptibility
• B.Conduct another round of generic annual security awareness training for all employees
• C.Publicly post the names of employees who fell for the phishing test to discourage future errors
• D.Temporarily block email access for the entire business function until a security solution is implemented

Why: Effective security awareness programs tailor interventions to observed weaknesses and use metrics to gauge improvement. Broad or punitive actions fail to change behavior sustainably. Management should focus on focused education and measurable outcomes. Targeted training addresses the function‑specific risk and measuring susceptibility shows whether the intervention is effective.

A critical SaaS provider uses subcontractors to process organisational data. What should the information security program require?

• A.Assurance limited to the primary provider’s headquarters and its direct services
• B.Periodic audits of the primary provider after contract signing without monitoring subcontractors
• C.Delegating risk‑appetite decisions to subcontractors while the provider retains overall responsibility
• D.Visibility into material subcontractors, flow‑down requirements and ongoing oversight

Why: Third‑party risk management extends beyond the direct provider to any material fourth‑party services. Security programs must require that contracts flow down security controls, that the organization retains visibility into those subcontractors, and that ongoing oversight mechanisms (e.g., monitoring, audits) are in place. Because the organization must maintain visibility into any material fourth‑party relationships, ensure that security requirements are flowed down, and continuously oversee their performance.

Given a dashboard that shows 99.9% patch compliance while critical internet‑facing systems remain unpatched, what should the CISO report?

• A.Critical exceptions, exposure, ageing, impact and remediation ownership
• B.Overall compliance percentage and total patches applied
• C.Success of the patch program based on the 99.9% metric alone for the reporting period
• D.Remediation ownership and timeline for all identified patch gaps

Why: Aggregated compliance figures can obscure significant vulnerabilities, especially on internet‑facing assets. Management reporting should therefore include details of critical exceptions, the associated exposure, the age of the gaps, their potential impact, and who is responsible for remediation to support risk‑based decision making. It highlights the high‑risk gaps that the aggregate metric hides, enabling informed risk‑based decisions.

A legacy application essential to operations cannot support modern authentication methods. What is the BEST approach to manage the associated risk?

• A.Assess compensating controls, isolate the system, implement monitoring, and develop a replacement roadmap.
• B.Implement a new authentication module immediately, without assessing compensating controls or planning a migration.
• C.Rely solely on network segmentation and firewalls, ignoring monitoring and a formal replacement plan.
• D.Transfer the risk to the vendor and request a fix, without establishing internal oversight or controls.

Why: Legacy systems that cannot meet current security standards must be protected with compensating controls such as isolation and continuous monitoring while a phased replacement is planned. This approach aligns risk management with defense‑in‑depth and ensures business continuity. Ignoring the weakness, relying only on perimeter controls, or outsourcing the risk does not provide sufficient assurance or a clear path to remediation. It balances risk mitigation with immediate safeguards and a structured plan to retire the insecure system.