Information Security Management Program ACCISO Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A government agency's ISMP includes a metrics program. The agency's leadership wants to understand the overall security posture and whether the ISMP is meeting its objectives. Which type of metric would be most useful for this high-level assessment?

   • APercentage of systems compliant with the organization's security baseline
   • BAverage time to patch critical vulnerabilities
   • CNumber of security incidents reported per month
   • DNumber of security awareness training sessions held
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which governance framework is commonly used to align an ISMP with organizational strategy?

   • ATOGAF
   • BITIL
   • CCOBIT
   • DISO 9001
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   An organization's ISMP has been in place for three years. An external audit found that the program is not adapting to new threats, and the risk assessment process is not integrated with incident response. The CISO must improve the program. Which action is most effective for continuous improvement?

   • AConduct more frequent risk assessments without changing how they are used.
   • BIncrease the security team's budget to hire more analysts.
   • CEstablish a formal process to feed incident lessons learned back into the risk assessment and update controls accordingly.
   • DReplace the current risk assessment methodology with a more advanced one.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of an Information Security Management Program (ISMP) within an organization?

   • ATo maximize the organization's return on investment in technology
   • BTo replace the need for technical security controls with administrative measures
   • CTo ensure that all employees have access to the internet and email services
   • DTo establish a framework that protects the confidentiality, integrity, and availability of information assets
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A retail company's ISMP includes a security awareness program. After a phishing simulation, the security team finds that employees in the finance department click on simulated phishing emails at a higher rate than other departments. The team wants to improve the program's effectiveness. Which action is most aligned with the ISMP's awareness and training objective?

   • AIncrease the frequency of phishing simulations for all employees without additional training
   • BProvide targeted, role-based training for the finance team on phishing recognition and reporting
   • CDisable email for the finance department until their click rate improves
   • DSend a company-wide email reminding all employees to be careful with emails
   Reveal Solution Discussion Select an answer first