Program Foundation and Governance CISM Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of a security guideline?

   • AA baseline configuration for servers
   • BA step-by-step process for responding to a security incident
   • CA recommended practice for creating strong passwords
   • DA mandatory requirement to use multi-factor authentication
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A hospital is implementing a new security program and needs to staff it appropriately. The CISO has identified the need for incident response, vulnerability management, and security awareness training. The hospital has a limited budget and cannot hire full-time specialists for every function. Which staffing strategy best addresses the program's needs within the budget constraint?

   • AHire full-time specialists for incident response, vulnerability management, and security awareness training.
   • BRely entirely on external consultants to run the security program on a part-time basis.
   • CAssign security responsibilities to existing IT staff without additional training or support.
   • DHire one full-time security generalist and outsource specialized functions like penetration testing and 24/7 monitoring to managed security service providers (MSSPs).
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of the NIST Cybersecurity Framework (CSF)?

   • ATo provide a set of best practices to help organizations manage and reduce cybersecurity risk
   • BTo provide a framework for IT service management
   • CTo define a set of legal requirements for data protection
   • DTo certify organizations as compliant with international standards
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a common criterion used to classify information assets?

   • AThe asset's physical location
   • BThe asset's age and historical value
   • CThe asset's color and appearance
   • DThe asset's sensitivity and criticality to business operations
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A large manufacturing company has classified its engineering blueprints as 'Confidential'. The engineering department head is responsible for the blueprints, while the IT department manages the file servers where they are stored. A new product design is being developed, and the CISO needs to ensure that access is properly controlled. Which assignment of roles and responsibilities is most appropriate?

   • AThe CISO is the asset owner because the blueprints are classified as Confidential and require security oversight.
   • BThe IT department head is the asset owner because IT manages the file servers and can grant access to the blueprints.
   • CThe engineering department head is the asset owner, and the IT department is the custodian responsible for implementing the access controls specified by the owner.
   • DThe individual engineers who create the blueprints are the asset owners, and they must manage access directly.
   Reveal Solution Discussion Select an answer first