When selecting between two security controls that provide similar protection, which factor should be the PRIMARY differentiator?

The control's popularity among peers

The cost of implementation and maintenance

What is the PRIMARY purpose of reporting security metrics to stakeholders?

To satisfy the requirements of external auditors only

To automate the collection of security data

To provide a detailed technical log of all security events

To enable informed decision-making and demonstrate program effectiveness

Which of the following is the PRIMARY reason for aligning information security program metrics with business objectives?

To ensure all security controls are automated

To satisfy regulatory requirements for reporting security incidents

To demonstrate the value of security investments to executive management

To reduce the number of security incidents to zero

A security team collects data on phishing simulation click rates, but the data is stored in different formats across multiple spreadsheets. The team wants to report a consolidated trend to management. What is the first step the team should take?

Use a data visualization tool to automatically generate charts from the spreadsheets

Report the data as-is, noting that formats vary by source

Create a new spreadsheet that manually copies the data from all sources

Define a standard data format and collection process for all metrics

A security team collects metrics on phishing simulation results, patch compliance, and incident response times. The CISO wants a monthly dashboard that executives can use to quickly assess the overall security posture. What is the most important consideration when designing this reporting?

Report only metrics that show positive results to maintain stakeholder confidence

Present metrics as trends with clear targets and context for each measure

Use technical jargon and detailed charts to demonstrate the team's expertise

Include raw data for all metrics so executives can perform their own analysis

Certified Information Security Manager

Domain 3Objective 2

Program Implementation and Operations CISM Practice Questions (Page 6)

Part of the Domain 3: Information Security Program domain, which accounts for 33% of the CISM exam.

32questions here

7free pages

8concepts

33%of the exam

Questions 26–30

26foundation · easy
When selecting between two security controls that provide similar protection, which factor should be the PRIMARY differentiator?
Select an answer first
27foundation · easy
What is the PRIMARY purpose of reporting security metrics to stakeholders?
Select an answer first
28foundation · easy
Which of the following is the PRIMARY reason for aligning information security program metrics with business objectives?
Select an answer first
29application · medium
A security team collects data on phishing simulation click rates, but the data is stored in different formats across multiple spreadsheets. The team wants to report a consolidated trend to management. What is the first step the team should take?
Select an answer first
30application · medium
A security team collects metrics on phishing simulation results, patch compliance, and incident response times. The CISO wants a monthly dashboard that executives can use to quickly assess the overall security posture. What is the most important consideration when designing this reporting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CISM” is a trademark of its owner, used for identification only.