Organizational Structures, Roles and Responsibilities CISM Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary risk that segregation of duties is designed to mitigate?

   • AInsufficient budget for security tools
   • BHigh turnover of security staff
   • CConflicts of interest and unauthorized actions
   • DLack of technical expertise
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An organization is creating a security steering committee to improve governance. Which composition best ensures the committee can effectively prioritize security initiatives and allocate resources?

   • ARepresentatives from IT, legal, HR, and business units, chaired by the CISO.
   • BExternal auditors and consultants, chaired by the CEO.
   • CAll members of the security team, chaired by the CISO.
   • DIT managers only, chaired by the CIO.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A financial institution is implementing segregation of duties in its security operations. The team has only five members, and the current process requires that the same analyst who detects a security incident also performs the forensic investigation and reports the findings to management. Which approach best reduces the risk of conflict of interest while considering the small team size?

   • AOutsource the forensic investigation to an external firm to ensure independence.
   • BHave the analyst document their own investigation and have the team manager review the documentation.
   • CAllow the same analyst to perform all tasks to maintain efficiency, given the small team.
   • DRequire that a different analyst performs the forensic investigation and that the original analyst only reports the detection.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is deciding where the information security function should report. The CISO currently reports to the CIO, but the board is concerned that security decisions are being influenced by IT operational priorities. Which reporting line would best address this concern?

   • AReport to the Chief Financial Officer (CFO).
   • BRemain reporting to the CIO but with a dotted line to the board.
   • CReport directly to the CEO or board.
   • DReport to the Chief Operating Officer (COO).
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is defining the roles of the board, executive management, and the CISO in information security governance. Which allocation of responsibilities best reflects the principle that the board sets the risk appetite, executive management implements the strategy, and the CISO manages the security program?

   • ABoard approves the risk appetite; executive management ensures the security strategy aligns with it; CISO implements and operates the security program.
   • BBoard approves the security strategy; executive management sets the risk appetite; CISO implements the strategy.
   • CCISO sets the risk appetite; board approves the security strategy; executive management implements the program.
   • DExecutive management sets the risk appetite; board approves the security strategy; CISO implements the program.
   Reveal Solution Discussion Select an answer first