CISM Information Security Governance: 272 practice questions

12 of the 272 Information Security Governance questions in the Certsqill CISM bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISM? Take the free 5-min readiness check →

1. Managers promptly report suspected incidents and discuss: Which action best demonstrates the required behavior

1. Require all employees to repeat the security awareness course.

   Training may build knowledge, but completion does not show that managers model the required reporting behavior.
2. Publish monthly totals of incidents reported by each store.

   Reporting totals can be an outcome measure, but they do not by themselves demonstrate managerial modeling or appropriate escalation.
3. Issue another annual security policy reminder to store managers.

   A reminder restates expectations but does not demonstrate managers personally practicing prompt reporting.
4. Managers promptly report suspected incidents and discuss the lessons learned. ✓

   Managers visibly reporting incidents and discussing lessons demonstrates the expected behavior and reinforces prompt escalation.

Managers visibly reporting and discussing incidents demonstrates the required leadership behavior.

2. Have the COO realign delivery incentives with reporting: What should security recommend first?

1. Reissue the reporting policy to drivers.

   Reissuing a known policy does not correct delivery incentives that discourage the required behavior.
2. Have the COO realign delivery incentives with reporting. ✓

   The authorized owner must remove the conflicting incentive so operational targets support, rather than suppress, incident reporting.
3. Ask regional managers to encourage reporting while retaining current delivery targets.

   Local encouragement cannot reliably overcome company-wide targets that continue to penalize or discourage reporting.
4. Add reporting behavior to supervisor performance discussions and route reviews.

   Supervisor discussions may reinforce expectations, but they do not change the delivery targets creating the conflict.

The COO should align delivery incentives with reporting because the existing targets discourage the required behavior.

3. Use the confidential channel and route urgent: Which action should management implement?

1. Require staff to report first through their direct clinical supervisors.

   The ordinary hierarchy may be useful in other cases, but it does not ensure confidential reporting when non-retaliation is an explicit requirement.
2. Use the confidential channel and route urgent care-impacting issues to the risk owner. ✓

   This uses the approved protected route and ensures matters threatening patient care reach the accountable business risk owner promptly.
3. Suspend the local channel until an anonymous hotline receives a separate assessment.

   A separate assessment may be useful for a future option, but suspending the approved operational channel removes available protection and delays escalation.
4. Wait for the next compliance committee meeting before escalating uncertain events.

   Committee review may provide oversight, but waiting delays escalation despite an approved channel and an authorized immediate response.

The approved confidential route protects reporters and directs urgent care risks to the accountable owner.

4. Designate one accountable security owner: What should it do first?

1. Designate one accountable security owner. ✓

   Designation establishes decision authority before shared systems create security responsibilities spanning both organizations.
2. Create a temporary committee to review shared-system security issues.

   A review group may support coordination, but it can diffuse accountability when one security authority is explicitly required.
3. Deliver joint security-awareness sessions for both organizations.

   Joint education may support integration, but it does not establish the required accountable authority before connection.
4. Compare both organizations’ security policies and control standards.

   Comparison can identify differences, but it does not satisfy the immediate requirement to designate one accountable authority.

Designating one accountable owner establishes authority before shared responsibilities begin.

5. Implement one reporting route across all stores: What management action satisfies the charter without exceedin

1. Allow each store to select its preferred reporting method.

   Store-level choice directly conflicts with the charter’s requirement for one enterprise route.
2. Implement one reporting route across all stores. ✓

   A common route directly satisfies the charter while preserving local flexibility in unrelated operating practices.
3. Delay implementation until all stores’ existing reporting practices are compared.

   A comparison may help plan implementation, but the charter has already established the required outcome and does not make comparison a prerequisite.
4. Standardize every store’s security procedure and work instruction.

   The charter requires common reporting, not complete procedural uniformity; extending the mandate unnecessarily removes permitted local flexibility.

Implement one enterprise reporting route while leaving unrelated local practices flexible.

6. Give dispatch supervisors role-specific reporting: Which action best communicates that role-specific responsib

1. Provide company-wide awareness training on recognizing security incidents.

   General awareness helps staff recognize incidents but does not explain the dispatch supervisor’s recipient and authority.
2. Post the incident hotline number for all employees.

   A hotline supports access to reporting but does not communicate the supervisor’s delegated authority or role-specific expectations.
3. Review quarterly whether supervisors followed the documented escalation procedure.

   A review can test later performance, but it does not initially communicate the recipient or delegated authority.
4. Give dispatch supervisors role-specific reporting and authority instructions. ✓

   This targeted communication identifies both where supervisors report and what decisions they may make.

Targeted instructions identify the supervisor’s reporting recipient and delegated authority.

