Program Communication and External Management CISM Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of ongoing monitoring of a third-party service provider?

   • ATo identify new business opportunities
   • BTo replace the provider with a cheaper option
   • CTo renegotiate the contract annually
   • DTo ensure the provider continues to meet security requirements
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A multinational manufacturing company has a security awareness program that relies on an annual 60-minute computer-based training (CBT) module. Completion rates are high, but the security team observes that employees still fall for phishing emails and mishandle sensitive data. The CISO wants to improve engagement and retention without a large budget increase. Which change is most likely to improve the program's effectiveness?

   • ASwitch to a mandatory in-person classroom session once a year, led by an external security consultant.
   • BIncrease the length of the annual CBT to 90 minutes and add more detailed policy text to ensure full coverage of all security topics.
   • CMake the annual CBT optional and rely on a monthly security newsletter to keep security top-of-mind.
   • DReplace the annual CBT with a series of short, interactive micro-learnings delivered quarterly, supplemented by simulated phishing exercises and immediate feedback.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   After implementing a new security awareness program, the CISO wants to evaluate its effectiveness. The program includes phishing simulations, online training modules, and a reporting mechanism for suspicious emails. Which metric would provide the most direct evidence of behavior change?

   • AThe percentage of employees who completed the online training modules.
   • BThe number of employees who reported a simulated phishing email to the security team.
   • CThe number of security awareness posters displayed in the office.
   • DThe number of security incidents that occurred during the training period.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is it important to assess the security practices of a vendor's subcontractors?

   • ABecause they are required to be audited by law
   • BBecause they may have access to the organization's data
   • CBecause they are always the weakest link
   • DBecause they are directly contracted by the organization
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is a fourth-party risk in the context of third-party risk management?

   • ARisk from a direct vendor's failure
   • BRisk arising from a vendor's subcontractors
   • CRisk from regulatory changes
   • DRisk from the organization's own employees
   Reveal Solution Discussion Select an answer first