Information Security Governance

CISM · 54 questions

• A newly hired information security manager discovers that business units routinely skip the security review step so they can hit product launch dates, and no one has been sanctioned for it. What should the security manager do FIRST?
• After several employees were disciplined for clicking phishing links, staff have stopped reporting suspicious emails, and the security team now learns of compromises only days later. Which action would BEST restore timely reporting?
• A fast-moving technology startup is being merged into a heavily regulated bank, and the two organizations have very different attitudes toward security. The security manager is asked to establish a common security culture for the combined entity. Which approach is BEST?
• In a strategy workshop, several executives describe information security as purely an IT department problem and decline to take part in security decisions. Which action is MOST likely to shift ownership toward the business?
• A security manager wants to show the executive committee whether the organization's security culture is actually improving. Which indicator is the MOST meaningful?
• A global policy requires that confidential documents be stored only in approved repositories, but a regional office keeps sharing them through personal messaging groups because that is how local teams have always collaborated. What should the security manager do?
• Business units view the security team as an obstacle and increasingly launch projects without involving it, discovering security requirements only late in delivery. Which action is MOST likely to build partnership and bring security in earlier?
• The chief executive asks the security manager to exempt the executive team from multifactor authentication because it slows them down when traveling. What is the BEST response?
• A company plans to begin selling services in a new country that has recently enacted a data protection law. What should the security manager do FIRST?
• One country where the company operates requires transaction records to be retained for several years, while another jurisdiction's privacy law requires that personal data in those same records be deleted once it is no longer needed. What is the BEST approach?
• A key customer contract requires the company to notify the customer of any breach affecting its data within a shorter window than the applicable regulator requires. How should the incident response procedures address this?
• An external audit found the organization fully compliant with its industry regulation, yet a month later attackers exploited a weakness in a business system that the regulation does not cover and that had never been risk assessed. What does this MOST likely indicate?
• A regulator asks who in the organization is ultimately accountable for ensuring that customer personal data is handled in line with legal requirements. Which answer is correct?
• The business wants to move customer records to a cloud provider region located outside the home country to reduce costs. What should the security manager do FIRST?
• Over the past year, several new regulations affecting the organization were missed until external auditors raised them. What is the BEST long-term remedy?
• Remediation funds can close only one of two compliance gaps this quarter. One gap relates to a regulator that has been especially active in public enforcement; the other exposes a larger volume of sensitive data to a threat that is actively exploited. How should the security manager prioritize?
• The security manager currently reports to the CIO, who also runs IT operations and has repeatedly delayed security findings that would affect operational targets. The board is reviewing where the security role should report. What is the MOST important consideration?
• A database administrator and the manager of the business unit that uses a customer data set disagree about who may grant access to it. According to sound governance, who should decide the access rules?
• An organization is forming an information security steering committee to set priorities and resolve cross-functional issues. Which membership would make the committee MOST effective?
• The RACI chart for a new cloud platform lists several teams as responsible for quarterly user access reviews, but no one is marked as accountable. What is the BEST action?
• Newly appointed board members ask the security manager what their role in information security should be. Which description is MOST appropriate?
• A security administrator who grants and modifies user privileges is also the person who reviews the logs of privilege changes each week. What is the BEST corrective action?
• Internal audit offers to take over the security team's continuous monitoring of key controls, arguing that its independence would make the results more reliable. How should the security manager respond?
• A global group with subsidiaries regulated in several different jurisdictions is deciding whether its information security function should be centralized or federated. What should drive the decision?
• A security manager has been asked to develop a new information security strategy for the organization. What should the security manager do FIRST?
• While developing the information security strategy, the security manager has documented the current state of security and now needs to define the desired state for a gap analysis. How should the desired state be determined?
• The board approved a three-year information security strategy, but no executive has taken ownership of it, and most initiatives have stalled waiting for decisions from business units. What is MOST likely to restore momentum?
