I85PREP
⌘ K
CISM study materials
CISM study resources

CISM practice questions

One question at a time. Build your CISM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Governance

In an information security governance framework, which activity is primarily a governance responsibility rather than a management responsibility?

  1. Setting the organization's risk appetite for information security Correct answer.
  2. Reviewing daily security operation center alert queues
  3. Configuring and tuning the intrusion detection sensors
  4. Applying operating system patches to production servers

Explanation

Governance sets direction and oversight: it defines risk appetite, approves strategy, and monitors performance, while management executes day-to-day controls. Choosing the risk appetite is therefore a governing-body decision, not an operational task.

Question 2Information Security Governance

What is the primary purpose of an information security steering committee?

  1. To prioritize security initiatives and align them with business objectives Correct answer.
  2. To approve individual firewall change requests each week
  3. To perform forensic investigations of security incidents
  4. To conduct technical vulnerability scans across the enterprise

Explanation

A steering committee provides direction and oversight across the program, resolving competing priorities and aligning security investment with business objectives. It does not perform hands-on operational or investigative work.

Question 3Information Security Governance

Which group ultimately holds accountability for ensuring that information security risk is managed at an acceptable level across the enterprise?

  1. The external penetration testing vendor
  2. The board of directors Correct answer.
  3. The IT service desk team
  4. The internal audit department

Explanation

Accountability for enterprise risk rests with the board, which delegates execution to management but cannot delegate ultimate accountability. Operational teams and auditors support or assure but do not hold that accountability.

Question 4Information Security Governance

Which document type sits at the top of the information security policy hierarchy and states management's intent?

  1. An enterprise information security policy Correct answer.
  2. A technical hardening guideline
  3. A configuration baseline
  4. A standard operating procedure

Explanation

The policy is a high-level statement of management intent and mandatory direction; standards, procedures, and baselines translate it into specific requirements and steps.

Question 5Information Security Governance

A security team documents the mandatory minimum password length and complexity that must be met on all systems. This document is best classified as:

  1. A standard Correct answer.
  2. A procedure
  3. A guideline
  4. A policy

Explanation

Standards are mandatory minimum requirements that specify what must be achieved, while procedures describe step-by-step how to do it and guidelines are recommended practices. A defined password length and complexity threshold is a requirement, so it is a standard.

Question 6Information Security Governance

Risk appetite is best described as:

  1. The maximum downtime a system can tolerate before recovery is complete
  2. The total number of risks recorded in the risk register
  3. The list of controls required to pass an audit
  4. The amount and type of risk an organization is willing to accept Correct answer.

Explanation

Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives, and it is set by the governing body. It guides which risks are pursued, mitigated, or avoided.

Question 7Information Security Governance

An organization states that it will not accept more than four hours of downtime for its payment platform. This statement is an example of:

  1. Control testing
  2. Risk register
  3. Risk tolerance Correct answer.
  4. Risk appetite

Explanation

Risk tolerance is the acceptable variation around the risk appetite, often expressed as measurable limits such as maximum downtime. The four-hour figure operationalizes the appetite into a testable threshold.

Question 8Information Security Governance

Which characteristic makes an indicator a useful key risk indicator (KRI)?

  1. It is reported only once a year to reduce reporting noise
  2. It measures the total number of controls currently deployed in the environment
  3. It is chosen because data is easy to collect
  4. It gives early warning of rising risk and links to a business objective Correct answer.

Explanation

A KRI should be predictive, tied to objectives, and measurable, giving early warning of increasing exposure. Indicators chosen for convenience or that merely count controls do not inform risk decisions.

Question 9Information Security Governance

The most important criterion for judging the success of an information security strategy is whether it:

  1. Deploys the widest possible range of security tools across the enterprise
  2. Achieves a zero-incident security record every quarter
  3. Minimizes spending on security staff and technology
  4. Enables business objectives while managing risk to acceptable levels Correct answer.

Explanation

A security strategy succeeds when it enables business objectives at an acceptable level of risk. Tool breadth, zero incidents, or minimal spend are not valid measures of strategic success.

Question 10Information Security Governance

A CISO who reports to the CIO may face a structural independence problem primarily because:

  1. The CIO owns IT delivery, so security may yield to delivery pressure Correct answer.
  2. The CIO lacks the technical knowledge to evaluate security risk accurately
  3. Reporting to the CIO prevents the CISO from independently hiring security staff
  4. The CISO cannot legally report to any member of the IT management team

Explanation

Independence matters because when security reports to the same executive accountable for delivery, trade-offs may favor schedule and cost over risk reduction. Reporting lines should preserve the CISO's ability to escalate risk independently.

