CISM Information Security Program Development 3

Question 1

Which of the following is MOST important when establishing a security program budget?

Accepted Answer

Justifying spend based on risk reduction and business value

Answer

Matching the budget of industry peers

Answer

Allocating the maximum available IT budget to security

Answer

Prioritizing tool purchases over personnel costs

Question 2

A CISM wants to ensure the security program addresses emerging threats. The BEST approach is to:

Accepted Answer

Subscribe to threat intelligence feeds and integrate findings into risk management

Answer

Conduct a one-time threat landscape study at program launch

Answer

Wait for incidents to occur before updating the program

Answer

Rely exclusively on annual penetration testing results

Question 3

When developing security policies, a CISM should ensure they are:

Accepted Answer

Approved by senior management and communicated to all staff

Answer

Written in highly technical language for precision

Answer

Comprehensive enough to cover every possible security scenario

Answer

Updated monthly to reflect the latest threat intelligence

Question 4

Which of the following BEST supports measuring the maturity of an information security program?

Accepted Answer

Using a capability maturity model to assess program components

Answer

Counting the total number of security incidents in a year

Answer

Comparing policy counts with peer organizations

Answer

Tracking the number of security tools deployed

Question 5

A CISM is establishing data classification as part of the security program. The PRIMARY benefit is to:

Accepted Answer

Ensure appropriate controls are applied based on data sensitivity

Answer

Reduce the cost of data storage across the organization

Answer

Comply with all applicable data protection regulations automatically

Answer

Enable the IT team to delete unnecessary data

Question 6

Which of the following is a KEY responsibility of a CISM when managing the security program lifecycle?

Accepted Answer

Ensuring the program evolves in response to changing business and threat conditions

Answer

Personally reviewing all access control logs daily

Answer

Approving every change request submitted to the IT team

Answer

Conducting all penetration tests personally