1. Which area is a primary focus of the CISM certification?
Information security governance
Programming best practices
Business process modeling
Hardware manufacturing
Show Answer
✅ Correct Answer: Information security governance
2. What is the primary responsibility of an information security manager?
Aligning security programs with business objectives
Configuring firewalls
Developing software
Managing physical assets
Show Answer
✅ Correct Answer: Aligning security programs with business objectives
3. Which document outlines an organization’s information security objectives?
Information Security Policy
Network Diagram
Business Continuity Plan
Incident Report
Show Answer
✅ Correct Answer: Information Security Policy
4. Which process is essential for identifying security vulnerabilities?
Risk assessment
Asset tagging
Software installation
Inventory management
Show Answer
✅ Correct Answer: Risk assessment
5. What is the primary goal of an incident response plan?
Minimize impact and ensure business continuity
Develop new applications
Increase employee productivity
Optimize hardware performance
Show Answer
✅ Correct Answer: Minimize impact and ensure business continuity
6. Which framework is commonly used for information security governance?
Show Answer
✅ Correct Answer: COBIT
7. What is a key component of a security awareness program?
Employee training
Server upgrades
Access provisioning
Backup scheduling
Show Answer
✅ Correct Answer: Employee training
8. Which action is part of risk mitigation?
Implementing security controls
Documenting incidents
Increasing data storage
Optimizing hardware
Show Answer
✅ Correct Answer: Implementing security controls
9. What is the primary purpose of a business impact analysis (BIA)?
Identify critical business functions
Evaluate software performance
Configure network devices
Document coding standards
Show Answer
✅ Correct Answer: Identify critical business functions
10. Which role is responsible for approving the information security policy?
Executive management
IT administrator
Security analyst
System developer
Show Answer
✅ Correct Answer: Executive management
11. Which process ensures compliance with legal and regulatory requirements?
Security auditing
System testing
Network monitoring
Incident handling
Show Answer
✅ Correct Answer: Security auditing
12. What is the first step in developing an information security strategy?
Understanding business objectives
Installing antivirus software
Reviewing backup logs
Updating hardware
Show Answer
✅ Correct Answer: Understanding business objectives
13. Which control type is a firewall classified as?
Preventive
Corrective
Detective
Directive
Show Answer
✅ Correct Answer: Preventive
14. Which security control addresses post-incident actions?
Corrective
Preventive
Detective
Directive
Show Answer
✅ Correct Answer: Corrective
15. What is a key indicator of an effective information security program?
Reduction in security incidents
Increase in hardware investments
More software licenses
Higher internet speed
Show Answer
✅ Correct Answer: Reduction in security incidents
16. Which process involves continuous monitoring of security controls?
Security governance
System design
Application testing
Change management
Show Answer
✅ Correct Answer: Security governance
17. What is the primary goal of security metrics?
Measure the effectiveness of security controls
Track employee performance
Document system updates
Increase software efficiency
Show Answer
✅ Correct Answer: Measure the effectiveness of security controls
18. Which tool is commonly used for security risk management?
Risk register
Firewall
System log
Access list
Show Answer
✅ Correct Answer: Risk register
19. Which framework aligns with CISM’s information security management?
ISO/IEC 27001
PCI DSS
ITIL
HIPAA
Show Answer
✅ Correct Answer: ISO/IEC 27001
20. What is the role of an information security governance framework?
Ensure alignment with business objectives
Design technical architectures
Oversee hardware procurement
Conduct system testing
Show Answer
✅ Correct Answer: Ensure alignment with business objectives
21. Which of the following is the PRIMARY responsibility of senior management in information security governance?
Setting the strategic direction for security
Configuring firewalls
Writing security policies
Performing vulnerability scans
Show Answer
✅ Correct Answer: Setting the strategic direction for security
22. What is the PRIMARY purpose of a security baseline?
To establish minimum security requirements
To measure employee performance
To track security incidents
To schedule system updates
Show Answer
✅ Correct Answer: To establish minimum security requirements
23. Which of the following is MOST important when developing an information security strategy?
Alignment with business objectives
Technical implementation details
Vendor product selection
Departmental budget allocations
Show Answer
✅ Correct Answer: Alignment with business objectives
24. What is the PRIMARY benefit of implementing a security awareness program?
Reduced human-related security risks
Increased system performance
Lower hardware costs
Faster software development
Show Answer
✅ Correct Answer: Reduced human-related security risks
25. Which of the following is the BEST indicator of effective security governance?
Security is treated as a business enabler
All systems have the latest patches
The security team has grown in size
Security tools are state-of-the-art
Show Answer
✅ Correct Answer: Security is treated as a business enabler
26. What is the PRIMARY purpose of a risk appetite statement?
To define the level of risk an organization is willing to accept
To document all identified risks
To outline security control requirements
To describe incident response procedures
Show Answer
✅ Correct Answer: To define the level of risk an organization is willing to accept