7. Compare reporting and escalation outcomes after: Which evidence is most diagnostic?

1. Report monthly completion rates for mandatory security training.

   Completion measures participation, not whether employees report concerns or whether escalation produces better outcomes.
2. Review reporting patterns, workload, leadership responses, and resolution quality together.

   These are relevant inputs, but the option does not require a comparative outcome analysis that controls for departmental differences.
3. Compare reporting and escalation outcomes after normalizing workload and leadership effects. ✓

   This directly tests whether reporting behavior and escalation results improved while accounting for meaningful differences between departments.
4. Rank departments by incident volume and investigate those with the fewest reports.

   Low report volume may reflect less opportunity, weaker psychological safety, or different workloads rather than better culture.

Compare reporting and escalation outcomes in context, rather than relying on attendance or raw counts.

8. Partner incident records documenting encouragement: Which evidence is most direct?

1. Collect signed annual security acknowledgments from every partner.

   Acknowledgments show receipt or agreement but do not establish that partners encouraged prompt reporting.
2. Use briefing attendance, policy distribution, and survey responses to assess partner influence.

   These sources show exposure or perceptions, not documented partner conduct producing prompt escalation.
3. Analyze partner reporting rates against escalation timing and management follow-up.

   This can reveal associations, but without records of partner encouragement it does not directly establish the claimed conduct.
4. Partner incident records documenting encouragement, prompt escalation, and follow-up. ✓

   These records directly document the partners' conduct, the reporting result, and the response that followed.

Records connecting partner conduct, prompt escalation, and follow-up most directly test the claim.

9. Store cases showing reports without sales-related: Which evidence is most direct?

1. Store cases showing reports without sales-related retaliation. ✓

   These cases directly connect actual reporting with the absence of retaliation related to sales performance.
2. Review the published incident-reporting policy.

   The policy states expected behavior but does not show whether incentives affected reporting or whether retaliation occurred.
3. Analyze store reporting trends alongside sales targets and management actions.

   This analysis can provide useful context, but trends and targets alone do not establish that individual reporters avoided retaliation.
4. Compare bonus formulas, complaint rates, and training completion across all stores.

   These measures describe incentive design and activity, but do not directly document reporting followed by non-retaliatory treatment.

Cases linking actual reports to non-retaliatory treatment directly test the claim.

10. Driver reports with documented non-retaliatory follow-up: Which evidence most directly establishes the claim?

1. Review the non-retaliation policy.

   The policy expresses management intent but does not show how drivers were treated after escalating concerns.
2. Driver reports with documented non-retaliatory follow-up. ✓

   These records show both that drivers escalated concerns and that management’s subsequent treatment was non-retaliatory.
3. Use driver training records, survey results, and monthly report volume to assess safety.

   These measures provide indirect indications, but do not directly establish what happened to drivers after reporting.
4. Compare driver reports with disciplinary actions and supervisor responses over time.

   This comparison can identify patterns, but it does not necessarily document the treatment of the drivers who made particular reports.

Reports paired with documented follow-up show escalation and subsequent treatment.

11. Observed use of the unified escalation route and manager: Which evidence most directly demonstrates that resul

1. Completion records from the post-merger security orientation

   Records show attendance, but not whether staff apply the responsibilities or escalation route in practice.
2. Observed use of the unified escalation route and manager reinforcement ✓

   This directly demonstrates both expected behavior and leadership reinforcement of the merged responsibilities.
3. Approval of one enterprise security policy

   Approval shows governance documentation, but not that personnel use the process or managers reinforce responsibilities.
4. A completed crosswalk mapping legacy policies and roles to the merged structure

   A crosswalk supports alignment planning, but does not establish that employees follow the resulting process.

Observed reporting behavior plus manager reinforcement directly demonstrates integration.

12. Staff use the route and managers respond consistently: Which evidence is most direct?

1. Common policy publication across the partnership

   A common policy communicates expectations but does not show that either practice follows them.
2. Both practices attend the same annual security briefing

   Attendance establishes common exposure to information, not consistent reporting or managerial response.
3. Staff use the route and managers respond consistently in both practices ✓

   This evidence directly tests the two behaviors that the partnership has defined as its cultural result.
4. Practice leaders compare reporting procedures and document remaining differences each quarter

   Comparison identifies alignment gaps, but does not demonstrate that staff report consistently or managers respond consistently.

Consistent reporting and managerial response directly test the defined shared-culture result.

Other CISM domains

• Information Security Program — 528 questions →
• Incident Management — 480 questions →
• Information Security Risk Management — 320 questions →
• All 1600 CISM questions →
• CISM certification: requirements, cost and exam format →