Blog

CISM – Domain 1 – Governance Quiz – 100 Questions

by JTExceediance
by JTExceediance
A+A-
Reset

CISM Domain 1 Governance Quiz – 100 Questions

📘 CISM Domain 1 · Information Security Governance

100 practice questions — click any option to check your answer.
✅ Green = correct  |  ❌ Strikethrough = your wrong pick, with the correct answer highlighted in green.
Sec 1 Sec 2 Sec 3 Sec 4 Sec 5 Sec 6 Sec 7 Sec 8 Sec 9 Sec 10
📌 Section 1 · Questions 1–10
1. An organization has experienced rapid growth through acquisitions, resulting in inconsistent security policies across business units. Which of the following is the MOST effective approach to establishing consistent security governance across the enterprise?
A) Allow each business unit to maintain its current policies to avoid disruption to ongoing operations.
B) Develop and implement an enterprise-wide security policy framework that is approved by executive management and applicable to all units.
C) Conduct a security audit of each business unit and mandate that the weakest unit adopt the strongest unit's policies.
D) Hire external consultants to design a custom security framework for each business unit based on their specific operational needs.
2. The Board of Directors has requested a report on the organization's information security posture. What is the MOST critical element that should be included in this report?
A) A detailed technical inventory of all security tools and their configurations across the enterprise.
B) A summary of the security team's daily operational activities and incident response performance metrics.
C) An assessment of the organization's risk profile, alignment with risk appetite, and progress on strategic security initiatives.
D) A comprehensive list of all security policies and standards that have been approved and communicated to employees.
3. Which of the following BEST describes the primary purpose of information security governance?
A) To ensure compliance with all applicable laws, regulations, and contractual obligations through periodic audits.
B) To direct, control, and oversee the security program in alignment with business strategy, risk appetite, and stakeholder expectations.
C) To implement technical controls that prevent unauthorized access to sensitive information and critical systems.
D) To respond effectively to security incidents and restore normal business operations with minimal disruption to services.
4. An organization is developing a new information security strategy. Which of the following is the MOST important input to this strategy?
A) The current technical architecture and security tool capabilities of the organization's IT environment.
B) The organization's overall business strategy, objectives, and risk appetite as defined by executive management and the Board.
C) The security industry's best practices and emerging trends as published by leading analysts and professional associations.
D) The results of recent penetration tests and vulnerability assessments conducted on critical systems and applications.
5. The Chief Information Security Officer (CISO) is presenting a security investment proposal to the Board. What is the MOST effective way to justify the investment?
A) Describe the technical features and capabilities of the proposed security solution in detail to demonstrate its effectiveness.
B) Compare the organization's security spending against industry benchmarks to show alignment with peer organizations' investments.
C) Present a business case that quantifies the expected risk reduction, financial impact mitigation, and alignment with strategic objectives.
D) Share case studies of security breaches in similar organizations to highlight the consequences of underinvestment in security.
6. Which of the following is the PRIMARY responsibility of the Board of Directors regarding information security?
A) To approve and oversee the execution of the organization's day-to-day security operations and incident response procedures.
B) To develop and maintain the organization's security policies, standards, and procedures for all business units and functions.
C) To exercise oversight by defining risk appetite, approving security strategy, and ensuring accountability for security outcomes.
D) To implement and manage the technical security controls that protect the organization's information assets and systems.
7. An organization's security steering committee is reviewing the security program's performance. Which metric would provide the MOST meaningful insight into the program's alignment with business objectives?
A) The percentage of employees who have completed annual security awareness training and passed the associated assessments.
B) The number of security incidents detected and resolved within the defined service level agreements over the reporting period.
C) The reduction in the organization's residual risk exposure for critical business processes and strategic initiatives as measured by KRIs.
D) The total security expenditure relative to the organization's revenue and the percentage spent on each security domain.
8. The CISO is developing a security governance charter for the organization. Which of the following elements is MOST critical to include in this charter?
A) A detailed list of all security technologies approved for use across the organization and their respective implementation timelines.
B) A comprehensive security risk register documenting all identified risks and the corresponding treatment plans and owners.
C) A clear definition of governance structures, roles, responsibilities, authority levels, and decision-making processes for security matters.
D) A complete inventory of all information assets, their classifications, and the controls currently implemented to protect them.
9. When establishing an information security governance framework, which of the following should be the FIRST step?
A) Conduct a comprehensive risk assessment to identify all threats, vulnerabilities, and potential impacts to business operations.
B) Select and implement a recognized control framework such as ISO 27001 or NIST CSF to guide security activities and compliance.
C) Define the security vision, mission, and principles that will guide decision-making and align with the organization's strategic objectives.
D) Appoint a Chief Information Security Officer and establish a security team with clearly defined roles and responsibilities.
10. An organization is considering a significant investment in a new security technology. What is the MOST important factor in making this decision from a governance perspective?
A) The technology's compatibility with existing infrastructure and the ease of integration with other security tools already deployed.
B) The technology's ability to reduce risk to a level that is consistent with the organization's risk appetite and tolerance thresholds.
C) The total cost of ownership, including licensing, maintenance, training, and ongoing operational support for the technology.
D) The vendor's reputation, financial stability, and track record in delivering similar security solutions to comparable organizations.
📌 Section 2 · Questions 11–20
11. The Board of Directors has delegated the oversight of information security to the Audit Committee. Which of the following responsibilities should the Audit Committee assume?
A) Managing the day-to-day security operations and ensuring that security incidents are resolved within established SLAs.
B) Developing, implementing, and maintaining the organization's security policies, standards, and related operational procedures.
C) Reviewing security program performance, risk exposures, and the effectiveness of controls to provide independent assurance to the Board.
D) Conducting security awareness training for employees and ensuring that all staff understand their security responsibilities.
12. Which of the following BEST describes the relationship between information security governance and information security management?