27. Which of the following is MOST important for ensuring security policy compliance?
Executive management support
Detailed technical procedures
Frequent policy updates
Automated enforcement tools
Show Answer
✅ Correct Answer: Executive management support
28. What is the PRIMARY purpose of a security architecture framework?
To guide the design of secure systems
To organize security documentation
To schedule security reviews
To plan security projects
Show Answer
✅ Correct Answer: To guide the design of secure systems
29. Which of the following is the MOST important factor in security program success?
Business alignment
Security budget size
Number of security staff
Quantity of security tools
Show Answer
✅ Correct Answer: Business alignment
30. What is the PRIMARY purpose of security metrics?
To demonstrate the effectiveness of security controls
To track security staff performance
To compare vendors
To schedule maintenance
Show Answer
✅ Correct Answer: To demonstrate the effectiveness of security controls
31. Which of the following is MOST important when evaluating security investments?
Business risk reduction
Technical sophistication
Vendor reputation
Implementation speed
Show Answer
✅ Correct Answer: Business risk reduction
32. What is the PRIMARY purpose of a third-party security assessment?
To evaluate vendor security controls
To reduce internal staff workload
To eliminate the need for internal audits
To outsource security responsibilities
Show Answer
✅ Correct Answer: To evaluate vendor security controls
33. Which of the following is MOST critical for effective security governance?
Clear roles and responsibilities
Advanced security tools
Large security budget
Frequent policy changes
Show Answer
✅ Correct Answer: Clear roles and responsibilities
34. What is the PRIMARY benefit of a security steering committee?
Cross-functional security oversight
Technical implementation guidance
Budget approval authority
Incident response coordination
Show Answer
✅ Correct Answer: Cross-functional security oversight
35. Which of the following is the BEST approach to security policy development?
Collaboration with business units
Adoption of industry templates
Delegation to technical staff
Outsourcing to consultants
Show Answer
✅ Correct Answer: Collaboration with business units
36. What is the PRIMARY purpose of security control testing?
To validate control effectiveness
To identify new vulnerabilities
To train security staff
To document procedures
Show Answer
✅ Correct Answer: To validate control effectiveness
37. Which of the following is MOST important for security policy exception management?
Documented risk acceptance
Technical workarounds
Temporary approvals
Automatic renewals
Show Answer
✅ Correct Answer: Documented risk acceptance
38. What is the PRIMARY purpose of a security maturity assessment?
To evaluate the sophistication of security practices
To measure employee security knowledge
To assess office physical security
To plan security team growth
Show Answer
✅ Correct Answer: To evaluate the sophistication of security practices
39. Which of the following is MOST important for security program sustainability?
Integration with business processes
Dedicated security budget
Large security team
Advanced security tools
Show Answer
✅ Correct Answer: Integration with business processes
40. What is the PRIMARY purpose of a security awareness survey?
To measure employee security knowledge and behaviors
To assess office security features
To evaluate security staff performance
To plan security training topics
Show Answer
✅ Correct Answer: To measure employee security knowledge and behaviors
41. Which of the following is MOST critical for effective risk management?
Risk-based decision making
Elimination of all risks
Standardized risk scores
Centralized risk ownership
Show Answer
✅ Correct Answer: Risk-based decision making
42. What is the PRIMARY purpose of a threat intelligence program?
To inform risk management decisions
To monitor employee activities
To track competitors
To evaluate vendors
Show Answer
✅ Correct Answer: To inform risk management decisions
43. Which of the following is MOST important when prioritizing security risks?
Potential business impact
Ease of mitigation
Regulatory requirements