Question 11Information Security Governance

Which of the following is the best example of a security metric that senior management would find meaningful?

  1. The percentage of critical systems patched within the window Correct answer.
  2. The number of firewall rules configured in the environment
  3. The total count of security tools licensed by the organization
  4. The number of pages in the information security policy

Explanation

Effective metrics are outcome-based, tied to risk, and understandable to executives. Reporting patch compliance against a defined window shows control effectiveness rather than activity volume.

Question 12Information Security Governance

An organization wants to cascade security objectives so that each business unit is accountable for measurable outcomes. Which approach best supports this?

  1. Centralizing all security decisions within the security operations team
  2. Publishing an annual security awareness poster campaign
  3. Requiring every unit to use the same antivirus product
  4. Setting unit objectives tied to enterprise goals and measuring results Correct answer.

Explanation

Objectives cascade when they are translated into measurable unit-level targets that trace back to enterprise goals and are reviewed periodically. Centralizing decisions or standardizing tools does not create accountability for outcomes.

Question 13Information Security Governance

Who should own the enterprise security awareness and training program from a governance perspective?

  1. A designated security function with executive sponsorship Correct answer.
  2. The internal audit team, because it regularly evaluates compliance
  3. The help desk, because it answers employee security questions daily
  4. Each employee individually, without any central coordination

Explanation

Awareness programs need central ownership to ensure consistent content and measurement, plus executive sponsorship for legitimacy and business input for relevance.

Question 14Information Security Governance

When an organization outsources a business process to a vendor, what is the most appropriate governance expectation regarding information security?

  1. Security requirements are unnecessary if the contract already includes a liability clause
  2. The vendor assumes all accountability for the organization's data
  3. The vendor's own certifications eliminate the need for any ongoing monitoring
  4. The organization remains accountable and requires the vendor to meet requirements Correct answer.

Explanation

Outsourcing transfers execution, not accountability; the organization must specify security requirements in the contract and monitor vendor performance against them.

Question 15Information Security Governance

A new data protection regulation is enacted in a jurisdiction where the organization operates. What is the governance-appropriate first step?

  1. Delegate the matter entirely to the legal department without security involvement
  2. Assess the regulation's applicability and assign ownership for compliance Correct answer.
  3. Immediately purchase an additional security product
  4. Wait for the regulator to issue enforcement actions before acting

Explanation

Governance requires identifying applicable obligations, assessing their impact, and assigning clear ownership before remediation decisions are made. Only after that assessment can appropriate controls and investments be chosen.

Question 16Information Security Governance

In a data governance model, who is typically accountable for determining the classification and appropriate use of a data set?

  1. The security operations analyst who monitors logs
  2. The business data owner who is accountable for that data domain Correct answer.
  3. The external cloud hosting provider
  4. The database administrator who maintains the servers

Explanation

Accountability for data classification and use sits with the business data owner who understands the data's value and context; custodians and service providers implement the resulting controls.

Question 17Information Security Governance

In a RACI matrix for security governance, what does the 'A' (accountable) role signify?

  1. The person who is informed after the decision is made
  2. The person who performs the hands-on work needed to complete the activity
  3. The single person who answers for the activity's outcome and approves it Correct answer.
  4. The person who must be consulted for input before a decision is made

Explanation

Accountability means one named person answers for the outcome and holds approval authority; only one accountable party should exist per activity. The other roles describe doing the work, being consulted, or being informed.

Question 18Information Security Governance

When building a business case for a new security investment, which approach is most effective with executive decision makers?

  1. List the number of features included in each vendor proposal
  2. Emphasize that the investment is required to keep up with competitors' tooling
  3. Present the technical specifications of the proposed solution in detail
  4. Quantify risk reduction and express it in business terms such as financial impact Correct answer.

Explanation

Executives fund risk reduction, so proposals must translate technical benefit into business impact, cost, and residual risk. Frame the decision in the language of the business, not product features.

Question 19Information Security Governance

An organization's security governance is ad hoc, undocumented, and driven by individual heroics. Which description best fits this maturity level?

  1. Initial or ad hoc, where processes are unstructured and reactive Correct answer.
  2. Optimized, with continuous improvement and metrics-driven decision making
  3. Defined, with documented and standardized processes across the enterprise
  4. Managed, with basic metrics and some process discipline

Explanation

The initial or ad hoc level is characterized by unstructured, reactive, and undocumented activity that depends on individuals rather than process. Higher levels introduce repeatability, definition, measurement, and optimization.

