Program Communication and External Management CISM Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In the third-party risk management lifecycle, which phase involves assessing the security posture of a potential vendor before signing a contract?

   • AMonitoring
   • BTermination
   • CDue diligence
   • DContracting
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When reporting to the board of directors, which type of information is MOST appropriate to emphasize?

   • ANames of individual employees who caused incidents
   • BDetailed technical vulnerabilities
   • CSpecific security tool configurations
   • DStrategic risks and alignment with business objectives
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is terminating its contract with an IT outsourcing provider that had access to sensitive customer data. The CISO is responsible for ensuring that the termination is handled securely. Which action is most critical during the termination phase?

   • ARequest that the provider delete all company data and provide a written certification of deletion.
   • BRely on the provider's standard offboarding process and trust that they will handle the termination appropriately.
   • CExecute a structured exit plan that includes data return or destruction, revocation of access, verification of deletion, and a final security assessment of the provider's handling of company data.
   • DRevoke the provider's access to all company systems and data immediately upon the effective date of termination.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   The board of directors of a multinational corporation is reviewing the annual security report. The board is concerned about the company's exposure to cyber risk and wants to understand the potential financial impact of a major breach. The CISO has limited time to present the report. Which approach is most effective for the board?

   • APresent a summary of the top cyber risks, the potential financial impact (e.g., cost of a breach, regulatory fines), the effectiveness of current controls, and the status of key mitigation initiatives.
   • BPresent a detailed technical analysis of the company's security architecture and the vulnerabilities that exist.
   • CPresent a detailed quantitative risk analysis, including the annualized loss expectancy (ALE) for each major risk.
   • DPresent a comparison of the company's security spending to industry benchmarks and recommend increasing spending to match the highest spender.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A regional bank with a high-risk trading desk and a large remote customer-support team wants to improve its security awareness program. The CISO has limited budget and must show measurable improvement within one year. Which approach best aligns the program with the organization's risk profile and culture?

   • AReplace all training with monthly phishing simulations for the entire company, and measure success by the number of employees who report simulated emails.
   • BFocus all training on the trading desk because they handle the highest-risk transactions, and provide no formal training to support staff this year.
   • CDeliver the same annual online training to all employees, with a mandatory quiz and a pass rate of 80%.
   • DProvide role-based training: advanced phishing simulations and trade-surveillance scenarios for the trading desk, and customer-data handling and social-engineering modules for support staff, with tailored metrics for each group.
   Reveal Solution Discussion Select an answer first