CISM. Set it up and run it.

1. Refer to the exhibit. Comparing the two register rows, what BEST explains why R-217 shows low residual risk while R-218 remains high?

• A. R-217 has a lower inherent risk than R-218
• B. Effective controls on R-217 reduced its residual risk
• C. R-218 is a less important asset than R-217
• D. R-217 was accepted while R-218 was transferred

Correct answer: B. Both risks share a high inherent level, so the difference in residual risk comes from control effectiveness: R-217's strong controls reduced its exposure to low, while R-218 has no controls implemented and therefore keeps its high inherent level.

Why the others are wrong. The inherent levels are identical in the register, so a lower inherent risk does not explain the difference. Relative asset importance is not shown and does not determine residual risk here. The register indicates controls, not acceptance or transfer, so attributing the gap to those treatments misreads the data shown.

2. An information security governance program is being established. Which outcomes should the program be primarily designed to deliver at the governance level? (Choose two.)

• A. Daily tuning of intrusion detection signatures and rules
• B. Alignment of security with business objectives
• C. Clear accountability for assigned security responsibility
• D. Manual review of every production server's patch status
• E. Hands-on configuration of endpoint encryption on laptops

Correct answer: B. Governance is responsible for strategic alignment and for establishing accountability; these ensure security supports business goals and that responsibility for outcomes is clearly owned, which are the defining objectives of an information security governance program.

Why the others are wrong. Tuning intrusion detection signatures, reviewing patch status, and configuring endpoint encryption are all operational management activities executed within the program. They implement direction rather than set it, so none belongs at the governance level, which concerns alignment, value, accountability, and oversight rather than day-to-day technical execution.

3. A board asks the security manager to clarify how information security governance differs from information security management. What is the PRIMARY distinction to convey?

• A. Governance executes controls while management provides oversight
• B. Governance and management describe the same accountability
• C. Governance selects technology while management approves budgets
• D. Governance sets direction while management executes the program

Correct answer: D. Governance is the responsibility of the board and executives: it sets strategic direction, defines risk appetite, and provides oversight, while management makes decisions and executes the program within that direction.

Why the others are wrong. Reversing the roles so governance executes and management oversees inverts the accountability model. Claiming the terms are the same ignores the deliberate separation of direction-setting from execution. Restricting governance to technology and management to budgets mischaracterizes both as narrow operational functions rather than the strategic-versus-executive distinction.

4. The information security manager is building the enterprise risk model. What combination MUST be present together for information risk to actually exist?

• A. A firewall rule that blocks legitimate inbound traffic flows
• B. A threat that exploits a vulnerability affecting a valued asset
• C. A budget shortfall constraining the security program roadmap
• D. A vendor contract that is approaching its renewal window

Correct answer: B. Risk materializes only when a threat is able to exploit a vulnerability that affects an asset of value; remove any one element and the exposure disappears, which is why the model links all three together.

Why the others are wrong. A misconfigured firewall rule is a single control weakness, not the complete risk equation. A budget shortfall is a program constraint that may raise risk indirectly but is not itself a risk element. A vendor contract renewal is a procurement event unrelated to the threat-vulnerability-asset relationship.

5. A security manager is establishing an information security program for the first time. To ensure the program delivers value, what should MOST directly shape its objectives?

• A. The tools favored by the security team
• B. The organization's business strategy and goals
• C. The latest published industry threat reports
• D. The stated preferences of the audit committee

Correct answer: B. Program objectives derived from the business strategy ensure security supports enterprise goals, which is what earns funding, executive backing, and measurable value rather than technology chosen for its own sake.

Why the others are wrong. Team tool preferences shape implementation details, not program direction, and lead to technology-driven rather than value-driven work. Threat reports inform risk assessment but do not by themselves define what the business needs the program to achieve. The audit committee provides oversight, but building objectives around audit preferences produces a compliance-only program disconnected from business value.

6. A security manager is establishing the organization's incident response capability. What is the PRIMARY purpose of a formal incident response plan?

• A. Eliminate the possibility of security incidents occurring
• B. Satisfy the external auditor's documentation requirements
• C. Assign personal accountability for control failures after an event
• D. Ensure a coordinated response that limits damage and recovery time

Correct answer: D. A documented plan gives responders predefined roles, procedures, and decision authority so the organization reacts quickly and consistently, minimizing business impact and recovery time rather than improvising under the pressure of an active incident.

Why the others are wrong. No plan can eliminate incidents, since threats and vulnerabilities will always exist. Satisfying an auditor is a byproduct, not the purpose, of readiness. Assigning personal accountability after an event is punitive and discourages the honest, early reporting that effective response depends on.

7. Despite a comprehensive policy set, employees routinely bypass security controls. Which factor MOST strongly determines whether a security-conscious culture takes hold across the organization?

• A. The number of awareness posters displayed in offices
• B. The size of the annual information security budget
• C. The technical sophistication of the deployed controls
• D. Visible commitment modeled consistently by senior leadership

Correct answer: D. Organizational culture follows tone at the top; when senior leaders visibly comply with and champion security, employees treat it as an expectation rather than an obstacle, which no budget or poster campaign alone achieves.

Why the others are wrong. Awareness posters raise visibility but do not change ingrained behavior on their own. A larger budget funds tools and staff yet cannot manufacture cultural buy-in. Technically sophisticated controls that users resent are precisely what gets bypassed; culture is shaped by modeled leadership behavior, not spending or technology.

8. A newly appointed security manager is beginning a risk identification effort for the organization. What should be established FIRST to make the effort meaningful?

• A. A schedule for the next external penetration test
• B. A summary of last year's security awareness metrics
• C. An inventory of assets and their value to the business
• D. A list of firewall rules currently in production

Correct answer: C. Risk identification must start from knowing what assets exist and what they are worth to the business, because threats and vulnerabilities only matter in proportion to the value of what they could affect.

Why the others are wrong. Scheduling a penetration test presumes you already know what to test and why. Reviewing awareness metrics measures a control's effect, not the assets at risk. Listing firewall rules documents controls already in place rather than identifying what needs protecting in the first place.