Organizational Structures, Roles and Responsibilities CISM Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A global organization is redesigning its security governance. The board wants consistent risk reporting, but regional business units require agility to respond to local threats. The CISO is concerned about maintaining segregation of duties across regions. Which approach best balances these competing needs?

   • AOutsource security operations to a single global provider to ensure consistency and segregation.
   • BImplement a hybrid model with global standards and regional implementation, and require independent local review of security changes.
   • CAdopt a decentralized model to maximize regional agility and local control.
   • DAdopt a fully centralized model to ensure consistent reporting and eliminate regional variations.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security steering committee is struggling to make decisions because the CISO and the business unit leaders have conflicting priorities. The CISO wants to implement strict controls, while business leaders want to minimize disruption. Which action would best help the committee resolve this conflict and make effective decisions?

   • AEscalate all unresolved conflicts to the board for decision.
   • BAllow the CISO to make the final decision on all security matters.
   • CAllow business leaders to override security requirements when they cause disruption.
   • DHave the CISO present risk-based options that show the trade-offs between security and business impact.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is typically a member of a security steering committee?

   • AJunior security analyst
   • BHelp desk technician
   • CExternal penetration tester
   • DChief information officer (CIO)
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a potential disadvantage of the information security function reporting to the CIO?

   • AIt ensures security is aligned with business strategy
   • BIt may lead to conflicts of interest because IT is responsible for implementing systems that security must review
   • CIt increases the independence of the security function
   • DIt eliminates the need for a separate security budget
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which scenario best demonstrates the principle of segregation of duties in information security?

   • AA security analyst is responsible for monitoring alerts, while a separate team handles incident response
   • BA database administrator grants access to a system and also reviews access logs
   • CA single administrator manages both the firewall and the VPN concentrator
   • DA security administrator also performs internal audits of the security controls
   Reveal Solution Discussion Select an answer first