A) Governance and management are interchangeable terms that both refer to the direction and control of security activities.
B) Governance defines the strategic direction, risk appetite, and accountability framework, while management executes and implements the security program.
C) Management sets the security strategy and approves budgets, while governance implements security controls and monitors operational effectiveness.
D) Governance is focused on operational security activities, while management is focused on strategic alignment with business objectives.
13. An organization is implementing a new compliance requirement that significantly impacts security operations. What is the MOST effective way to integrate this requirement into the security governance framework?
A) Assign the compliance requirement to the legal department and allow them to manage it independently of the security program.
B) Implement the specific controls required for compliance without considering broader security implications or business impact.
C) Update the security strategy and risk register to reflect the new requirement, and adjust controls and resource allocation accordingly.
D) Treat compliance as a separate activity and maintain distinct governance structures for security and compliance functions.
14. The security governance framework should ensure that security decisions are made at the appropriate level of the organization. Which of the following is the MOST important governance mechanism for achieving this?
A) A centralized security operations center that monitors all security alerts and incidents across the enterprise.
B) A comprehensive set of security policies that define acceptable behavior and consequences for non-compliance at all levels.
C) Clearly defined authority levels and escalation paths for security decisions, documented in the governance charter and approved by executives.
D) A security risk register that documents all risks and their respective owners, treatment plans, and review dates.
15. A business unit leader proposes a new initiative that involves significant data sharing with external partners. The CISO identifies potential security risks. What should the CISO do FIRST?
A) Approve the initiative because the business unit leader has assessed the risks and believes the business case is strong.
B) Block the initiative entirely until the business unit leader provides a detailed security implementation plan for the data sharing.
C) Conduct a risk assessment and present the findings, along with mitigation options, to the business unit leader and appropriate governance body for a decision.
D) Escalate the issue directly to the Board to ensure they are aware of the risks associated with the new business initiative.
16. Which of the following is the BEST indicator that an organization's security governance is effective?
A) The security team achieves a perfect score on all internal and external security audits without any findings or recommendations.
B) The organization has implemented all the security controls recommended by industry best practices and regulatory standards.
C) Security decisions are consistently aligned with business objectives and risk appetite, and stakeholders have confidence in the program's direction.
D) The organization has not experienced any significant security incidents or data breaches over the past 12 months.
17. The CISO is preparing the annual security budget. What is the MOST appropriate basis for allocating resources across different security domains?
A) The industry benchmarks for security spending as a percentage of revenue to ensure alignment with peer organizations.
B) The organization's risk assessment results, prioritizing investments in areas that address the highest-priority risks and business impacts.
C) The historical spending patterns and past budget allocations to maintain consistency and predictability in the security program.
D) The technology roadmap and anticipated needs for upgrading or replacing existing security tools and infrastructure.
18. An organization's security governance framework includes a security steering committee. Which of the following is the PRIMARY role of this committee?
A) To implement security controls and manage the day-to-day security operations of the organization.
B) To respond to security incidents and coordinate recovery efforts with business continuity and disaster recovery teams.
C) To provide oversight, guidance, and decision-making authority for the security program at the executive and business unit level.
D) To conduct security awareness training and communicate security policies to employees across the organization.
19. Which of the following is the MOST critical success factor for an information security governance program?
A) The implementation of advanced security technologies and tools that provide comprehensive threat detection and prevention.
B) A comprehensive set of security policies and standards that cover all aspects of information security across the enterprise.
C) Active engagement and commitment from executive management and the Board, including visible support and adequate resource allocation.
D) A mature security awareness program that ensures all employees understand their security responsibilities and obligations.
20. The CISO is reviewing the organization's security governance documentation. Which document should define the HIGHEST-level security principles and strategic direction?
A) The security standards document, which contains mandatory requirements for all security controls and processes.
B) The enterprise security policy, which is approved by the Board and establishes the organization's security vision, mission, and principles.
C) The security procedures manual, which provides step-by-step instructions for executing specific security tasks and activities.
D) The security governance charter, which defines the governance structures, roles, and decision-making processes for security.
📌 Section 3 · Questions 21–30
21. An organization is adopting a new security framework. Which of the following is the MOST important consideration when selecting the appropriate framework?
A) The framework's recognition by external auditors and industry peers as a leading practice in information security management.
B) The framework's ability to address the organization's specific risk profile, regulatory obligations, and strategic security objectives.
C) The framework's comprehensive coverage of all technical security controls and its alignment with popular certification programs.
D) The framework's ease of implementation and the availability of experienced consultants to support the adoption process.
22. The CEO has asked the CISO to explain why the organization needs to invest in security governance. What is the BEST response?
A) "Security governance ensures we comply with all applicable laws and regulations, which prevents fines and legal penalties from being imposed."
B) "Security governance provides the structures and processes to protect our IT infrastructure from cyber threats and malicious actors effectively."
C) "Security governance ensures that security decisions are aligned with business strategy and that we are managing risks within our appetite while enabling business objectives."
D) "Security governance establishes clear roles and responsibilities so that everyone knows what they are accountable for regarding information security."
23. Which of the following is the GREATEST risk when security governance is weak or absent in an organization?
A) The organization may fail to implement the latest security technologies and fall behind industry peers in security maturity.
B) The organization may not have documented security policies and procedures, leading to inconsistent practices across business units.
C) The organization may make uninformed security decisions that are not aligned with business priorities, leading to ineffective resource allocation and unmanaged risk exposure.
D) The organization may fail to detect and respond to security incidents because of inadequate monitoring and response capabilities.
24. The security governance framework should be designed to support which of the following PRIMARY outcomes?
A) The implementation of all security controls recommended by industry standards and frameworks such as ISO 27001 and NIST CSF.
B) The achievement of a high score in external security assessments and audits, demonstrating the organization's commitment to security excellence.
