Organizational Structures, Roles and Responsibilities CISM Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services firm operates in multiple countries with strict local data protection regulations. The firm wants to maintain consistent security policies globally while allowing local teams to implement controls that meet regional legal requirements. Which organizational structure is most appropriate?

   • AOutsource security to a global managed security service provider.
   • BDecentralized structure where each country operates independently.
   • CCentralized structure with a single global security team.
   • DHybrid structure with global policy and local implementation.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   In a large organization, the same individual is responsible for both approving and implementing changes to firewall rules. Which risk does this create, and what is the best mitigation?

   • ARisk of configuration errors; mitigation is to provide more training.
   • BRisk of unauthorized changes; mitigation is to require a second person to approve changes.
   • CRisk of slow change implementation; mitigation is to automate the approval process.
   • DRisk of vendor lock-in; mitigation is to use multiple firewall vendors.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of a security steering committee in information security governance?

   • ATo audit the effectiveness of security controls
   • BTo perform daily security monitoring and incident response
   • CTo provide strategic direction and oversight for the security program
   • DTo enforce security policies through disciplinary actions
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which organizational structure for information security governance is characterized by a central security team that sets standards and provides oversight while business units retain some implementation flexibility?

   • AHybrid
   • BDecentralized
   • COutsourced
   • DCentralized
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is considering moving the CISO reporting line from the CIO to the Chief Risk Officer (CRO). What is the primary advantage of this change?

   • AIt will improve alignment between security and enterprise risk management.
   • BIt will eliminate the need for a security steering committee.
   • CIt will reduce the security budget.
   • DIt will make the CISO responsible for all risk types.
   Reveal Solution Discussion Select an answer first