Program Foundation and Governance CISM Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A mid-sized financial services firm is adopting the NIST Cybersecurity Framework (CSF) to mature its security program. The CISO has been given a flat budget for the next fiscal year and must allocate resources to close the highest-priority gaps identified in a current-state assessment. The assessment shows that the organization has strong technical controls but weak governance processes, including no formal risk appetite statement and inconsistent policy enforcement. Which resource allocation should the CISO prioritize?

   • AFund external penetration testing to validate the effectiveness of existing technical controls.
   • BPurchase an advanced SIEM platform to improve threat detection and correlation across the enterprise.
   • CHire a dedicated governance, risk, and compliance (GRC) analyst to develop the risk appetite statement and enforce policy consistency.
   • DInvest in additional endpoint detection and response (EDR) licenses to expand coverage to all remote workers.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A university is creating an information asset inventory. The CISO wants to ensure that the inventory is useful for risk management and that assets are properly protected. The university has research data, student records, administrative systems, and public website content. Which action is most important to ensure the inventory supports risk-based decisions?

   • AAssign a unique identifier to each asset and record its owner, classification, and location.
   • BFocus on hardware assets only, as software and data are not considered information assets.
   • CList only the assets that have been involved in a security incident in the past year.
   • DInclude only the assets that are connected to the network, as offline assets do not pose a risk.
   Reveal Solution Discussion Select an answer first