C) The delivery of business value through effective risk management, strategic alignment, and accountability for security outcomes and decisions.
D) The reduction of the organization's security budget through elimination of redundant controls and inefficient security processes.
25. An organization is undergoing a significant merger with another company. What is the MOST critical security governance activity during the integration phase?
A) Conducting technical vulnerability assessments of the acquired company's IT infrastructure to identify and remediate security gaps.
B) Harmonizing the security policies and standards of both organizations into a single, unified framework applicable to all business units.
C) Aligning the security governance structures, risk appetites, and accountability frameworks to ensure consistent oversight and decision-making.
D) Integrating the security tools and technologies of both organizations to provide centralized monitoring and incident response capabilities.
26. Which of the following is the MOST effective way for the CISO to demonstrate the value of the security program to the Board?
A) Presenting detailed security metrics that show the number of incidents detected, resolved, and prevented by the security program.
B) Translating security risks and program achievements into business impact terms such as revenue protection, cost avoidance, and risk reduction.
C) Comparing the organization's security capabilities to industry benchmarks and highlighting areas where the organization leads or lags its peers.
D) Demonstrating compliance with all applicable regulations and standards, and showing audit results that confirm the program's effectiveness.
27. An organization has defined its risk appetite and communicated it through governance channels. Which of the following is the MOST important use of this risk appetite statement?
A) To set specific security control requirements for all systems and applications based on their classification and associated risks.
B) To prioritize security incidents and allocate response resources based on the potential impact and urgency of each incident.
C) To guide security decision-making, resource allocation, and risk acceptance across all levels of the organization.
D) To establish key risk indicators and performance metrics that measure the program's alignment with organizational objectives.
28. The CISO is developing a security strategy for the next three years. Which of the following should be the FOUNDATION of this strategy?
A) The security industry's leading practices and emerging trends, as identified by research firms and security thought leaders.
B) The results of the most recent security risk assessment, including identified vulnerabilities and recommended remediation actions.
C) The organization's business strategy, objectives, and risk appetite, as defined by executive management and approved by the Board.
D) The current maturity of the security program and the specific areas where improvement is needed to achieve the next maturity level.
29. Which of the following is the BEST example of a governance-level security metric?
A) The average time taken by the security operations center to respond to and contain security incidents.
B) The percentage of employees who have completed the mandatory security awareness training program.
C) The percentage of the organization's risk exposure that is being managed within the defined risk tolerance thresholds.
D) The number of security patches applied to critical systems and the time taken to apply them after release.
30. An organization is establishing a security governance framework. Which of the following is the MOST effective approach to ensuring the framework is adopted and sustained?
A) Designing the framework based on industry best practices and then mandating its adoption across all business units through policy enforcement.
B) Engaging key stakeholders in the design process, securing executive sponsorship, and embedding governance into existing business processes.
C) Implementing the framework through a phased approach, starting with the most critical business units and expanding to the entire organization.
D) Training all employees on the framework's requirements and establishing a compliance monitoring program to track adoption and adherence.
📌 Section 4 · Questions 31–40
31. The Board has requested a security dashboard to monitor the organization's security posture. What should be the PRIMARY focus of this dashboard?
A) Operational security metrics such as incident counts, response times, and the number of alerts generated by security tools.
B) Compliance metrics showing the organization's adherence to regulatory requirements and the status of audit findings.
C) Strategic risk metrics such as the organization's risk profile, alignment with risk appetite, and progress on key security initiatives.
D) Financial metrics showing security spending by category and the return on investment of security initiatives and projects.
32. Which of the following BEST describes the role of the CISO in the governance structure of an organization?
A) The CISO is accountable for making all security decisions and is ultimately responsible for the security of the organization.
B) The CISO is responsible for advising executives and the Board on security matters, developing the security strategy, and overseeing the program.
C) The CISO reports to the CIO and is responsible for implementing security controls and managing the security operations team.
D) The CISO is accountable for all security incidents and is responsible for communicating incident details to regulatory authorities.
33. An organization is updating its security policies to reflect changes in the regulatory environment. What is the MOST important consideration in this policy update process?
A) Ensuring that the policies are aligned with the organization's technical capabilities and can be implemented without significant investment.
B) Ensuring that the policies are approved by the appropriate governance body and communicated to all affected stakeholders effectively.
C) Ensuring that the policies include detailed technical specifications to guide security teams in their implementation of controls.
D) Ensuring that the policies are reviewed by external legal counsel to confirm compliance with applicable laws and regulations.
34. A business unit wants to implement a new cloud-based solution that deviates from the organization's security architecture standards. What should the CISO do FIRST?
A) Approve the solution because the business unit leader has confirmed it meets all business requirements and operational needs.
B) Block the solution until the vendor can demonstrate full compliance with the organization's existing security architecture standards.
C) Assess the risks associated with the deviation, document the findings, and present them to the security steering committee for a formal decision.
D) Request that the business unit leader submit a formal exception request and wait for the governance body's decision before taking any action.
35. Which of the following is the MOST effective approach to ensuring that security governance is integrated into the organization's culture?
A) Establishing a security governance committee that meets regularly and provides oversight of the security program.
B) Implementing security governance training for all employees and measuring their understanding through annual assessments.
C) Embedding security governance into existing business processes and decision-making frameworks, with visible leadership support.
D) Developing and communicating security policies and standards that apply to all employees and business units consistently.
36. The CISO is presenting the security program's performance to the Audit Committee. Which metric would provide the MOST meaningful assurance to the committee?
A) The number of security incidents reported by employees and the time taken to resolve each incident.
B) The effectiveness of security controls as measured through independent testing and the reduction of residual risk over time.
C) The percentage of the security budget spent on personnel versus technology and the correlation with program outcomes.
D) The number of security audits that have been completed and the status of open audit findings and remediation actions.
37. An organization is developing a security awareness program. What is the MOST important governance consideration for this program?
