Program Communication and External Management CISM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A CISO is preparing a monthly security report for the IT director, who is responsible for operational security. The IT director wants to understand the effectiveness of the security controls and identify areas for improvement. Which type of metrics would be most useful for this audience?

   • AHigh-level risk indicators such as the number of high-risk vulnerabilities and the status of critical projects.
   • BA list of all security policies and procedures that have been updated in the past month.
   • CA summary of the security budget and spending compared to the plan.
   • DOperational metrics such as the number of security incidents, the time to detect and respond, the percentage of systems patched, and the results of vulnerability scans.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is about to implement a new identity and access management (IAM) system that will require employees to use multi-factor authentication (MFA) and change their passwords more frequently. The CISO anticipates resistance from employees. Which communication strategy is most likely to reduce resistance and increase adoption?

   • AWait until the system is fully deployed and then inform employees of the new requirements.
   • BSend a single email to all employees explaining the new requirements and the date they will take effect.
   • CAnnounce the change at the next all-hands meeting and provide a link to the policy on the intranet.
   • DUse a phased communication plan that includes executive sponsorship, department-specific training sessions, and a feedback channel for employees to raise concerns.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which audience would MOST likely require communication focused on strategic security risks and resource needs?

   • AIT help desk staff
   • BGeneral employees
   • CExternal auditors
   • DExecutive management
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of conducting a needs assessment before designing a security awareness program?

   • ATo identify the specific security behaviors and knowledge gaps that the program should address
   • BTo select the training delivery platform
   • CTo comply with regulatory requirements
   • DTo determine the budget for the training program
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is contracting with a new software-as-a-service (SaaS) provider for customer relationship management (CRM). The provider will store customer data, including personal information. The CISO wants to ensure that the contract includes appropriate security requirements. Which clause is most important to include?

   • AA clause requiring the provider to maintain a service level agreement (SLA) for uptime and performance.
   • BA clause requiring the provider to notify the company within 72 hours of any security incident that affects company data.
   • CA clause that defines the security controls the provider must implement, including encryption, access controls, and the right to audit, along with incident notification requirements.
   • DA clause that limits the provider's liability to the amount paid under the contract.
   Reveal Solution Discussion Select an answer first