Organizational Structures, Roles and Responsibilities CISM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security steering committee has been formed to review and prioritize security initiatives. Which outcome indicates that the committee is functioning effectively?

   • AThe committee meets monthly and documents decisions.
   • BThe committee is chaired by the CISO and includes only security staff.
   • CThe committee approves all security projects without modification.
   • DThe committee aligns security investments with the organization's risk appetite and business strategy.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A multinational corporation with autonomous regional business units is designing its information security governance structure. Each region has its own IT and security teams, but the board wants consistent security metrics and risk tolerance across the enterprise. Which organizational structure best meets these needs?

   • AHybrid — global security sets standards and risk tolerance, while regional teams implement and adapt to local requirements.
   • BFederated — each region operates independently but reports security incidents to a central coordinator.
   • CCentralized — all security decisions and operations are managed by a single global team.
   • DDecentralized — each regional business unit manages its own security independently with no central oversight.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which organizational structure for information security governance places security decision-making authority primarily within each business unit, with limited central oversight?

   • ADecentralized
   • BHybrid
   • CMatrix
   • DCentralized
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A small company has a single IT administrator who currently manages user accounts, assigns permissions, and also reviews security audit logs. To improve segregation of duties without hiring additional staff, which action is most appropriate?

   • AAssign the review of audit logs to a manager from a different department, even if not a security expert.
   • BHave the administrator continue as is, since the company is too small to separate duties.
   • COutsource the administrator's duties to a third party to avoid internal conflicts.
   • DAutomate all security controls so that no human review is needed.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An organization is defining the role of executive management in information security governance. Which responsibility is most appropriate for executive management?

   • AApprove the overall security strategy and ensure it aligns with business objectives.
   • BApprove individual firewall rule changes.
   • CConduct technical vulnerability assessments.
   • DImplement daily security monitoring and incident response.
   Reveal Solution Discussion Select an answer first