A) Ensuring that the program uses interactive training methods and gamification to maintain employee engagement and interest.
B) Ensuring that the program covers all relevant security topics, including phishing, password hygiene, and data protection.
C) Ensuring that the program has executive sponsorship, is mandated by policy, and includes measurement of effectiveness and reporting to management.
D) Ensuring that the program is delivered annually to all employees and that training completion is tracked and reported.
38. Which of the following is the GREATEST risk when the security governance framework does not include input from business stakeholders?
A) The security team may implement controls that are technically robust but not accepted by employees, reducing overall program effectiveness.
B) The security program may focus on risks that are important from a technical perspective but misaligned with strategic business priorities and objectives.
C) The organization may fail to implement the latest security technologies because business stakeholders do not support the necessary investments.
D) The security team may not understand the business impact of risks, leading to incidents that cause unexpected operational disruptions.
39. The organization is considering outsourcing a significant security function to a managed security service provider. What is the MOST important governance activity prior to making this decision?
A) Conducting a technical evaluation of the service provider's security tools and capabilities to ensure they meet the organization's requirements.
B) Negotiating the contract terms and conditions to ensure the service provider is financially liable for any security breaches or failures.
C) Assessing the risks and implications of outsourcing and ensuring that the decision is made by the appropriate governance authority with accountability.
D) Reviewing the service provider's references and case studies to confirm their experience with similar clients and security challenges.
40. Which of the following BEST describes the relationship between security policies and security governance?
A) Policies are the primary mechanism for implementing governance, and they define the governance structures and decision-making processes.
B) Policies are one component of governance, translating strategic direction into operational requirements and establishing accountability.
C) Governance is the process of enforcing policies, and policies provide the detailed rules for day-to-day security operations.
D) Policies define the strategic direction, while governance ensures that policies are implemented and enforced consistently across the organization.
📌 Section 5 · Questions 41–50
41. An organization is experiencing rapid growth and has added several new subsidiaries. What is the MOST effective approach to maintaining consistent security governance across the expanded enterprise?
A) Allow each subsidiary to maintain its own security governance structure to accommodate local business practices and regulations.
B) Require all subsidiaries to adopt the same security technologies and tools to ensure consistent monitoring and incident response.
C) Establish a centralized security governance framework with defined minimum standards and provide guidance on local implementation.
D) Conduct regular security audits of all subsidiaries and mandate remediation of any findings to ensure consistency across the enterprise.
42. The CISO is preparing the security strategy for the next fiscal year. Which of the following should be the PRIMARY driver of the strategy's priorities?
A) The organization's historical security spending patterns and the need to maintain consistency in resource allocation.
B) The security industry trends and emerging threats identified by leading research firms and security conferences.
C) The organization's strategic business objectives and the risks that could prevent the organization from achieving those objectives.
D) The results of the most recent security maturity assessment and the specific initiatives needed to progress to the next maturity level.
43. Which of the following is the MOST effective way for the CISO to build trust and credibility with the Board of Directors?
A) Presenting detailed technical information about security tools and controls to demonstrate deep expertise and thorough understanding.
B) Ensuring that the organization passes all security audits with no findings or recommendations for improvement.
C) Providing clear, honest, and business-relevant information that enables the Board to make informed decisions about security risks and investments.
D) Reporting only successful security initiatives and framing challenges as opportunities to avoid raising concerns with the Board.
44. An organization is implementing a new security governance framework. Which of the following is the MOST critical success factor for this implementation?
A) The availability of skilled security professionals who understand the framework and can train others on its requirements.
B) The active support and visible commitment of executive management and the Board to the new governance approach.
C) The selection of the most comprehensive framework that covers all aspects of information security governance in detail.
D) The allocation of sufficient budget to implement all the governance controls required by the framework.
45. The security team has identified a new risk that could have a significant impact on the organization's operations. What is the MOST appropriate governance response?
A) Implement controls to mitigate the risk immediately without waiting for formal approval to ensure the organization is protected.
B) Document the risk in the risk register and wait for the next scheduled governance meeting to discuss and decide on treatment actions.
C) Escalate the risk to the appropriate governance body for a decision on treatment, and provide analysis of options and potential impacts.
D) Assign the risk to the business unit owner and request that they develop a treatment plan and present it to the security team.
46. Which of the following BEST describes the concept of "tone from the top" in security governance?
A) The CISO's communication of security policies and expectations to all employees through formal training and awareness programs.
B) The leadership's visible commitment to security, demonstrated through their actions, communications, and resource allocation decisions.
C) The organization's security policies and standards that define the minimum acceptable level of security for all employees.
D) The security governance structure's reporting lines and the delegation of authority for security decisions throughout the organization.
47. An organization is developing a security scorecard for executive reporting. Which of the following elements is MOST important to include on this scorecard?
A) The number of security incidents detected, contained, and resolved within defined service level agreements.
B) The percentage of employees who have completed the mandatory security awareness training program.
C) The current risk exposure relative to the organization's defined risk appetite and the status of key risk mitigation initiatives.
D) The total security budget and the percentage of the budget spent on personnel, technology, and services.
48. The CISO is reviewing the organization's security governance documentation and identifies that several key policies have not been reviewed or updated in over three years. What is the MOST appropriate action?
A) Schedule a review of all policies during the next annual policy review cycle and prioritize the most critical policies for immediate update.
B) Initiate an immediate review of all policies, update them to reflect current business and threat conditions, and establish a regular review schedule.
C) Retain the existing policies because they have been effective for the organization and have not caused any significant issues or incidents.
D) Delegate the policy review to the business unit leaders to ensure the policies are relevant to their specific operational contexts.
49. Which of the following is the GREATEST risk when security governance is viewed as solely an IT responsibility rather than an enterprise-wide concern?
A) The security team may not receive adequate budget and resources to implement the necessary security controls effectively.
