CISM Information Security Governance 2

Question 1

Which framework is MOST commonly used to establish information security governance in US enterprises?

Accepted Answer

COBIT

Answer

COBIT (Control Objectives for Information and Related Technologies) is widely used for IT and information security governance in enterprises.

Question 2

When developing a security governance program, a CISM should FIRST:

Accepted Answer

Understand the organization's business strategy and objectives

Answer

Understanding the business strategy ensures that the security governance program is aligned with and supports organizational goals from the outset.

Question 3

Which of the following BEST describes the relationship between IT governance and information security governance?

Accepted Answer

Information security governance is a subset of IT governance

Answer

Information security governance is a subset of IT governance, which itself is a component of overall corporate governance.

Question 4

A CISM is presenting a security governance roadmap to the CEO. The presentation should PRIMARILY focus on:

Accepted Answer

Security risk in terms of business impact and strategic alignment

Answer

Executive presentations should frame security governance in business terms, focusing on risk, impact, and alignment with organizational strategy.

Question 5

Which of the following is a KEY output of a mature information security governance program?

Accepted Answer

Security metrics aligned to business objectives

Answer

A mature governance program produces meaningful security metrics that are tied to and measured against business objectives, demonstrating value to leadership.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM Information Security Governance 2