CISM Information Security Program: 528 practice questions

12 of the 528 Information Security Program questions in the Certsqill CISM bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISM? Take the free 5-min readiness check →

1. Map the coverage gap and submit a resourced staffing: What is the best action?

1. Assign existing analysts additional permanent shifts

   Permanent reassignment may create unsustainable workload and does not establish approved recurring capacity for continuous coverage.
2. Buy a monitoring platform using existing discretionary funds

   A platform does not supply sustainable staffing, and using funds without addressing recurring operating capacity fails the strategy requirement.
3. Postpone monitoring until transaction growth stabilizes

   Postponement conflicts with the approved strategy and leaves the known coverage gap during expanding online operations.
4. Map the coverage gap and submit a resourced staffing proposal ✓

   The proposal connects required coverage, current capability, operating demand, and recurring cost for the authorized approval decision.

Document the capability gap and propose funded staffing because the approved strategy requires coverage beyond current capacity.

2. Define alert ownership and operating capacity before: What should happen first?

1. Deploy the platform with business-hours triage and review coverage later

   This leaves after-hours alerts without an assigned response and postpones a prerequisite for effective operation.
2. Assign warehouse supervisors to investigate alerts during local shifts

   This changes responsibilities without establishing security competence, authority, escalation, or sustainable staffing approval.
3. Reduce detection rules until existing security staff can provide continuous coverage

   Reducing rules may lower workload but does not establish ownership or obtain the recurring capacity needed for the intended service.
4. Define alert ownership and operating capacity before deployment ✓

   The service needs accountable investigators and sustainable coverage before alerts are generated, while any recurring staffing requirement must follow the applicable approval route.

Establish accountable ownership and sustainable capacity before launching the monitoring service.

3. Create a development plan and nominate a successor: Which action best meets the requirement?

1. Create a development plan and nominate a successor candidate ✓

   A targeted development plan builds required competence while formally identifying succession progress against the six-month requirement.
2. Keep the current lead and document existing procedures

   Procedures preserve knowledge but do not create a qualified successor or demonstrate progress toward the stated competence requirement.
3. Rotate every analyst through incident leadership

   Unstructured rotation may broaden exposure but does not ensure one candidate achieves the defined competence profile.
4. Request an additional position before selecting anyone

   A new position may help later, but delaying development ignores the manager’s available authority and six-month succession requirement.

Use available development authority to build and nominate a successor, while escalating any later position request separately.

4. Centralize policy and federate operational implementation: Which delivery model best fits these conditions?

1. Centralize policy and federate operational implementation ✓

   This model preserves enterprise consistency while allowing practices to adapt execution to distinct workflows and delegated responsibilities.
2. Outsource identity governance to each client

   Client control would fragment partnership governance and does not satisfy the central team’s established policy authority.
3. Let each practice define its own identity policy

   Independent policies would undermine the strategy’s requirement for consistent identity and access expectations across the partnership.
4. Centralize all security operations under the partnership team

   Full centralization may reduce local responsiveness and conflicts with practices retaining operational responsibility under the stated model.

Central policy with federated execution balances enterprise consistency and practice-level operational responsibility.

5. Obtain architecture approval: What should the manager do?

1. Postpone checkout protection until the next release cycle

   A blanket postponement abandons an achievable dependency-aware schedule even though the manager can sequence the prerequisite work.
2. Obtain architecture approval, complete segmentation, then implement identity protection ✓

   This is the shortest valid path that respects both prerequisites and the manager’s authority while pursuing the holiday objective.
3. Request an executive exception to bypass architecture approval and meet the launch date

   The scenario states that approved architecture is required and the manager cannot waive it; seeking a bypass conflicts with that governance condition.
4. Begin identity-service configuration while architecture approval is pending

   Configuration before the required approval and segmentation may create rework and does not make the service available sooner.

Follow the stated approval and technical dependencies in sequence rather than bypassing them.

6. Assign interim enterprise ownership and fund a shared: What is the best management action?

1. Leave ownership with the hub manager and add checklist reviews

   Checklist reviews do not establish appropriate security accountability or provide specialist coverage for the high-value operation.
2. Assign interim enterprise ownership and fund a shared service ✓

   Interim ownership restores accountability while a shared service addresses high-risk coverage within the hub’s funding constraint.
3. Wait for next year’s dedicated specialist budget

   Waiting leaves a known high-value coverage gap despite an available shared-service approach and immediate enterprise accountability need.
4. Give the hub unrestricted authority to outsource security

   Unrestricted local outsourcing exceeds the stated authority and could create inconsistent service arrangements without enterprise ownership.

Assign interim enterprise ownership and use shared capacity to restore accountable coverage despite the hub’s staffing constraint.

