A company is designing a control to protect sensitive customer data stored in a cloud environment. The control must comply with data residency regulations that require data to remain within a specific country. Which control design is most appropriate?

Store data on-premises in the required country to avoid cloud compliance issues

Use a cloud provider that offers a data center in the required country

Encrypt all data and store the encryption keys in the required country

Use a virtual private network (VPN) to access the cloud from the required country

A bank is designing a control to prevent unauthorized wire transfers. The control must be effective but also not delay legitimate transactions. Which control design best balances security and operational efficiency?

Require dual authorization for all wire transfers, regardless of amount

Implement dual authorization only for transfers above a certain threshold, with automated checks for lower amounts

Require a manager's approval for every transfer, but only during business hours

Use a machine learning model to automatically approve all transfers without human review

Which factor is MOST important when selecting a security control?

The control's alignment with the organization's risk appetite

The control's popularity in the industry

The control's cost compared to other controls

The control's ease of implementation

Which characteristic is MOST important when selecting a metric to measure the effectiveness of an information security program?

The metric is aligned with a specific business objective

The metric is based on industry benchmarks

The metric is easy to calculate from existing data

What is the purpose of recommending remediation actions for control deficiencies?

To document the deficiency for future reference

To assign blame to responsible parties

To improve the overall security posture

To increase the number of controls

Certified Information Security Manager

Domain 3Objective 2

Program Implementation and Operations CISM Practice Questions (Page 1)

Part of the Domain 3: Information Security Program domain, which accounts for 33% of the CISM exam.

32questions here

7free pages

8concepts

33%of the exam

Questions 1–5

1expert · hard
A company is designing a control to protect sensitive customer data stored in a cloud environment. The control must comply with data residency regulations that require data to remain within a specific country. Which control design is most appropriate?
Select an answer first
2application · medium
A bank is designing a control to prevent unauthorized wire transfers. The control must be effective but also not delay legitimate transactions. Which control design best balances security and operational efficiency?
Select an answer first
3foundation · easy
Which factor is MOST important when selecting a security control?
Select an answer first
4foundation · easy
Which characteristic is MOST important when selecting a metric to measure the effectiveness of an information security program?
Select an answer first
5foundation · easy
What is the purpose of recommending remediation actions for control deficiencies?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.