Security Frameworks and Governance CISA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security manager has been running a security awareness program for a year. To determine whether the program should be continued, modified, or discontinued, which action provides the most reliable basis for this decision?

   • AReviewing the number of training sessions conducted
   • BChecking the training budget was fully spent
   • CComparing the results of security assessments and incident metrics before and after the program
   • DAsking employees if they liked the training
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A financial services firm is launching a security awareness program. The compliance officer insists that the program must be tailored to different roles within the organization. Which approach best satisfies this requirement?

   • ADeliver the same annual training to all employees
   • BFocus training only on IT staff
   • CProvide role-based training modules that address the specific risks and responsibilities of each job function
   • DUse a single generic online course for everyone
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which framework is primarily designed to provide a comprehensive set of controls and best practices for establishing, implementing, maintaining, and continually improving an organization's information security management system?

   • AISO/IEC 27001
   • BTOGAF
   • CITIL
   • DCOBIT
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which metric is most commonly used to evaluate the effectiveness of a security awareness program?

   • APercentage of employees who complete the training
   • BReduction in the number of successful phishing attacks
   • CNumber of security incidents reported by employees
   • DNumber of security policies updated
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A global company has offices in regions with very different threat landscapes. The headquarters mandates a single, uniform security awareness program for all employees. The regional security leads argue that the program is not effective because it does not address local risks. The CISO wants to improve effectiveness while maintaining a consistent corporate message. What is the best approach?

   • ACreate a core corporate training module for all employees and allow regions to add locally relevant modules
   • BRequire all regions to use the exact same training modules
   • CEliminate the corporate program and rely on regional initiatives
   • DAllow each region to develop its own completely independent program
   Reveal Solution Discussion Select an answer first