B) The organization may fail to implement security awareness programs for non-technical employees and business leaders.
C) Security decisions may be made without adequate business input, leading to misalignment between security investments and business priorities.
D) The organization may not have a designated Chief Information Security Officer with appropriate authority and accountability.
50. An organization is implementing a new enterprise resource planning (ERP) system. What is the MOST effective governance approach to ensure security is embedded in the implementation?
A) Assign the security team to conduct a risk assessment of the new system after the implementation is complete and before it goes live.
B) Embed security requirements into the project's requirements phase and include security representatives on the project governance board.
C) Delegate security responsibilities to the project manager and require them to include security in the project plan and implementation.
D) Conduct security testing of the new system during the user acceptance testing phase to identify and remediate security issues.
📌 Section 6 · Questions 51–60
51. The CISO is preparing a business case for a new security investment. Which of the following is the MOST compelling element to include in this business case?
A) A detailed description of the security solution's technical features and how they address specific threats and vulnerabilities.
B) A quantitative analysis of the expected risk reduction and financial impact mitigation compared to the investment cost.
C) A comparison of the organization's security capabilities to industry benchmarks and peer organizations' security investments.
D) A summary of recent security incidents in similar organizations and the lessons learned from those incidents.
52. Which of the following BEST describes the role of the Audit Committee in information security governance?
A) The Audit Committee is responsible for conducting security audits and providing independent assurance on the effectiveness of controls.
B) The Audit Committee exercises oversight by reviewing security program performance, audit findings, and management's remediation actions.
C) The Audit Committee approves the security budget and allocates resources for security initiatives and technology investments.
D) The Audit Committee develops and implements the organization's security policies and standards for all business units.
53. An organization is experiencing resistance to new security policies from business units. What is the MOST effective governance approach to address this resistance?
A) Mandate compliance with the new policies and enforce consequences for non-compliance through performance reviews and disciplinary actions.
B) Engage business unit leaders in the policy development process and demonstrate how the policies support their operational objectives.
C) Allow business units to develop their own policies based on their operational needs, with guidance from the security team.
D) Conduct training sessions to explain the new policies and provide examples of how they can be implemented in different business contexts.
54. The CISO is developing a security program performance report for executive management. Which of the following should be the PRIMARY focus of this report?
A) A detailed inventory of all security controls and their operating status across the organization.
B) A summary of all security incidents and the time taken to detect, contain, and recover from each incident.
C) The program's progress against strategic objectives, risk management effectiveness, and alignment with business priorities.
D) The security team's operational achievements, including the number of vulnerabilities remediated and alerts investigated.
55. Which of the following is the MOST effective way to ensure that security governance is responsive to changing business conditions?
A) Conducting an annual review of the security governance framework and making adjustments based on audit findings and lessons learned.
B) Establishing a security governance committee that meets quarterly and reviews the program's performance and alignment with objectives.
C) Building flexibility into the governance framework and establishing processes for rapid adjustment in response to business and threat changes.
D) Designing the governance framework based on industry best practices that have been proven effective in similar organizations.
56. An organization's Board has approved a new risk appetite statement. What is the MOST important action the CISO should take following this approval?
A) Update the security policies and standards to reflect the new risk appetite and communicate the changes to all employees.
B) Conduct a new risk assessment to determine whether current controls align with the new risk appetite and identify any gaps.
C) Integrate the risk appetite into security decision-making processes and ensure that all security activities are aligned with the approved appetite.
D) Report to the Board on the organization's current risk exposure and how it compares to the new risk appetite thresholds.
57. Which of the following BEST describes the difference between a security policy and a security standard?
A) A policy is a broad statement of intent, while a standard is a detailed procedure that explains how to implement the policy.
B) A policy defines the organization's position and expectations, while a standard establishes mandatory, measurable requirements for compliance.
C) A policy is approved by the Board, while a standard is developed and maintained by the security team without executive approval.
D) A policy applies to the entire organization, while a standard applies to specific business units or technology environments.
58. The CISO is establishing a security governance committee. Which of the following is the MOST important consideration in defining the committee's composition?
A) The committee should include representatives from all business units to ensure diverse perspectives and comprehensive coverage.
B) The committee should be composed primarily of security professionals who have the technical expertise to evaluate security risks effectively.
C) The committee should include executive decision-makers with the authority to allocate resources, approve strategies, and make strategic decisions.
D) The committee should be chaired by the CISO to ensure that security perspectives are represented at the governance table.
59. An organization is developing a security metrics program. Which of the following is the MOST important principle for selecting security metrics?
A) Metrics should be easy to collect and report without requiring significant manual effort from the security team.
B) Metrics should be linked to business objectives and provide actionable insights that support decision-making and resource allocation.
C) Metrics should focus on technical security controls and their performance rather than broader program outcomes and business impacts.
D) Metrics should be benchmarked against industry averages to demonstrate the organization's relative security performance.
60. Which of the following is the MOST critical element of a security governance framework?
A) A comprehensive set of security policies that cover all areas of information security and are regularly reviewed and updated.
B) A mature security risk management program that identifies, assesses, and treats all security risks appropriately.
C) Clearly defined roles, responsibilities, and accountability structures that ensure security decisions are made at the appropriate level.
D) A comprehensive security awareness program that ensures all employees understand their security responsibilities.
📌 Section 7 · Questions 61–70
61. The CISO is preparing the security budget for the next fiscal year. Which of the following is the MOST appropriate basis for allocating resources across the security program?
A) The organization's historical spending patterns and the need to maintain consistency in program operations.
B) The industry benchmarks for security spending as a percentage of revenue to ensure alignment with peer organizations.
C) The organization's risk assessment results, prioritizing investments that address the highest-priority risks and business impacts.
D) The technology roadmap and the anticipated need to upgrade or replace existing security tools and infrastructure.