Question 20Information Security Governance

What distinguishes the audit committee's role in security governance from that of the security steering committee?

  1. The audit committee configures security controls while the steering committee tests them
  2. The audit committee runs the security operations center while the steering committee hires analysts
  3. The audit committee approves firewall rules while the steering committee reviews logs
  4. The audit committee gives independent oversight of risk; the steering committee sets priorities Correct answer.

Explanation

The audit committee gives independent assurance to the board on risk and controls, while the steering committee makes directional decisions about security priorities. Keeping these roles separate preserves objectivity.

Question 21Information Security Governance

A business unit requests a deviation from a mandatory security standard because of an operational constraint. What is the most appropriate governance response?

  1. Require a documented, time-limited exception with risk assessment and approval Correct answer.
  2. Grant the deviation verbally so that the project timeline is not delayed at all
  3. Deny all deviation requests because approved standards can never be adjusted
  4. Let the business unit decide on its own without notifying the security function

Explanation

Exceptions must be explicit, risk-based, time-bound, and approved by the accountable authority so that residual risk is accepted knowingly. Undocumented or unilateral deviations leave risk unmanaged and untraceable.

Question 22Information Security Governance

How should information security risk best be integrated into enterprise risk management (ERM)?

  1. By reporting only technical vulnerabilities to the ERM committee
  2. By maintaining a separate security risk register that is never shared with ERM
  3. By expressing security risks on the same scales and categories used in ERM Correct answer.
  4. By excluding security risk from ERM because it is too technical

Explanation

Integration means using common risk language, scales, and reporting so security risk is comparable with other enterprise risks and can be prioritized alongside them. A parallel, disconnected register defeats that purpose.

Question 23Information Security Governance

During merger and acquisition due diligence, what is the most important security governance consideration?

  1. Identifying inherited risks, control gaps, and regulatory obligations Correct answer.
  2. Ensuring the acquired company uses the same antivirus product as the parent
  3. Waiting until the acquisition closes to assess security posture
  4. Replacing the acquired company's entire IT staff immediately

Explanation

Due diligence must surface inherited vulnerabilities, control gaps, and regulatory exposure because these affect valuation, integration cost, and deal terms. Waiting until after closing forfeits the ability to price or negotiate those risks.

Question 24Information Security Governance

'Tone at the top' most directly influences information security governance by:

  1. Determining which security technologies are procured
  2. Establishing the frequency of vulnerability scans
  3. Setting the technical configuration of network devices and firewalls
  4. Shaping whether employees treat security requirements as legitimate Correct answer.

Explanation

Executive behavior signals what is genuinely important; when leaders visibly sponsor and follow security requirements, employees treat them as legitimate. Technical choices and scan schedules are downstream operational decisions.

Question 25Information Security Governance

What is the primary benefit of benchmarking an organization's security program against peer organizations?

  1. It identifies the exact security products the organization should buy
  2. It gives a reference point for judging the program's relative maturity Correct answer.
  3. It guarantees that the organization will meet all regulatory requirements
  4. It replaces the need for an internal risk assessment

Explanation

Benchmarking supplies an external reference for maturity and effectiveness, informing judgment about where the program stands relative to peers. It complements, but does not replace, risk assessment and compliance activities.

Question 26Information Security Governance

In information security governance, which activity is a governance responsibility rather than a management responsibility?

  1. Changing firewall rules
  2. Reviewing alert queues
  3. Deploying operating system patches
  4. Setting direction and oversight Correct answer.

Explanation

Governance sets direction, defines decision rights, and provides oversight, while management executes controls and daily operations. Patch deployment, firewall changes, and alert review are operational tasks delegated within management.

Question 27Information Security Governance

Which document type states mandatory high-level security requirements approved by executive management?

  1. Policy Correct answer.
  2. Guideline
  3. Procedure
  4. Baseline configuration

Explanation

A policy expresses mandatory high-level management intent and is approved at an executive level. Standards, procedures, and baselines translate policy into specific requirements, steps, or technical settings.

Question 28Information Security Governance

What is the board of directors' primary information security governance role?

  1. Perform vulnerability scans
  2. Manage incident response
  3. Approve strategy and oversee risk Correct answer.
  4. Approve individual firewall changes

Explanation

The board provides oversight by approving security direction and monitoring risk at an enterprise level. It does not perform operational security tasks such as scanning, firewall changes, or incident handling.

