Free Certified Information Security Manager (CISM) practice test: 30 questions with answers

A documented architecture with controls mapped to requirements, reviewed regularly, gives the program a measurable basis for improvement. Tools without architecture, team size and yearly events do not show whether the program is effective.

Outcome metrics show whether the program is achieving its objectives, which is what effectiveness means. Activity, volume and form-completion metrics show work done rather than results.

Root-causing the gap, adjusting the design and measuring the result is an improvement cycle that fixes the real problem. Replacing or stacking controls without analysis may repeat the failure, and removing the control leaves a risk unaddressed.

Linking the investment to a quantified reduction in business risk gives the leader a justification in business terms. Competitor comparisons, workload and time since the last budget do not show value to the business.

An awareness team working with business leaders to tailor content to each function's risks changes behaviour, because the content matches what people actually do. A help desk, a single annual email and audit testing do not change behaviour in a structured way.

Applying a cloud security standard before approval closes the gap as adoption continues. Delaying adoption harms the business, unmanaged choices spread risk, and a single service ban pushes use underground without a review process.

A change process with approval, testing and rollback, enforced through access control, prevents unauthorised changes before they reach production. Shared accounts remove accountability, and after-the-fact emails and annual reviews detect changes without preventing them.

Including business leaders in planning and reviewing objectives after major changes keep the program aligned with what the business needs. Technical-only reporting, infrequent reviews and imposing controls without consultation all weaken alignment.

The business process owner is accountable for the outcomes and bears the impact of the residual risk, so the decision belongs to them, with the security manager advising. Auditors review after the fact, and the help desk does not own business risk.

Where impact is intolerable, mitigating the impact with controls that limit loss is appropriate even when likelihood is low. Accepting, ignoring or removing the process from scope leave an unacceptable impact in place.

Identifying assets, their value, and the threats and vulnerabilities that apply comes first, because controls can only be selected once the risk is understood. Selecting controls, testing them and writing response plans all depend on that analysis.

Ranking by likelihood and impact against risk appetite gives a defensible order that reflects the organisation's tolerance. Alphabetical order and random assignment ignore risk, and deleting below-average risks removes them without analysis.

Risk trend against appetite, with business impact, translates technical data into decisions executives can act on. Signature updates, rule changes and log volumes describe activity rather than risk.

Assessing the vendor's controls against requirements before signing identifies gaps while they can still be negotiated. A non-disclosure agreement is not a security control, transferring data before assessment exposes it, and a certificate without a scope review skips the assessment.

A backup generator restores power after an outage has happened, which makes it a corrective control. It does not prevent the outage, detect it, or replace a missing policy.

Transferring risk by insurance does not remove the organisation's responsibility to monitor residual exposure and the terms of the coverage. Removing the risk from the register or expecting the insurer to run internal controls is incorrect.

A strategy mapped to business goals, with progress metrics, answers the board's question about alignment. A tool list, a test plan and a vulnerability count describe activity and do not show how security supports business objectives.

A named owner for each processing activity, recorded in policy, shows who is answerable for the data. A RACI matrix is broader, training shows awareness rather than accountability, and a storage list documents location rather than ownership.

Assessing the gap and its causes shows whether the problem is awareness, resources or an unrealistic policy, which decides the right response. Notices, rewriting and blocking each act before the cause is known.

Periodic reviews with business leaders, using defined metrics and trigger points, keep governance aligned as the business changes. A one-time approval, a fixed budget and a ban on change let the strategy drift from the business.

A documented risk acceptance with compensating controls, a review date and the owner's sign-off makes the exception visible, justified and time-limited. Approving without review, exempting permanently and rejecting without discussion each fail to manage the risk properly.

Clear accountability and board-level reporting against business objectives are the core of effective governance. Updating policy only after audits, centralising every decision in IT and a fixed budget each weaken governance.

An information security charter or policy approved by the board establishes the program's authority, purpose and scope. A training calendar, a scan report and a rule base are operational records and do not establish authority.

Containment limits the damage, and preserving evidence supports the investigation and any legal or regulatory need. Notifying customers, reimaging everything and waiting for approval each act before the scope is known, and they can destroy evidence or delay the response.

Roles, escalation paths and decision authority, rehearsed by the team, determine whether an incident is handled quickly and correctly. Policy text, tool catalogues and diagrams support the response but do not direct it.

A post-incident review examines root cause and improves controls, processes and the response, which prevents recurrence. Blaming individuals discourages reporting, quick closure skips learning, and press statements serve communications rather than improvement.

Restoring from verified clean backups after removing access avoids reinfection, and tracking lessons learned with owners and dates prevents repeats. Restoring infected images, closing without root cause analysis and withholding the cause from stakeholders all raise the risk of recurrence.

Chain of custody and work on verified copies show that the evidence is authentic and unaltered, which is what makes the investigation defensible. Working on originals, editing logs and destroying evidence each undermine admissibility.

The privacy or legal function and the incident response lead are the people the plan typically requires to be notified first, because they decide the obligations and the next steps. Marketing, all staff and a single vendor are not the first notification.

Measuring detection and containment times and seeing them improve shows that capability is growing. Unreported incidents, same-day closure regardless of cause and unplanned response are signs of weakness.