62. Which of the following is the BEST indicator that security governance is effectively integrated into the organization?
A) The organization has a comprehensive set of security policies and standards that cover all areas of information security.
B) The organization has a dedicated security team with clearly defined roles, responsibilities, and reporting lines.
C) Security considerations are consistently included in business decisions, and business leaders actively participate in security governance.
D) The organization has not experienced any significant security incidents or data breaches over the past two years.
63. An organization is considering entering a new market that has significantly different regulatory requirements. What is the MOST important governance activity prior to market entry?
A) Conducting a technical assessment of the security tools needed to comply with the new market's regulatory requirements.
B) Assessing the security and compliance risks associated with the new market and incorporating them into the organization's risk profile.
C) Hiring local legal counsel to interpret the new market's regulations and develop a compliance plan for the organization.
D) Establishing a local security team to manage the security requirements of the new market independently of the corporate program.
64. Which of the following BEST describes the role of the security steering committee in the governance structure?
A) The steering committee implements security controls and manages the day-to-day security operations of the organization.
B) The steering committee provides technical guidance to the security team and advises on the selection of security technologies.
C) The steering committee provides oversight, resolves conflicts, and makes strategic decisions about security investments and priorities.
D) The steering committee conducts security audits and provides independent assurance on the effectiveness of security controls.
65. The CISO is developing a security communication plan. Which of the following is the MOST important consideration for this plan?
A) Ensuring that security communications are delivered through multiple channels to maximize employee awareness and engagement.
B) Tailoring security communications to different audiences, including the Board, executives, employees, and technical teams.
C) Including technical details in all communications to ensure that employees understand the nature and severity of security threats.
D) Communicating security issues only when they affect the organization to avoid causing unnecessary concern among employees.
66. An organization has defined its security governance principles. Which of the following is the MOST important principle to include?
A) Security must be implemented using the most advanced technologies to ensure comprehensive protection against emerging threats.
B) Security decisions must be aligned with business objectives and made with consideration of the organization's risk appetite.
C) Security must be a top priority for all employees and must be considered in all business decisions and operational activities.
D) Security must be implemented consistently across all business units and geographic locations without exception or deviation.
67. The CISO is preparing a report for the Board on the organization's security program. Which of the following should be the PRIMARY focus of this report?
A) The technical details of the security controls that have been implemented to protect critical systems and data.
B) The organization's risk exposure, the effectiveness of controls in managing that risk, and progress on strategic security initiatives.
C) The performance of the security operations team, including incident response times and the number of alerts investigated.
D) The organization's compliance with all applicable laws, regulations, and contractual obligations related to security.
68. Which of the following is the MOST effective way to ensure that security policies are understood and followed by employees?
A) Making policies easily accessible on the company intranet and requiring employees to acknowledge they have read and understood them.
B) Integrating policy requirements into employee training and performance evaluations, and consistently enforcing consequences for non-compliance.
C) Providing regular updates on policy changes and the rationale behind them through company newsletters and team meetings.
D) Involving employees in the policy development process and soliciting their input to ensure policies are practical and relevant.
69. An organization is evaluating its security governance maturity. Which of the following would indicate that governance is at the highest level of maturity?
A) Security policies and standards are documented and communicated to all employees and business units across the organization.
B) Security governance is integrated into business processes, and security metrics are regularly reported to executive management.
C) Security governance is continuously improved based on feedback, lessons learned, and changes in business and threat conditions.
D) Security governance is formally established with a steering committee and clear roles and responsibilities for all participants.
70. The CISO is developing a security governance charter. Which of the following is the MOST important element to include in this charter?
A) A detailed description of the security team's organizational structure and reporting lines.
B) A comprehensive list of the organization's security policies and their approval dates.
C) The governance authority, decision-making processes, and escalation paths for security matters.
D) The organization's risk appetite statement and its alignment with strategic objectives.
📌 Section 8 · Questions 71–80
71. Which of the following is the MOST important consideration when designing a security governance framework for a multinational organization?
A) Ensuring that the framework is based on industry best practices and is consistent with international security standards.
B) Balancing the need for consistent global governance with the flexibility to accommodate local legal, regulatory, and cultural differences.
C) Establishing a centralized security operations center that monitors security events across all geographic locations and business units.
D) Implementing the same security controls and technologies in all locations to ensure consistent protection across the enterprise.
72. The CISO is reviewing the security program's performance metrics. Which metric would provide the MOST meaningful insight into governance effectiveness?
A) The percentage of security policies that have been updated in the last 12 months to reflect current business and threat conditions.
B) The number of business decisions that were informed by security risk assessments and the outcomes of those decisions.
C) The degree to which security decisions are aligned with business objectives and risk appetite, as measured through governance reviews.
D) The number of security incidents that were escalated through the appropriate governance channels and resolved effectively.
73. An organization is implementing a new regulatory compliance program. What is the MOST important governance consideration for this program?
A) Ensuring that the compliance program is independently managed by the legal department to avoid conflicts with business objectives.
B) Implementing the compliance requirements as quickly as possible to avoid fines and penalties from regulatory authorities.
C) Integrating compliance requirements into the security governance framework to ensure consistent oversight and accountability.
D) Outsourcing compliance activities to external consultants who have expertise in the specific regulatory requirements.
74. Which of the following is the GREATEST risk when security governance is not aligned with enterprise risk management?
A) The security program may focus on risks that are not the highest priority from an enterprise perspective.
B) The organization may have inconsistent risk reporting and decision-making across different departments and functions.
C) The security team may not have access to the enterprise risk data needed to make informed decisions about security investments.
D) The organization may fail to meet regulatory compliance requirements for integrated risk management reporting.
75. The CISO is presenting the security strategy to the Board. Which of the following is the MOST effective way to begin this presentation?
A) A detailed overview of the current security threat landscape and the specific threats facing the organization.
B) A summary of the organization's current security capabilities and the investments required to close identified gaps.
