Program Foundation and Governance CISM Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A multinational retail company is building an information asset inventory. The CISO wants to ensure that all assets are identified and that the inventory supports downstream classification and protection decisions. The company operates both on-premises data centers and multiple cloud environments, and it has a mix of custom applications, SaaS services, and employee-owned devices used under BYOD. Which approach best ensures comprehensive asset identification?

   • AAsk each department head to submit a list of the applications and data they use, and compile those lists into a single spreadsheet.
   • BRely on the configuration management database (CMDB) maintained by the IT operations team, as it already contains all hardware and software assets.
   • CDeploy an agent on every server and workstation to collect installed software and hardware details, and consider that the complete asset inventory.
   • DUse an automated discovery tool that scans the network and cloud APIs to identify systems, then manually supplement it with a survey of business units for data and process assets.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A multinational corporation is considering adopting ISO/IEC 27001 for its information security management system. The company has operations in 30 countries, each with its own regulatory requirements. The CISO must decide whether to pursue certification for the entire organization or for specific business units. The company has a mature security program but has never pursued formal certification. Which approach best balances certification benefits with implementation effort?

   • APursue certification for the entire organization as a single scope, covering all 30 countries.
   • BPursue certification for a single business unit that has the highest regulatory pressure and then expand to other units over time.
   • CAdopt ISO/IEC 27001 as an internal framework but do not pursue certification, as it is not required by any customer or regulator.
   • DChoose a different framework, such as NIST CSF, because it is less prescriptive and easier to implement across multiple countries.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary role of a custodian in the handling of an information asset?

   • ATo use the asset in accordance with organizational policies
   • BTo implement and manage the technical and physical controls that protect the asset
   • CTo determine the asset's classification level
   • DTo define the access rights for the asset
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A manufacturing company is establishing a security program and needs to determine the appropriate resources. The company has a small security team and a limited budget. The CISO must decide whether to build an in-house security operations center (SOC) or use a managed security service provider (MSSP). The company has a high need for 24/7 monitoring and incident response, but also wants to maintain control over its security operations. Which approach best balances these needs?

   • ABuild a full in-house SOC with 24/7 staffing, even though it will require significant budget and hiring.
   • BRely on the existing IT team to monitor security alerts during business hours only, and ignore alerts outside of business hours.
   • COutsource all security functions to an MSSP and eliminate the in-house security team.
   • DUse an MSSP for 24/7 monitoring and incident response, and keep a small in-house team for strategy and oversight.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A global company is updating its information security policy to address new data privacy regulations. The CISO has drafted the policy and needs to ensure it is properly approved and communicated. The company operates in multiple countries with different legal requirements. Which step is most important for the CISO to take before finalizing the policy?

   • ASend the draft policy to all employees for comments and suggestions before finalizing.
   • BPublish the policy on the intranet and send an email to all employees announcing its effective date.
   • CObtain review and approval from legal counsel to ensure the policy aligns with all applicable regulations.
   • DHave the CISO approve the policy and immediately implement it, as the CISO is the authority on security.
   Reveal Solution Discussion Select an answer first