Question 29Information Security Governance

What is the primary governance role of the chief information security officer (CISO)?

  1. Write all application source code
  2. Personally configure every security system
  3. Align security with business objectives Correct answer.
  4. Manage payroll processing operations

Explanation

The CISO leads the security strategy and advises executives so that security supports business objectives and risk tolerance. Technical configuration, coding, and payroll are delegated operational responsibilities.

Question 30Information Security Governance

What should an information security charter primarily establish?

  1. Authority and scope Correct answer.
  2. Annual penetration test schedule
  3. Detailed firewall rules
  4. List of IT assets

Explanation

A security charter formally defines the security function's mandate, authority, scope, and key responsibilities. It provides the basis for accountability and decision rights within governance.

Question 31Information Security Governance

An information security strategy should be aligned primarily with which of the following?

  1. Vendor marketing materials
  2. The latest security product trends
  3. Business goals and risk appetite Correct answer.
  4. IT department holiday schedules

Explanation

A security strategy should translate business goals and the organization's risk appetite into security priorities. Product trends and vendor materials may inform tactics but should not drive strategy.

Question 32Information Security Governance

Who should approve an enterprise-wide information security policy?

  1. The help desk manager
  2. Executive management Correct answer.
  3. An external auditor
  4. Any security analyst

Explanation

Executive management approval gives an enterprise policy the authority and accountability needed for organization-wide enforcement. Analysts, auditors, and help desk staff may contribute or review, but they do not own executive approval.

Question 33Information Security Governance

Which of the following is a recognized framework for establishing information security governance?

  1. HTTP
  2. COBIT
  3. RAID Correct answer.
  4. SMTP

Explanation

COBIT is a recognized governance framework for enterprise IT and information security. HTTP, SMTP, and RAID are technical protocols or storage configurations, not governance frameworks.

Question 34Information Security Governance

A security steering committee cannot agree on whether to fund a new data loss prevention tool. What is the most appropriate governance action?

  1. Let the CISO decide alone
  2. Escalate with risk and cost data Correct answer.
  3. Run only a technical product test
  4. Defer until the next budget cycle

Explanation

Unresolved governance decisions should be escalated to the appropriate executive authority with the risk, cost, and business impact clearly stated. Unilateral action or indefinite deferral avoids accountable decision-making.

Question 35Information Security Governance

Which situation best indicates a lack of separation between security governance and security operations?

  1. Board reviews risk quarterly
  2. CEO approves security policy
  3. CISO approves each firewall change Correct answer.
  4. Committee includes many business units

Explanation

Governance should set direction and oversee risk, while operations execute changes under delegated authority. A CISO personally approving every firewall change blurs that boundary by performing operational control.

Question 36Information Security Governance

A business unit plans a customer portal that will handle personal data. When should security governance requirements be introduced?

  1. After the vendor contract is signed
  2. Only after a security incident
  3. At initiation and design gates Correct answer.
  4. After launch during the first audit

Explanation

Security governance requirements should be embedded at project initiation and enforced through design gates so that risk is addressed before build and launch. Waiting until audit, incident, or contracting limits the ability to influence design.

Question 37Information Security Governance

An internal audit report identifies repeated failures to remediate high-risk findings. What should security governance do first?

  1. Assign remediation to the help desk
  2. Close findings without evidence
  3. Require an owned remediation plan Correct answer.
  4. Ignore it because audit is advisory

Explanation

Governance should hold management accountable by requiring a remediation plan with named owners, deadlines, and tracking. Ignoring findings, misassigning ownership, or closing without evidence undermines oversight.

Question 38Information Security Governance

In the three lines of defense model, what is the role of internal audit (third line) regarding information security?

  1. Setting security policy
  2. Accepting residual risk
  3. Independent assurance Correct answer.
  4. Owning daily security operations

Explanation

The third line provides independent assurance over governance, risk management, and controls. Management owns operations, policies, and risk acceptance decisions within the first and second lines.

Question 39Information Security Governance

A regulator requests evidence that senior management oversees the security program. Which artifact best demonstrates this?

  1. A firewall rule export
  2. A list of installed antivirus versions
  3. An employee vacation calendar
  4. Committee minutes and charter Correct answer.

Explanation

Signed committee minutes and a charter show that senior management has established oversight, reviewed decisions, and directed the program. Technical exports and administrative records do not demonstrate governance oversight.

Question 40Information Security Governance

What is the primary purpose of security governance reporting to the board?