Vulnerability severity
Show Answer
✅ Correct Answer: Potential business impact
44. What is the PRIMARY purpose of a risk register?
To document and track organizational risks
To record employee attendance
To schedule meetings
To track office supplies
Show Answer
✅ Correct Answer: To document and track organizational risks
45. Which of the following is MOST important for third-party risk management?
Security requirements in contracts
Vendor office locations
Employee count at vendor sites
Vendor parking space allocation
Show Answer
✅ Correct Answer: Security requirements in contracts
46. What is the PRIMARY benefit of a risk assessment methodology?
Consistent evaluation of risks
Reduced assessment time
Automated risk scoring
Standardized reporting
Show Answer
✅ Correct Answer: Consistent evaluation of risks
47. Which of the following is MOST important when communicating risks to executives?
Business impact
Technical details
Historical trends
Industry benchmarks
Show Answer
✅ Correct Answer: Business impact
48. What is the PRIMARY purpose of residual risk reporting?
To inform risk acceptance decisions
To document control failures
To justify security budgets
To compare with competitors
Show Answer
✅ Correct Answer: To inform risk acceptance decisions
49. Which of the following is MOST important for cloud risk management?
Shared responsibility model understanding
Data center location
Provider employee count
Server hardware models
Show Answer
✅ Correct Answer: Shared responsibility model understanding
50. What is the PRIMARY purpose of a risk treatment plan?
To document how risks will be addressed
To track insurance claims
To schedule risk assessments
To organize risk workshops
Show Answer
✅ Correct Answer: To document how risks will be addressed
51. Which of the following is MOST critical for incident response planning?
Clear escalation procedures
Advanced forensic tools
Large response team
Detailed technical playbooks
Show Answer
✅ Correct Answer: Clear escalation procedures
52. What is the PRIMARY purpose of an incident classification scheme?
To prioritize response efforts
To assign blame
To track security staff performance
To calculate insurance premiums
Show Answer
✅ Correct Answer: To prioritize response efforts
53. Which of the following is MOST important for effective incident detection?
Monitoring and alerting capabilities
Large security team
Advanced forensic tools
Detailed documentation
Show Answer
✅ Correct Answer: Monitoring and alerting capabilities
54. What is the PRIMARY purpose of incident response testing?
To validate response capabilities
To identify new vulnerabilities
To train technical staff
To document procedures
Show Answer
✅ Correct Answer: To validate response capabilities
55. Which of the following is MOST important for incident communication?
Predefined stakeholder notification plans
Technical details
Legal review of all communications
Marketing approval
Show Answer
✅ Correct Answer: Predefined stakeholder notification plans
56. What is the PRIMARY purpose of post-incident reviews?
To improve future response
To assign responsibility
To document technical details
To justify security investments
Show Answer
✅ Correct Answer: To improve future response
57. Which of the following is MOST critical for business continuity during incidents?
Alternative processing capabilities
Detailed technical documentation
Large response team
Advanced forensic tools
Show Answer
✅ Correct Answer: Alternative processing capabilities
58. What is the PRIMARY purpose of incident severity levels?
To determine appropriate response resources
To track security staff performance
To calculate financial losses
To compare with industry peers
Show Answer
✅ Correct Answer: To determine appropriate response resources
59. Which of the following is MOST important for incident evidence preservation?
Chain of custody documentation
Advanced forensic tools
Large legal team
Detailed technical skills
Show Answer
✅ Correct Answer: Chain of custody documentation
60. What is the PRIMARY benefit of tabletop exercises?
To validate response plans without disruption
To test technical skills
To train new staff
To document procedures
Show Answer
✅ Correct Answer: To validate response plans without disruption
