CISM Information Security Program Development 2

Question 1

A CISM is implementing a security control framework. Which of the following is MOST important when selecting a framework?

Accepted Answer

It should align with the organization's risk profile and industry requirements

Answer

It must be mandated by a government agency

Answer

It must be the most recently published framework available

Answer

It should be the most widely adopted framework globally

Question 2

Which of the following BEST describes a 'defense-in-depth' strategy in an information security program?

Accepted Answer

Implementing multiple layers of controls so that failure of one does not expose assets

Answer

Deploying a single, highly capable security platform

Answer

Relying exclusively on perimeter defenses such as firewalls

Answer

Focusing all security investment on the most critical assets only

Question 3

When building a security program, which of the following activities should be performed on a CONTINUOUS basis?

Accepted Answer

Monitoring of controls effectiveness and emerging threats

Answer

Initial risk assessment only

Answer

Employee onboarding security briefings only

Answer

Annual policy review and update cycle

Question 4

A CISM is developing a vulnerability management program. The FIRST step should be:

Accepted Answer

Defining the scope, assets, and criticality tiers to be covered

Answer

Deploying automated scanning tools across all systems

Answer

Establishing a patch deployment schedule for all systems

Answer

Negotiating a vulnerability disclosure policy with vendors

Question 5

Which of the following BEST supports a 'security by design' approach in program development?

Accepted Answer

Integrating security requirements into the project lifecycle from inception

Answer

Performing security assessments only after systems are deployed

Answer

Purchasing security add-ons for existing systems after deployment

Answer

Relying on vendors to build security into their products

Question 6

A CISM is establishing a vendor risk management program. The MOST critical first step is to:

Accepted Answer

Identify and inventory all third-party relationships and their data access levels

Answer

Require all vendors to sign a confidentiality agreement

Answer

Deploy security monitoring tools on all vendor networks

Answer

Conduct on-site audits of all vendors annually