CISM Information Security Governance Quiz

1. An information security policy should include:

Clear objectives and scope

Roles and responsibilities

Compliance requirements

All of the above

2. The primary goal of information security governance is to:

Eliminate all security risks

Ensure security enables business objectives while managing risk

Maximize spending on security tools

Comply with all applicable regulations

3. Which stakeholder group should be involved in security governance decisions?

Only the IT department

Only senior executives

Business leadership, IT, risk management, and compliance teams

Only external auditors

4. True or False: Compliance with regulations is a sufficient governance objective.

True

False

5. A security governance framework should be reviewed and updated:

Every five years

Only when a major breach occurs

Regularly, at least annually or when business changes occur

Never, once established it should remain unchanged

6. Which of the following is a governance responsibility rather than an operational one?

Installing antivirus software on workstations

Defining the organization's security strategy

Monitoring firewall logs daily

Patching operating systems

7. True or False: Information security governance applies only to large enterprises.

True

False

8. The process of establishing security governance typically begins with:

Implementing technical controls

Understanding business objectives and risk context

Hiring a Chief Information Security Officer

Conducting a vulnerability assessment

9. Which metric is most important for measuring governance effectiveness?

Number of security incidents per month

Alignment of security initiatives with business objectives

Total security budget spent

Number of security patches deployed

10. True or False: Risk tolerance and risk appetite are the same concept.

True

False

11. Which of the following best defines information security governance?

The set of processes and controls used to protect data from unauthorized access

The system of leadership and accountability that ensures security aligns with business objectives

The technical framework for implementing firewalls and encryption

The audit procedures used to verify compliance with regulations

12. What does RACI stand for in governance context?

Risk Assessment and Compliance Initiative

Responsible, Accountable, Consulted, Informed

Regulatory Audit and Control Infrastructure

Risk Avoidance and Compliance Improvement

13. True or False: Security governance should align with business strategy and objectives.

True

False

14. The board of directors' role in security governance includes:

Implementing day-to-day security controls

Overseeing security strategy and holding management accountable

Writing security policies for all departments

Performing vulnerability scans on company systems

15. Which of the following is a key component of a security governance framework?

Clearly defined roles and responsibilities

Regular risk assessments and mitigation strategies

Documented policies and procedures

All of the above

16. True or False: Information security governance is primarily a technical responsibility.

True

False

17. What is the main purpose of a security steering committee?

To approve all user access requests

To provide strategic oversight and governance of security initiatives

To monitor network traffic in real time

To conduct annual compliance audits

18. Which governance framework is commonly used to establish information security policies?

COBIT

ISO/IEC 27001

NIST Cybersecurity Framework

All of the above

19. Risk appetite in governance refers to:

The maximum amount an organization is willing to spend on security

The level of risk the organization is willing to accept to achieve objectives

The frequency of risk assessments performed annually

The types of threats most likely to affect the organization

20. What is the primary responsibility of the information security manager in governance?

Writing code and implementing patches

Ensuring security strategies support organizational goals and risk tolerance

Conducting penetration tests on all systems

Maintaining the organization's backup systems

CISM Information Security Governance Quiz

1. An information security policy should include:

2.

What first name or nickname would you like us to use?

2. The primary goal of information security governance is to:

3. Which stakeholder group should be involved in security governance decisions?

4. True or False: Compliance with regulations is a sufficient governance objective.

5. A security governance framework should be reviewed and updated:

6. Which of the following is a governance responsibility rather than an operational one?

7. True or False: Information security governance applies only to large enterprises.

8. The process of establishing security governance typically begins with:

9. Which metric is most important for measuring governance effectiveness?

10. True or False: Risk tolerance and risk appetite are the same concept.

11. Which of the following best defines information security governance?

12. What does RACI stand for in governance context?

13. True or False: Security governance should align with business strategy and objectives.

14. The board of directors' role in security governance includes:

15. Which of the following is a key component of a security governance framework?

16. True or False: Information security governance is primarily a technical responsibility.

17. What is the main purpose of a security steering committee?

18. Which governance framework is commonly used to establish information security policies?

19. Risk appetite in governance refers to:

20. What is the primary responsibility of the information security manager in governance?