ISACA CISM QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Information Security Governance (Questions 1–24)
1. The PRIMARY reason for aligning information security strategy with business strategy is to:
A) Ensure compliance with all applicable regulations
B) Enable the organization to achieve its objectives
C) Reduce the total cost of security controls
D) Satisfy auditor requirements
Answer: B
Rationale: The ultimate purpose of security governance is to enable business objectives by managing risk to
acceptable levels. Compliance (A), cost reduction (C), and audit satisfaction (D) are means or byproducts, not
the primary goal.
,2. Which of the following is the MOST important characteristic of an effective information security governance
framework?
A) It is owned by the security department
B) It is integrated with enterprise governance
C) It relies on industry best practices
D) It is reviewed annually by external auditors
Answer: B
Rationale: Security governance must be integrated into overall enterprise governance to be effective and
sustainable. Security ownership (A) alone is insufficient; best practices (C) and external review (D) are
supporting elements, not the defining characteristic.
3. An organization's security strategy should PRIMARILY be driven by:
A) The latest security technologies
B) Regulatory requirements
C) Business objectives and risk appetite
D) Peer organizations' security postures
, Answer: C
Rationale: Strategy flows from business objectives and the organization's willingness to accept risk. Technology
(A), regulation (B), and benchmarking (D) inform but do not drive strategy.
4. Which role is ultimately accountable for information security within an organization?
A) Chief Information Security Officer (CISO)
B) Board of directors
C) IT manager
D) Internal audit
Answer: B
Rationale: Ultimate accountability rests with the board, which represents the owners/stakeholders. The CISO (A)
is responsible for executing the program; IT (C) implements; audit (D) provides independent assurance.
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
EXAM PREP | STUDY GUIDE | PRACTICE TEST
,Domain 1: Information Security Governance (Questions 1–24)
1. The PRIMARY reason for aligning information security strategy with business strategy is to:
A) Ensure compliance with all applicable regulations
B) Enable the organization to achieve its objectives
C) Reduce the total cost of security controls
D) Satisfy auditor requirements
Answer: B
Rationale: The ultimate purpose of security governance is to enable business objectives by managing risk to
acceptable levels. Compliance (A), cost reduction (C), and audit satisfaction (D) are means or byproducts, not
the primary goal.
,2. Which of the following is the MOST important characteristic of an effective information security governance
framework?
A) It is owned by the security department
B) It is integrated with enterprise governance
C) It relies on industry best practices
D) It is reviewed annually by external auditors
Answer: B
Rationale: Security governance must be integrated into overall enterprise governance to be effective and
sustainable. Security ownership (A) alone is insufficient; best practices (C) and external review (D) are
supporting elements, not the defining characteristic.
3. An organization's security strategy should PRIMARILY be driven by:
A) The latest security technologies
B) Regulatory requirements
C) Business objectives and risk appetite
D) Peer organizations' security postures
, Answer: C
Rationale: Strategy flows from business objectives and the organization's willingness to accept risk. Technology
(A), regulation (B), and benchmarking (D) inform but do not drive strategy.
4. Which role is ultimately accountable for information security within an organization?
A) Chief Information Security Officer (CISO)
B) Board of directors
C) IT manager
D) Internal audit
Answer: B
Rationale: Ultimate accountability rests with the board, which represents the owners/stakeholders. The CISO (A)
is responsible for executing the program; IT (C) implements; audit (D) provides independent assurance.