61. Which of the following is MOST important for security program development?
Alignment with business objectives
Latest security technologies
Large security budget
Comprehensive policies
Show Answer
✅ Correct Answer: Alignment with business objectives
62. What is the PRIMARY purpose of security control baselines?
To establish minimum security requirements
To measure employee performance
To track security incidents
To schedule system updates
Show Answer
✅ Correct Answer: To establish minimum security requirements
63. Which of the following is MOST important for security architecture?
Defense in depth
Standardized hardware
Uniform software
Centralized management
Show Answer
✅ Correct Answer: Defense in depth
64. What is the PRIMARY purpose of security awareness training?
To reduce human-related security risks
To document compliance
To evaluate employees
To promote security team
Show Answer
✅ Correct Answer: To reduce human-related security risks
65. Which of the following is MOST critical for access control management?
Regular review of access rights
Complex password requirements
Biometric authentication
Detailed logging
Show Answer
✅ Correct Answer: Regular review of access rights
66. What is the PRIMARY purpose of security metrics?
To demonstrate security program effectiveness
To track staff performance
To compare vendors
To schedule maintenance
Show Answer
✅ Correct Answer: To demonstrate security program effectiveness
67. Which of the following is MOST important for vulnerability management?
Risk-based prioritization
Automated scanning
Comprehensive reporting
Detailed documentation
Show Answer
✅ Correct Answer: Risk-based prioritization
68. What is the PRIMARY purpose of penetration testing?
To identify exploitable vulnerabilities
To measure network speed
To test employee knowledge
To evaluate office ergonomics
Show Answer
✅ Correct Answer: To identify exploitable vulnerabilities
69. Which of the following is MOST critical for encryption management?
Key management processes
Algorithm selection
Performance impact
Implementation cost
Show Answer
✅ Correct Answer: Key management processes
70. What is the PRIMARY purpose of a security operations center (SOC)?
To monitor and respond to security events
To manage physical security
To oversee building access
To plan security projects
Show Answer
✅ Correct Answer: To monitor and respond to security events
71. Which of the following is MOST important for network security?
Segmentation
Firewall brand
Monitoring tools
Logging details
Show Answer
✅ Correct Answer: Segmentation
72. What is the PRIMARY purpose of endpoint protection?
To secure devices accessing organizational resources
To improve device performance
To standardize hardware
To reduce support costs
Show Answer
✅ Correct Answer: To secure devices accessing organizational resources
73. Which of the following is MOST critical for application security?
Secure development lifecycle
Programming language
Developer skills
Testing tools
Show Answer
✅ Correct Answer: Secure development lifecycle
74. What is the PRIMARY purpose of log management?
To support investigation and analysis
To improve system performance
To reduce storage costs
To document configurations
Show Answer
✅ Correct Answer: To support investigation and analysis
75. Which of the following is MOST important for cloud security?
Shared responsibility model
Data center location
Provider size
Service cost
Show Answer
✅ Correct Answer: Shared responsibility model
76. What is the PRIMARY purpose of security configuration management?
To maintain secure system baselines
To document changes
To track versions
To schedule updates
Show Answer
✅ Correct Answer: To maintain secure system baselines
77. Which of the following is MOST critical for identity management?
Lifecycle management
Authentication methods
Directory services
Reporting capabilities
Show Answer
✅ Correct Answer: Lifecycle management
78. What is the PRIMARY purpose of security monitoring?
To detect potential security incidents
To measure performance
To track users
To document configurations
Show Answer
✅ Correct Answer: To detect potential security incidents
79. Which of the following is MOST important for data protection?
Classification
Storage capacity
Access speed
Backup frequency