C) An articulation of the organization's strategic business objectives and how the security strategy will enable and protect those objectives.
D) A comparison of the organization's security maturity against industry benchmarks and peer organizations.
76. Which of the following BEST describes the relationship between security governance and security culture?
A) Governance defines the security policies, and culture ensures that employees understand and follow those policies.
B) Culture is a component of governance that focuses on the human aspects of security, including awareness and behavior.
C) Governance establishes the structures and accountability, while culture reflects the attitudes and behaviors that determine whether governance is effective.
D) Culture is the result of effective governance, and it reinforces the principles and expectations defined by the governance framework.
77. An organization is developing a security governance framework. Which of the following should be the FIRST step in this process?
A) Conducting a risk assessment to identify the organization's key security risks and vulnerabilities.
B) Selecting a recognized governance framework such as COBIT or ISO 27001 as the foundation for the program.
C) Engaging executive management and the Board to secure their commitment and define the governance vision and objectives.
D) Developing a comprehensive set of security policies and standards to guide all security activities.
78. The CISO is reviewing the organization's security governance documentation and identifies that several policies are contradictory. What is the MOST appropriate action?
A) Document the contradictions and ignore them until the next policy review cycle to avoid disrupting ongoing operations.
B) Initiate an immediate review to resolve the contradictions and ensure all policies are consistent and aligned with governance principles.
C) Communicate the contradictions to employees and allow them to use professional judgment in determining which policy applies.
D) Escalate the contradictions to the security steering committee and request that they prioritize the resolution of policy conflicts.
79. Which of the following is the MOST effective way to measure the effectiveness of security governance?
A) The number of security incidents that have been prevented or successfully contained by the security program.
B) The extent to which security decisions are aligned with business objectives and risk appetite, as assessed through governance reviews.
C) The percentage of employees who have completed security awareness training and can demonstrate understanding of security policies.
D) The frequency with which the security governance committee meets and the number of decisions made during those meetings.
80. An organization is facing a significant security incident that requires immediate executive attention. What is the MOST appropriate governance response?
A) The CISO should make all decisions about the incident response and inform executives after the incident is contained.
B) The security team should follow the incident response plan and report progress to executives on a weekly basis.
C) The CISO should escalate the incident through the governance structure and ensure the Crisis Management Team is activated for executive decision-making.
D) The security team should handle the incident independently and request executive approval only when additional resources are required.
📌 Section 9 · Questions 81–90
81. The CISO is developing a security governance framework for the organization. Which of the following is the MOST important benefit of establishing this framework?
A) It ensures that all security controls are implemented consistently across the organization and are regularly tested.
B) It provides a formal structure for security decision-making that is independent of individual personalities and preferences.
C) It establishes clear accountability and enables the Board to exercise oversight over security risks and investments.
D) It ensures that the organization complies with all applicable laws, regulations, and contractual obligations related to security.
82. Which of the following is the MOST important consideration when defining the CISO's role in the governance structure?
A) The CISO should have direct access to the Board and the authority to make decisions about security investments and priorities.
B) The CISO should have the authority to advise executives and the Board and to recommend security strategies, but accountability rests with the Board and executives.
C) The CISO should report to the CIO and focus on implementing security controls and managing the security operations team.
D) The CISO should be responsible for all security decisions and should be held accountable for the outcomes of those decisions.
83. An organization is establishing a security awareness program. Which of the following governance elements is MOST critical for the program's success?
A) The program should include interactive training modules and gamification to maintain employee engagement and participation.
B) The program should be delivered by external experts who have experience in security awareness and training best practices.
C) The program should be mandated by policy, approved by executive management, and include metrics to measure effectiveness and compliance.
D) The program should be customized for each business unit to address their specific security risks and operational contexts.
84. Which of the following is the MOST effective way for the CISO to influence security governance decisions?
A) Building personal relationships with key decision-makers and advocating for security priorities through informal channels.
B) Presenting technical evidence of security risks and vulnerabilities to demonstrate the need for specific security investments.
C) Providing clear, business-relevant information and analysis that enables executives to make informed decisions about security risks and investments.
D) Escalating security issues to the Board directly when executives are not responsive to security recommendations and requests.
85. An organization is developing a security metrics program. Which of the following is the MOST important principle to follow?
A) Metrics should be comprehensive and cover all aspects of the security program to provide a complete picture of performance.
B) Metrics should be easy to collect and report without requiring significant manual effort from the security team.
C) Metrics should be linked to business objectives and provide actionable insights for decision-making and improvement.
D) Metrics should be benchmarked against industry averages to demonstrate the organization's relative security performance.
86. The CISO is preparing the security strategy for the organization. Which of the following is the MOST appropriate basis for the strategy's priorities?
A) The security industry trends and emerging threats identified by leading research firms and security conferences.
B) The organization's business objectives and the risks that could prevent the organization from achieving those objectives.
C) The results of the most recent security risk assessment and the specific vulnerabilities identified in critical systems.
D) The organization's historical security spending and the need to maintain consistency in resource allocation.
87. Which of the following is the MOST effective way to ensure that security governance is sustainable over time?
A) Building governance into the organization's DNA through consistent leadership commitment, training, and regular communication.
B) Documenting governance structures and processes and ensuring they are reviewed and updated at least annually.
C) Embedding governance into existing business processes and decision-making frameworks, not treating it as a separate initiative.
D) Establishing a governance committee with representatives from all business units and ensuring they meet regularly.
88. An organization is evaluating its security governance framework. Which of the following indicates that the framework is effective?
A) The organization has not experienced any significant security incidents or data breaches in the past year.
B) The security team has implemented all the controls identified in the risk assessment and vulnerability scans.
C) Security considerations are consistently integrated into business decisions, and stakeholders have confidence in the program's direction.
D) The security governance committee meets regularly and makes decisions that are documented and communicated to stakeholders.
