CISM (CISM) 2

Question 1

A newly appointed CISM is reviewing the organization's information security governance structure. Which of the following BEST demonstrates effective governance?

Accepted Answer

The board of directors receives regular security risk reports

Answer

Effective governance requires board-level oversight and accountability, including regular reporting on security risks.

Question 2

During a risk assessment, an organization identifies a threat with a high likelihood but low impact. What is the MOST appropriate risk treatment?

Accepted Answer

Implement controls proportional to the risk level

Answer

Controls should be implemented proportional to the overall risk level, balancing likelihood and impact considerations.

Question 3

An organization is developing its information security strategy. Which factor is MOST critical to align the strategy with business objectives?

Accepted Answer

Understanding the organization's risk appetite and business goals

Answer

Security strategy must be grounded in the organization's risk appetite and specific business objectives to be effective.

Question 4

Which metric BEST demonstrates the effectiveness of a security awareness training program?

Accepted Answer

Reduction in phishing click rates after training

Answer

Behavioral change metrics like reduced phishing click rates directly measure training effectiveness rather than just participation.

Question 5

A third-party vendor with access to sensitive customer data has suffered a breach. What should the information security manager do FIRST?

Accepted Answer

Assess the impact on the organization and notify affected parties per policy

Answer

The immediate priority is assessing organizational impact and fulfilling notification obligations per policy and regulatory requirements.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM (CISM) 2