Information Security Governance
50 practice questions with explanations — 15 free to try
4 of these 50 questions are in the free 15-question taster · the full topic is part of Premium
PassNova has 50 CISM practice questions on Information Security Governance, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Information Security Governance: example questions & answers
4 worked examples with answers and explanations below. Try 15 CISM questions free in the browser; the full 50-question Information Security Governance bank is part of PassNova Premium.
An information security manager is establishing a security governance framework. What is the MOST important factor to ensure its success?
- ASecuring a dedicated security budget
- BSelecting a widely recognised control framework such as ISO 27001
- CAlignment of the security strategy with business objectives✓
- DDeploying advanced technical security controls across the enterprise
Answer: Effective security governance depends primarily on aligning the security strategy with business objectives so that security supports and enables the organisation's goals.
Who should have ultimate accountability for an organisation's information security governance?
- AThe information security manager
- BThe IT operations department
- CThe board of directors and senior management✓
- DThe external security auditor
Answer: Governance is a leadership responsibility; the board and senior management hold ultimate accountability for direction, oversight, and resourcing of information security.
What is the PRIMARY purpose of an information security strategy?
- ATo define disciplinary action for policy violations
- BTo document the technical configuration of each security device deployed on the network
- CTo provide a roadmap that links security activities to organisational goals✓
- DTo list the known threats facing the organisation
Answer: A security strategy provides a roadmap that connects security initiatives to business goals, guiding investment and prioritisation over time.
An information security manager wants to demonstrate the value of the security program to executives. Which metric is MOST useful for this purpose?
- AThe number of firewall rules configured across the enterprise estate
- BThe number of antivirus signature updates pushed to endpoints each week
- CKey risk indicators showing reduction of business risk exposure✓
- DThe total count of security patches applied to servers during the previous month
Answer: Executives value evidence of reduced business risk; key risk indicators tied to business exposure communicate value far better than operational activity counts.