Information Security Program
65 practice questions with explanations — 15 free to try
4 of these 65 questions are in the free 15-question taster · the full topic is part of Premium
PassNova has 65 CISM practice questions on Information Security Program, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Information Security Program: example questions & answers
4 worked examples with answers and explanations below. Try 15 CISM questions free in the browser; the full 65-question Information Security Program bank is part of PassNova Premium.
An information security program's objectives should be derived PRIMARILY from which of the following?
- AThe findings of the most recent external audit report
- BThe control objectives of an industry framework such as NIST CSF
- CThe information security strategy and business requirements✓
- DThe results of the latest vulnerability assessment
Answer: Program objectives flow from the security strategy and business requirements so the program delivers outcomes the organisation actually needs.
What is the MOST important success factor when implementing a security awareness training program?
- AMaking completion of the training mandatory for each employee on an annual basis
- BTracking completion rates through the learning management system
- CTailoring the content to the audience and reinforcing it regularly✓
- DDelivering the training material in a single annual classroom session
Answer: Awareness is most effective when content is tailored to the audience and reinforced regularly, sustaining behaviour change rather than a one-off event.
When selecting security controls for the information security program, what should be the PRIMARY consideration?
- AThe requirements of the organisation's chosen control framework
- BThe total cost of ownership of each of the candidate controls
- CThe level of risk the controls are intended to reduce✓
- DThe ease of integrating the controls with existing technology
Answer: Controls should be selected based on the risk they reduce, ensuring effort and spend are aligned to the organisation's actual exposure.
What is the PRIMARY purpose of defining roles and responsibilities within an information security program?
- ATo satisfy the documentation requirements of auditors
- BTo support the allocation of the security budget
- CTo define the reporting line of the security manager
- DTo ensure accountability and clear ownership of security tasks✓
Answer: Clearly defined roles and responsibilities establish accountability and ownership, which are essential for security activities to be performed reliably.