A multinational corporation operates in a country with strict data protection regulations and also has a global presence. The company is considering adopting ISO/IEC 27001 for its information security management. The board is concerned about the cost and effort of certification. What is the primary business benefit that justifies the investment?

It guarantees the company will not experience a data breach

It automatically ensures compliance with all local data protection laws

It eliminates the need for any other security controls

It provides a competitive advantage by demonstrating a commitment to security to customers and partners

A security manager is evaluating the effectiveness of a security awareness program. The phishing simulation click rate has decreased from 20% to 5% over the past year. However, the number of real-world phishing incidents that result in data breaches has not decreased. What is the most likely explanation for this discrepancy?

The training program is not effective

The simulated phishing emails are too easy to identify

The security team is not reporting all incidents

The real-world incidents are not related to phishing

Certified Information Systems Auditor

Domain 5Objective 1

Security Frameworks and Governance CISA Practice Questions (Page 4)

Part of the Protection of Information Assets domain, which accounts for 26% of the CISA exam.

24questions here

5free pages

4concepts

26%of the exam

Questions 16–20

16foundation · easy
An organization has a policy requiring strong passwords. Which document type would provide specific technical requirements, such as minimum length and complexity, that must be followed to comply with the policy?
Select an answer first
17foundation · easy
In information security governance, which term describes a high-level statement of management intent that guides decision-making and establishes the overall direction for security?
Select an answer first
18expert · hard
A multinational corporation operates in a country with strict data protection regulations and also has a global presence. The company is considering adopting ISO/IEC 27001 for its information security management. The board is concerned about the cost and effort of certification. What is the primary business benefit that justifies the investment?
Select an answer first
19application · medium
A manufacturing company wants to improve its cybersecurity posture by focusing on a framework that is risk-based and helps identify, protect, detect, respond, and recover from cyber threats. The company is not seeking certification. Which framework is most suitable?
Select an answer first
20expert · hard
A security manager is evaluating the effectiveness of a security awareness program. The phishing simulation click rate has decreased from 20% to 5% over the past year. However, the number of real-world phishing incidents that result in data breaches has not decreased. What is the most likely explanation for this discrepancy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISA” is a trademark of its owner, used for identification only.

Security Frameworks and Governance CISA Practice Questions (Page 4)

Questions 16–20

An organization has a policy requiring strong passwords. Which document type would provide specific technical requirements, such as minimum length and complexity, that must be followed to comply with the policy?

In information security governance, which term describes a high-level statement of management intent that guides decision-making and establishes the overall direction for security?

A manufacturing company wants to improve its cybersecurity posture by focusing on a framework that is risk-based and helps identify, protect, detect, respond, and recover from cyber threats. The company is not seeking certification. Which framework is most suitable?

Keep studying — Protection of Information Assets