Program Foundation and Governance CISM Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A startup company with 50 employees and a small security team wants to establish its first formal security program. The CISO has limited budget and staff and needs a framework that is practical to implement quickly while still providing a solid foundation. The company does not currently need formal certification. Which framework selection is most appropriate for this context?

   • AImplement COBIT as the primary framework, focusing on IT governance and control objectives.
   • BAdopt the full ISO/IEC 27001 standard and pursue certification within the first year.
   • CWait until the company grows and then adopt a framework, as frameworks are not useful for small organizations.
   • DUse the NIST Cybersecurity Framework (CSF) as a guide to prioritize actions based on risk, without pursuing formal certification.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of an information asset?

   • AA company's employee satisfaction
   • BA company's brand reputation
   • CA company's customer database
   • DA company's office furniture
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the first step in the process of developing a security policy?

   • AObtaining approval from senior management
   • BIdentifying the business objectives and legal requirements that the policy must support
   • CDrafting the policy document
   • DCommunicating the policy to all employees
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A financial institution has a policy that states 'All sensitive customer data must be encrypted at rest.' The CISO needs to ensure that IT staff know exactly how to implement this requirement for the various databases and file shares. Which document type should the CISO develop to provide the specific implementation steps?

   • AA standard that defines the encryption algorithm and key length, but not the implementation steps.
   • BA guideline that suggests best practices for encryption, but leaves the implementation to each team's discretion.
   • CA new security policy that expands on the encryption requirement with more details.
   • DA set of procedures that describe step-by-step how to enable encryption on each database and file share type.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of classifying information assets?

   • ATo determine the appropriate level of protection based on sensitivity and criticality
   • BTo ensure that all assets are protected equally regardless of their value
   • CTo comply with international standards for asset management
   • DTo assign a unique identifier to each asset for tracking purposes
   Reveal Solution Discussion Select an answer first