89. The CISO is reviewing the organization's security governance framework. Which of the following should be the PRIMARY objective of this framework?
A) To ensure that all security controls are implemented consistently and effectively across the organization.
B) To provide a formal structure for security decision-making and accountability for security outcomes.
C) To align security activities with business objectives and ensure that security enables rather than hinders business success.
D) To ensure compliance with all applicable laws, regulations, and contractual obligations related to information security.
90. Which of the following is the GREATEST risk of not having a formal security governance framework in place?
A) The organization may fail to implement security controls consistently across different business units and geographic locations.
B) The organization may not have documented security policies and procedures to guide employee behavior and decision-making.
C) The organization may make security decisions without considering business impact, leading to inefficient resource allocation and unmanaged risk exposure.
D) The organization may fail to detect and respond to security incidents because of inadequate monitoring and response capabilities.
📌 Section 10 · Questions 91–100
91. The CISO is preparing a report on the security program's maturity. Which of the following should be the PRIMARY focus of this report?
A) The specific areas where the program has improved compared to the previous maturity assessment.
B) The current maturity level of each security domain and the specific initiatives needed to achieve the next level.
C) The alignment of the program's maturity with business objectives and risk appetite, and the strategic priorities for improvement.
D) The organization's maturity compared to industry benchmarks and peer organizations in the same sector.
92. Which of the following is the MOST effective way for the CISO to manage stakeholder expectations regarding security?
A) Setting clear expectations through formal service level agreements and regular performance reporting to stakeholders.
B) Engaging stakeholders regularly to understand their needs, communicating risks transparently, and providing realistic options for managing them.
C) Ensuring that all security initiatives are aligned with industry best practices and are consistent with peer organizations' security capabilities.
D) Providing detailed technical reports that demonstrate the security team's effectiveness in protecting the organization's assets.
93. An organization is developing a security governance framework. Which of the following is the MOST critical element to include in the framework?
A) A comprehensive set of security policies and standards that apply to all employees and business units.
B) A detailed security risk register that documents all identified risks and their treatment plans and owners.
C) Clear definitions of governance structures, roles, responsibilities, and accountability for security decisions and outcomes.
D) A comprehensive security metrics program that measures the effectiveness and efficiency of the security program.
94. The CISO is evaluating the effectiveness of the security governance committee. Which of the following is the BEST indicator of the committee's effectiveness?
A) The frequency of committee meetings and the attendance rate of its members.
B) The number of security decisions made by the committee and the speed of decision-making.
C) The extent to which committee decisions are implemented effectively and lead to improved security outcomes.
D) The quality of the documentation produced by the committee and its alignment with governance best practices.
95. Which of the following is the MOST important factor in building a security governance culture in the organization?
A) The implementation of comprehensive security policies and standards that apply to all employees.
B) The enforcement of security policies through consistent consequences for non-compliance and violations.
C) The visible commitment of leadership to security and their active participation in governance activities and decision-making.
D) The establishment of a security awareness program that educates employees on security policies and risks.
96. An organization is evaluating its security governance framework. Which of the following indicates that the framework is mature and effective?
A) Security governance is formally documented and reviewed annually by the security team.
B) Security governance is integrated into business processes and is regularly reviewed and improved based on feedback and lessons learned.
C) Security governance is embedded in the organization's culture and continuously adapted to changing business conditions and threats.
D) Security governance is supported by a comprehensive set of policies and standards that are communicated to all employees.
97. The CISO is developing a security investment plan for the organization. Which of the following is the MOST appropriate basis for prioritizing security investments?
A) The security industry's emerging trends and the need to adopt advanced technologies to stay ahead of threats.
B) The results of the most recent vulnerability assessment and the remediation of identified security weaknesses.
C) The organization's risk profile and the potential impact of each risk on business objectives and strategic priorities.
D) The organization's historical security spending and the need to maintain consistency in resource allocation.
98. Which of the following is the MOST important consideration when delegating security authority to business unit leaders?
A) Ensuring that business unit leaders have the necessary technical expertise to make informed security decisions.
B) Ensuring that business unit leaders are held accountable for security outcomes through performance reviews and metrics.
C) Ensuring that delegated authority is consistent with the organization's risk appetite and that there is appropriate oversight and reporting.
D) Ensuring that business unit leaders have access to the security tools and resources needed to manage security effectively.
99. An organization is developing a security governance framework. Which of the following is the MOST effective approach to ensure the framework is adopted and sustained?
A) Designing the framework based on industry best practices and mandating its adoption across all business units through policy enforcement.
B) Implementing the framework through a phased approach, starting with the most critical business units and expanding to the entire organization.
C) Engaging key stakeholders in the design process, securing executive sponsorship, and embedding governance into existing business processes.
D) Training all employees on the framework's requirements and establishing a compliance monitoring program to track adoption and adherence.
100. Which of the following BEST describes the ultimate objective of information security governance?
A) To ensure that all security controls are implemented effectively and that security incidents are responded to promptly.
B) To enable the organization to achieve its business objectives while managing security risks within the defined risk appetite.
C) To ensure compliance with all applicable laws, regulations, and contractual obligations related to information security.
D) To establish clear roles, responsibilities, and accountability for security decisions and outcomes across the organization.
🔄 Click any option to check your answer · CISM Domain 1 – Information Security Governance
You Might Also Like

You may also like

How To Give Effective Feedback To Employees – 152 Real Life Examples

50 Powerful Sentences For Assertive Leaders

Portfolio Management Competency Dashboard: Self-Assessment & Radar Analysis

A 220 Points Comprehensive Checklist for Small Businesses

Mastering SEO with RankMath: A Comprehensive Guide to Boost Your Website’s Ranking

The Power of ChatGPT – 20 Powerful Features for Your Business

This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Accept Read More

Privacy & Cookies Policy