Page 1 of 185
CISM-CERTIFIED INFORMATION SECURITY
MANAGER EXAM/ ISACA CISM EXAM
COMPLETE 300 QUESTIONS WITH DETAILED
SOLUTIONS JUST RELEASED THIS YEAR
Question 1: Which of the following would BEST ensure the success of information security
governance within an organization?
A. The steering committee approves all security projects
B. The security policy manual is distributed to all managers
C. Security procedures are accessible on the company intranet
D. The corporate network utilizes multiple screened subnets
Answer: A
Information security governance success depends on executive-level commitment and oversight.
A steering committee with approval authority ensures security decisions align with business
strategy and receive appropriate resources and attention from senior leadership. Distributing
policies or procedures alone does not establish governance; technical controls address
operational security, not governance.
1
SUCCESS!
,Page 2 of 185
Question 2: Which of the following should be developed FIRST in an information security
program?
A. Standards
B. Procedures
C. Policies
D. Guidelines
Answer: C
Policies represent the highest level of security documentation and establish the organization's
strategic direction and requirements. Standards, procedures, and guidelines derive from policies
and provide detailed implementation guidance. Without policies, lower-level documents lack a
governing framework and may be inconsistent.
Question 3: Which individual would be in the BEST position to sponsor the creation of an
information security steering group?
A. Chief security officer
B. Chief operating officer
2
SUCCESS!
,Page 3 of 185
C. Chief internal auditor
D. Chief legal counsel
Answer: B
The chief operating officer (COO) has broad organizational authority and can provide the cross-
functional sponsorship needed for an effective steering group. A chief security officer may lack
the seniority to secure resources across business units. Internal audit and legal counsel typically
serve as advisors rather than sponsors.
Question 4: What is the MOST appropriate reporting base for the information security
management function?
A. Head of IT
B. Infrastructure director
C. Network manager
D. Chief information officer
Answer: D
Reporting to the chief information officer (CIO) provides sufficient organizational authority while
maintaining appropriate independence. Reporting to the head of IT or infrastructure director
3
SUCCESS!
, Page 4 of 185
creates a conflict of interest as security would be subordinate to operational IT management.
Reporting to the network manager provides insufficient authority for strategic security decisions.
Question 5: Which of the following is MOST indicative of the failure of information security
governance within an organization?
A. The information security department has had difficulty filling vacancies
B. The chief information officer (CIO) approves changes to the security policy
C. The information security oversight committee only meets quarterly
D. The data center manager has final sign-off on all security projects
Answer: D
Governance failure is evident when operational managers (e.g., data center manager) have final
authority over security projects without appropriate oversight. This indicates security decisions
are being made at too low a level without consideration of enterprise-wide risk. The CIO
approving policy changes is appropriate governance; committee meeting frequency and staffing
challenges are operational issues.
4
SUCCESS!
CISM-CERTIFIED INFORMATION SECURITY
MANAGER EXAM/ ISACA CISM EXAM
COMPLETE 300 QUESTIONS WITH DETAILED
SOLUTIONS JUST RELEASED THIS YEAR
Question 1: Which of the following would BEST ensure the success of information security
governance within an organization?
A. The steering committee approves all security projects
B. The security policy manual is distributed to all managers
C. Security procedures are accessible on the company intranet
D. The corporate network utilizes multiple screened subnets
Answer: A
Information security governance success depends on executive-level commitment and oversight.
A steering committee with approval authority ensures security decisions align with business
strategy and receive appropriate resources and attention from senior leadership. Distributing
policies or procedures alone does not establish governance; technical controls address
operational security, not governance.
1
SUCCESS!
,Page 2 of 185
Question 2: Which of the following should be developed FIRST in an information security
program?
A. Standards
B. Procedures
C. Policies
D. Guidelines
Answer: C
Policies represent the highest level of security documentation and establish the organization's
strategic direction and requirements. Standards, procedures, and guidelines derive from policies
and provide detailed implementation guidance. Without policies, lower-level documents lack a
governing framework and may be inconsistent.
Question 3: Which individual would be in the BEST position to sponsor the creation of an
information security steering group?
A. Chief security officer
B. Chief operating officer
2
SUCCESS!
,Page 3 of 185
C. Chief internal auditor
D. Chief legal counsel
Answer: B
The chief operating officer (COO) has broad organizational authority and can provide the cross-
functional sponsorship needed for an effective steering group. A chief security officer may lack
the seniority to secure resources across business units. Internal audit and legal counsel typically
serve as advisors rather than sponsors.
Question 4: What is the MOST appropriate reporting base for the information security
management function?
A. Head of IT
B. Infrastructure director
C. Network manager
D. Chief information officer
Answer: D
Reporting to the chief information officer (CIO) provides sufficient organizational authority while
maintaining appropriate independence. Reporting to the head of IT or infrastructure director
3
SUCCESS!
, Page 4 of 185
creates a conflict of interest as security would be subordinate to operational IT management.
Reporting to the network manager provides insufficient authority for strategic security decisions.
Question 5: Which of the following is MOST indicative of the failure of information security
governance within an organization?
A. The information security department has had difficulty filling vacancies
B. The chief information officer (CIO) approves changes to the security policy
C. The information security oversight committee only meets quarterly
D. The data center manager has final sign-off on all security projects
Answer: D
Governance failure is evident when operational managers (e.g., data center manager) have final
authority over security projects without appropriate oversight. This indicates security decisions
are being made at too low a level without consideration of enterprise-wide risk. The CIO
approving policy changes is appropriate governance; committee meeting frequency and staffing
challenges are operational issues.
4
SUCCESS!