• Midway through a three-year security strategy, the company announces a cloud-first transformation that will move most business applications to external providers within two years. What is the BEST action for the security manager?
• A risk assessment is complete, and the security manager must sequence a three-year roadmap. Proposed initiatives are a behavioral analytics platform, data loss prevention that relies on data labels, a policy refresh with a data classification scheme, and an automated response tool. Which initiative should be scheduled FIRST?
• After approving a new information security strategy, board members ask how they will know whether it is working. Which measure would BEST answer their question?
• The security manager reviews recent internal and external developments to decide whether the information security strategy needs revision. Which development is MOST likely to require a strategic change rather than an operational adjustment?
• A draft information security strategy lists several items in a single table. Which item is a constraint on the strategy rather than an objective of it?
• The security manager begins developing an information security strategy and finds that the organization has never defined its risk appetite. What is the BEST course of action?
• An organization adopted a well-known security governance framework exactly as published. A year later, teams are overwhelmed by requirements that do not fit the business, and many controls address risks the organization does not face. What should the security manager do?
• A project team is preparing for ISO/IEC 27001 certification and keeps confusing it with ISO/IEC 27002. Which statement correctly describes the relationship between the two standards?
• Executives want a framework focused on the governance and management of enterprise information and technology, aligning IT with stakeholder goals, rather than a catalogue of technical controls. Which framework BEST fits this need?
• The security manager needs a common, nontechnical language to explain the organization's cybersecurity posture and priorities to the board. Which approach would BEST meet this need?
• An organization claims that information security governance is integrated into its corporate governance. Which observation provides the BEST evidence that this is true?
• Three frameworks, one required by a regulator and two by major customers, each impose separate audits on the same operational teams, causing duplicate evidence requests and audit fatigue. What is the BEST approach?
• In an organization's information security governance structure, which element sets direction by stating management's intent and expectations?
• The security manager is preparing a business case for a security monitoring platform to present to the executive committee. Which content would be MOST persuasive to that audience?
• Halfway through the year, the security budget is cut by a significant amount, and not all planned initiatives can continue. What should the security manager do?
• The steering committee returns a draft business case for a new identity management platform because it presents only the chosen product and its benefits. Which addition would MOST improve the business case?
• A business case rests entirely on a single annualized loss expectancy figure, and executives question how reliable that number is. What should the security manager do?
• The security team is short-staffed for round-the-clock monitoring, and management must choose between hiring more analysts and outsourcing monitoring to a managed service provider. What is the MOST important consideration?
• A proposal to buy a data protection platform shows the purchase price and implementation fees but nothing beyond go-live. What key information is missing that management needs to make a sound decision?
• A large security program was funded two years ago on the basis of expected risk reduction, but no one has checked whether the promised benefits were delivered. What should the security manager do?
• Security budget requests are repeatedly submitted after the enterprise annual planning cycle has closed, so they compete for leftover contingency funds. What is the BEST long-term fix?
• The enterprise architecture team has started designing a new target-state architecture to support the company's five-year business strategy. At what point should information security be involved?
• A newly appointed security manager asks how the organization's enterprise architecture repository can help the information security program. Which answer BEST describes its value?
• An information security manager must decide which systems deserve the strongest protection, but the IT inventory lists hundreds of applications with no indication of business importance. The enterprise architecture repository maps business capabilities to the processes and applications that support them. Which approach BEST determines system criticality?
• During an enterprise architecture review, the information security manager discovers that several business units run cloud-based applications that are not recorded in the architecture inventory and were never assessed for security. What should the information security manager do FIRST?
• An organization's architecture review board approves all new solution designs, but its review criteria cover only cost, performance and interoperability. Several approved designs later required expensive security rework. Which action would BEST address the underlying problem?
• A legacy customer platform will be retired over three years through several interim architecture states in which old and new systems exchange data. The target architecture has already been fully assessed for security. What should the information security manager ensure?