Program Foundation and Governance CISM Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A large organization is implementing a new security policy that requires multi-factor authentication (MFA) for all system access. The CISO must ensure the policy is effectively implemented across the organization. The organization has a mix of technical and non-technical employees, and some legacy systems do not support MFA. Which implementation approach is most effective?

   • AExempt non-technical employees from the MFA requirement to avoid usability issues.
   • BCommunicate the policy via email and expect employees to comply on their own, as the policy is mandatory.
   • CDevelop a phased implementation plan that prioritizes high-risk systems, provides training for employees, and includes a technical solution for legacy systems.
   • DImplement the policy immediately for all systems and require all employees to use MFA, even if it means some legacy systems are temporarily unavailable.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Who is typically responsible for determining the classification of an information asset?

   • AThe asset owner
   • BThe system administrator
   • CThe security auditor
   • DThe end user
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A government contractor is required to implement a security program that aligns with NIST SP 800-171 for controlled unclassified information (CUI). The CISO is evaluating whether to adopt a broader framework to guide the overall program. The organization also needs to demonstrate compliance to auditors and manage security across multiple business units. Which framework adoption strategy is most appropriate?

   • AImplement only the NIST SP 800-171 controls and avoid any additional framework to reduce complexity.
   • BAdopt the NIST Cybersecurity Framework (CSF) but do not map it to NIST SP 800-171, since CSF is voluntary.
   • CAdopt ISO/IEC 27001 as the overarching framework and map its controls to NIST SP 800-171 requirements.
   • DUse COBIT strictly for IT governance and do not align it with NIST SP 800-171, as they serve different purposes.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A healthcare organization is implementing a data classification scheme. The compliance officer wants to ensure that protected health information (PHI) is handled with the highest level of protection, while internal marketing materials receive minimal controls. The CISO must define classification levels and criteria that align with regulatory requirements and operational needs. Which classification approach best meets these requirements?

   • AClassify all data as 'Confidential' by default, and require the same handling procedures for every asset.
   • BLet each department decide its own classification labels and criteria based on its specific needs.
   • CUse only two levels: 'Regulated' and 'Non-regulated', and apply the same controls to all data within each level.
   • DDefine three levels (Public, Internal, Restricted) with criteria based on confidentiality, integrity, and availability impact, and assign PHI to Restricted.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A retail company is deciding between adopting the NIST Cybersecurity Framework (CSF) and ISO/IEC 27001. The company has a strong technical security posture but lacks formal governance processes. The CISO needs to improve governance while maintaining flexibility to adapt to changing business needs. The company is not required to obtain certification but wants to demonstrate due diligence to its board and customers. Which framework adoption is most appropriate?

   • AAdopt ISO/IEC 27001 and pursue certification to provide formal assurance to customers and the board.
   • BAdopt both frameworks fully and maintain separate compliance programs for each.
   • CAdopt the NIST CSF as the primary framework and use it to drive governance improvements without formal certification.
   • DUse COBIT for governance and NIST CSF for security, but do not integrate them.
   Reveal Solution Discussion Select an answer first