CISM Domain 1 Questions Set-2: INFORMATION SECURITY GOVERNANCE

 11. What is the purpose of security governance in an organization?

a) To establish technical controls for information security.

b) To align the organization's security program with the needs of the business.

c) To enforce strict policies and procedures for employee compliance.

d) To promote collaboration between IT and security teams.

 

12. How are priorities in the security program determined?

a) By following industry best practices.

b) Based on the organization's budget allocation for security.

c) Through regular employee training and awareness programs.

d) Priorities should flow directly from the organization's mission, objectives, and goals.

 

13. What are standards in the context of security governance?

a) Guidelines for developing security policies.

b) Frameworks for risk assessment and management.

c) Best practices for incident response and recovery.

d) Standards help to drive a consistent and secure approach to solving business challenges.

 

14. What are controls in the context of security governance?

a) Monitoring tools for detecting security incidents.

b) Security policies and procedures.

c) Techniques for securing network infrastructure.

d) Controls are formal descriptions of critical activities to ensure desired outcomes.

 

15. How should security governance be practiced in an organization?

a) As a standalone process separate from IT and corporate governance.

b) By solely focusing on technical aspects of information security.

c) By involving only the IT department in decision-making.

d) Security governance should be practiced in a manner similar to IT governance and corporate governance.

 

16. What is the purpose of risk assessments in an effective security governance program?

a) To identify cybersecurity tools and technologies.

b) To allocate resources for incident response procedures.

c) To identify risks in information systems and supported processes.

d) To improve compliance with laws and regulations.

 

17. What is the purpose of incident response procedures in security governance?

  a) To identify potential business events such as mergers or acquisitions.

b) To allocate resources for business continuity and disaster recovery planning.

c) To improve compliance with laws, regulations, and standards.

d) To improve response to incidents and minimize their impact on the organization.

 

18. What is the purpose of metrics in security governance?

a) To identify recent business results and changes to the business.

b) To measure key security events such as policy changes and violations.

c) To allocate resources for business continuity and disaster recovery plans.

d) To improve strategic decisions in the IT organization.

 

19. What is the purpose of resource management in security governance?

a) To identify risks in information systems and supported processes.

b) To allocate manpower, budget, and other resources to meet security objectives.

c) To improve response to incidents and minimize their impact on the organization.

d) To improve strategic decisions in the IT organization.

 

20. How are scripted interactions among key business and IT executives used in security governance?

a) To measure key security events and incidents.

b) To allocate resources for business continuity and disaster recovery plans.

c) To identify recent business results and changes to the business.

d) To discuss the impact of regulatory changes, alignment with business objectives, and recent audits.