CISM (CISM) General 2

Question 1

An information security manager discovers that a business unit is using an unapproved cloud service to store sensitive customer data. What is the BEST first action?

Accepted Answer

Conduct a risk assessment of the cloud service

Answer

A risk assessment determines the actual exposure before taking disruptive action, enabling an informed and proportional response.

Question 2

Which metric BEST demonstrates the effectiveness of an information security awareness training program?

Accepted Answer

Reduction in security incidents caused by human error

Answer

Outcome-based metrics like reduced human-error incidents directly measure whether training changed behavior, not just participation.

Question 3

A CISM candidate is reviewing the organization's information security governance structure. Which element is MOST critical to effective governance?

Accepted Answer

Executive management accountability and oversight

Answer

Governance requires senior leadership accountability; without it, security strategy lacks authority and resources.

Question 4

When aligning information security strategy with business objectives, the security manager should PRIMARILY focus on:

Accepted Answer

Enabling business goals while managing risk to acceptable levels

Answer

Security strategy must support business objectives by balancing risk management with operational enablement rather than simply enforcing controls.

Question 5

An organization is about to launch a new product that processes health information. When should the information security manager FIRST be engaged?

Accepted Answer

During initial project planning and design

Answer

Security-by-design requires engaging the security function at project inception to embed controls rather than retrofit them.

CISM - Certified Information Security Manager Practice Test

CISM - Certified Information Security Manager Practice Test

CISM (CISM) General 2