7. Fund controls that reduce medication-system risk first: What should the manager recommend?

1. Split funding equally between both initiatives

   Equal allocation dilutes the limited investment and ignores the explicit requirement to prioritize risk reduction tied to patient care.
2. Fund email modernization because it serves more users

   User population alone does not outweigh the documented patient-care impact and stated strategy for risk-based prioritization.
3. Fund whichever team submits the stronger technical design

   Technical quality matters, but it does not replace the strategy’s explicit priority for patient-care risk reduction.
4. Fund controls that reduce medication-system risk first ✓

   The recommendation follows the approved strategy by prioritizing the largest patient-care impact when available funding permits only one improvement.

Prioritize medication-system controls because the strategy explicitly ranks patient-care risk above broader but lower-impact modernization.

8. Recurring service costs: What should the proposal emphasize?

1. A minimum budget with flexible service expectations

   Unbounded expectations and insufficient funding undermine predictable service delivery and prevent reliable evaluation of outcomes.
2. Last year’s temporary spending level without adjustment

   Historical temporary spending may not reflect recurring demand, current risks, dependencies, or predictable annual operating requirements.
3. Recurring service costs, outcomes, risks, and dependencies ✓

   These elements demonstrate sustainable capacity, business value, residual dependencies, and the basis for the board’s recurring investment decision.
4. A larger tool inventory and vendor feature comparison

   Features and inventory do not demonstrate sustainable operations, measurable outcomes, or alignment with client commitments and business risk.

Build the recurring proposal around sustainable costs, measurable outcomes, business risks, and dependencies required for predictable service delivery.

9. A capacity plan mapping forecast demand to available roles: Which evidence most directly establishes the answe

1. The approved security strategy, initiative roadmap, and annual training objectives

   These establish direction and development priorities but do not demonstrate whether available personnel can execute next quarter’s workload.
2. A capacity plan mapping forecast demand to available roles and staffing gaps ✓

   This directly compares the initiatives’ expected workload with available capability and identifies shortages that could affect delivery.
3. The security organization’s approved position list

   Approved positions show planned structure, not actual availability, capability, competing demand, or staffing gaps.
4. Current security-team utilization reports

   Utilization describes present workload but may not map future initiative demand to the roles and skills required.

A demand-to-capacity comparison directly tests whether available roles and resources can deliver the initiatives.

10. An approved operating model linking workload: Which evidence most directly determines whether the program can

1. The business case showing projected detection benefits and cost savings.

   The business case supports investment value but does not demonstrate staffing, authority, coverage, or operational feasibility.
2. A deployment plan covering integrations, training, milestones, and rollout dates.

   Implementation milestones show progress toward deployment but do not resolve continuous ownership, staffing authority, or sustainable coverage.
3. Current overtime and alert-volume reports.

   These show workload pressure but do not establish sustainable coverage, accountable roles, decision authority, or available capacity.
4. An approved operating model linking workload, coverage, roles, authority, and capacity. ✓

   This directly tests whether authorized personnel can handle expected alerts across the required operating period with sustainable resources.

An approved operating model must reconcile workload, coverage, accountable roles, authority, and capacity.

11. A role-to-competency matrix showing qualified primary: Which evidence most directly demonstrates compliance wi

1. The security strategy’s statement supporting organizational resilience

   The strategy expresses intent, but does not provide role-specific evidence of qualified backup personnel.
2. A current list of employees assigned to security duties

   The list identifies assignments, but does not demonstrate competence or backup coverage for critical roles.
3. A succession workshop attendance report for security managers

   Workshop attendance shows preparation activity, but does not prove qualified backups exist for each critical role.
4. A role-to-competency matrix showing qualified primary and backup personnel ✓

   The matrix directly demonstrates both assigned coverage and required competence for each critical role.

The requirement concerns qualified backup coverage, so a role-to-competency matrix provides direct evidence for every critical position.

12. Local execution with central oversight and metrics: Which evidence best demonstrates that model?

1. A shared security policy library with annual central approval

   Policies establish direction but do not prove local accountability, execution, or outcome measurement.
2. A central operations team performing security work for every independently managed office

   Central execution demonstrates centralization, not the approved model of local delivery under common governance.
3. Separate office procedures mapped to each practice's client commitments

   Tailored procedures support local delivery but do not demonstrate common oversight or comparable outcomes.
4. Local execution with central oversight and metrics ✓

   This directly demonstrates delegated delivery governed through common oversight and measurable results.

Federation combines local execution with central oversight and measurable outcomes.

Other CISM domains

• Incident Management — 480 questions →
• Information Security Risk Management — 320 questions →
• Information Security Governance — 272 questions →
• All 1600 CISM questions →
• CISM certification: requirements, cost and exam format →