  1. To list every individual security alert
  2. To enable informed risk decisions Correct answer.
  3. To provide raw firewall log entries
  4. To document staff vacation schedules

Explanation

Board reporting should summarize security risk, performance, and trends in business terms so directors can make informed oversight decisions. Raw logs, individual alerts, and administrative schedules do not support that purpose.

Question 41Information Security Governance

A CISO wants to establish security champions in business units. What governance arrangement best supports this?

  1. Assign champions to all incident response
  2. Give champions sole authority to accept risk
  3. Replace business unit leaders
  4. Define roles and time with unit management Correct answer.

Explanation

Security champions succeed when their roles, reporting lines, and allocated time are formally agreed with business unit management. They support local security practices but do not replace accountable business leaders or absorb all operational duties.

Question 42Information Security Governance

Which factor most strengthens an information security steering committee?

  1. No agenda for meetings
  2. Only technical staff attend
  3. Clear decision rights Correct answer.
  4. Delegate decisions to absent staff

Explanation

Effective steering committees have explicit decision rights, executive sponsorship, and authority to resolve cross-functional priorities. Missing agendas, absent decision-makers, and narrow technical membership weaken governance.

Question 43Information Security Governance

A security policy has not been reviewed for five years despite major technology changes. What governance action is most appropriate?

  1. Review and reapprove the policy Correct answer.
  2. Delegate review to a vendor
  3. Leave it unchanged because no incidents occurred
  4. Delete the policy

Explanation

Policies require periodic review to remain relevant as technology, risk, and business conditions change. A formal review and reapproval maintains currency and ownership, whereas leaving, deleting, or outsourcing review weakens governance.

Question 44Information Security Governance

What is the main governance reason to separate the security function from IT operations?

  1. To allow independent challenge Correct answer.
  2. To eliminate the need for audits
  3. To reduce electricity costs
  4. To avoid documenting procedures

Explanation

Separating security from IT operations helps security challenge operational priorities and raise risk concerns independently. It does not remove the need for audits or documentation, nor is it primarily a cost measure.

Question 45Information Security Governance

What should a governance body consider first when prioritizing competing security initiatives?

  1. Ease of implementation only
  2. Popularity among staff
  3. Vendor relationship strength
  4. Risk reduction and value Correct answer.

Explanation

Prioritization should be driven by the degree to which an initiative reduces prioritized risk and delivers business value. Vendor relationships, implementation ease, and popularity may inform execution but are not primary governance criteria.

Question 46Information Security Governance

An organization has mature security governance, but business units routinely bypass policy during peak season. Which governance weakness is most likely?

  1. Too many security tools
  2. Excessive board reporting
  3. Weak accountability Correct answer.
  4. Overly detailed procedures

Explanation

Routine policy bypass indicates that enforcement, consequences, and accountability are not operating effectively despite mature processes. Tool count, reporting volume, and procedure detail do not by themselves explain deliberate circumvention.

Question 47Information Security Governance

A multinational firm must govern security across subsidiaries with differing local regulations. What is the most effective governance structure?

  1. One global policy with no local input
  2. Outsource decisions to local vendors
  3. Fully independent subsidiary rules
  4. Common framework with variances Correct answer.

Explanation

A common control framework provides consistent enterprise risk management, while documented and centrally approved local variances address regulatory differences. Ignoring local input, fragmenting rules, or outsourcing decisions weakens governance.

Question 48Information Security Governance

Which approach best provides the board with forward-looking insight into emerging cyber risk?

  1. Current antivirus signatures
  2. Scenario analysis Correct answer.
  3. List of firewall vendors
  4. Past incident counts

Explanation

Scenario analysis explores plausible future events and links them to business impact, supporting proactive board discussion. Historical counts, signature lists, and vendor inventories are backward-looking or operational.

Question 49Information Security Governance

A security governance committee includes only IT managers. What is the most significant limitation of this composition?

  1. It will make incident response faster
  2. It may lack business context Correct answer.
  3. It will increase technical tools
  4. It will reduce the need for policies

Explanation

Cross-functional membership brings business, legal, compliance, and risk perspectives needed to prioritize enterprise security risk. A technical-only committee may struggle to weigh business impact and strategic trade-offs.

Question 50Information Security Governance

An organization wants to improve security governance maturity from defined processes to measured and managed performance. What should it implement first?

  1. Additional network firewalls
  2. A new corporate logo
  3. Metrics with management review Correct answer.
  4. More security tools and products

Explanation

Moving to measured and managed performance requires defined metrics, targets, and regular management review of results. Additional tools or branding do not create the measurement and oversight capability that defines this maturity step.