Program Communication and External Management CISM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A mid-sized company is implementing a new security awareness program and a new data loss prevention (DLP) tool. The CISO wants to communicate these changes to employees and management. Which communication strategy is most likely to gain support and reduce resistance?

   • ASend a single company-wide email from the CISO explaining the new tools and policies, and post the details on the intranet.
   • BCommunicate only to managers and ask them to cascade the information to their teams.
   • CWait until the tools are fully deployed and then announce them in the next all-hands meeting.
   • DLaunch a multi-channel campaign that includes executive sponsorship, department-specific town halls, and a dedicated intranet page with FAQs and a feedback channel.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of security metrics and reports?

   • ATo support decision-making by management
   • BTo increase the security budget
   • CTo track employee performance
   • DTo replace the need for audits
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   The board of directors of a publicly traded company is reviewing the annual information security report. The board is particularly interested in how security risks could affect the company's financial performance and reputation. Which type of information should the CISO emphasize in the report to the board?

   • AA detailed list of all security incidents from the past year, including the technical root cause of each.
   • BThe number of security awareness training hours completed by employees and the percentage of employees who passed the final exam.
   • CA comparison of the company's security spending to industry benchmarks, with a recommendation to match the highest spender.
   • DA summary of the top security risks, their potential financial and reputational impact, the effectiveness of current controls, and the status of key risk mitigation initiatives.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When selecting training content for a security awareness program, which topic is MOST appropriate for a general audience of all employees?

   • ASecure coding practices
   • BIncident response procedures for IT staff
   • CPhishing and social engineering recognition
   • DAdvanced network penetration testing
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A university with a diverse population of students, faculty, and administrative staff wants to improve its security awareness program. The university has a high rate of phishing attacks targeting students and has experienced data breaches involving faculty research data. The CISO has a limited budget and wants to maximize the program's impact. Which approach is most appropriate?

   • AProvide the same online training to all students, faculty, and staff, with a focus on general security topics.
   • BUse a single annual online training module for all groups and measure success by completion rate.
   • CFocus all training on faculty because they handle sensitive research data, and provide no formal training to students.
   • DDevelop role-based training: phishing awareness and safe online behavior for students, and research data protection and secure collaboration for faculty, with administrative staff receiving general security training.
   Reveal Solution Discussion Select an answer first