Show Answer
✅ Correct Answer: Classification
80. What is the PRIMARY purpose of a security assessment?
To evaluate control effectiveness
To find vulnerabilities
To test staff
To document configurations
Show Answer
✅ Correct Answer: To evaluate control effectiveness
81. Which of the following is MOST important for security governance?
Strategic alignment
Policy completeness
Staff size
Tool sophistication
Show Answer
✅ Correct Answer: Strategic alignment
82. What is the PRIMARY purpose of a security charter?
To define security roles and responsibilities
To document configurations
To track incidents
To schedule assessments
Show Answer
✅ Correct Answer: To define security roles and responsibilities
83. Which of the following is MOST critical for security policy effectiveness?
Management endorsement
Technical detail
Comprehensive coverage
Frequent updates
Show Answer
✅ Correct Answer: Management endorsement
84. What is the PRIMARY purpose of security standards?
To provide specific implementation requirements
To state high-level objectives
To document procedures
To track compliance
Show Answer
✅ Correct Answer: To provide specific implementation requirements
85. Which of the following is MOST important for security program metrics?
Alignment with business objectives
Technical granularity
Automated collection
Real-time reporting
Show Answer
✅ Correct Answer: Alignment with business objectives
86. What is the PRIMARY purpose of a security roadmap?
To plan security program evolution
To document current state
To track incidents
To schedule assessments
Show Answer
✅ Correct Answer: To plan security program evolution
87. Which of the following is MOST critical for third-party security?
Contractual security requirements
Vendor location
Provider size
Service cost
Show Answer
✅ Correct Answer: Contractual security requirements
88. What is the PRIMARY purpose of security budgeting?
To align security investments with risk
To minimize costs
To justify staff
To compare with peers
Show Answer
✅ Correct Answer: To align security investments with risk
89. Which of the following is MOST important for security organizational structure?
Clear reporting lines
Centralization
Staff size
Physical location
Show Answer
✅ Correct Answer: Clear reporting lines
90. What is the PRIMARY purpose of security job descriptions?
To define roles and responsibilities
To evaluate performance
To set salaries
To track certifications
Show Answer
✅ Correct Answer: To define roles and responsibilities
91. Which of the following is MOST critical for risk identification?
Comprehensive asset inventory
Advanced tools
Large team
Detailed processes
Show Answer
✅ Correct Answer: Comprehensive asset inventory
92. What is the PRIMARY purpose of risk analysis?
To evaluate potential impact and likelihood
To document controls
To assign ownership
To track remediation
Show Answer
✅ Correct Answer: To evaluate potential impact and likelihood
93. Which of the following is MOST important for risk evaluation?
Risk appetite comparison
Technical details
Historical data
Industry benchmarks
Show Answer
✅ Correct Answer: Risk appetite comparison
94. What is the PRIMARY purpose of risk treatment?
To modify risk to acceptable levels
To eliminate all risk
To document controls
To assign responsibility
Show Answer
✅ Correct Answer: To modify risk to acceptable levels
95. Which of the following is MOST critical for risk monitoring?
Ongoing assessment
Detailed reporting
Advanced tools
Large team
Show Answer
✅ Correct Answer: Ongoing assessment
96. What is the PRIMARY purpose of risk communication?
To inform decision making
To document processes
To assign blame
To justify budgets
Show Answer
✅ Correct Answer: To inform decision making
97. Which of the following is MOST important for incident preparation?
Response plan development
Advanced tools
Large team
Detailed documentation
Show Answer
✅ Correct Answer: Response plan development
98. What is the PRIMARY purpose of incident detection?
To identify potential security events
To assign responsibility
To document configurations
To test controls
Show Answer
✅ Correct Answer: To identify potential security events
99. Which of the following is MOST critical for incident containment?
Rapid response
Detailed analysis
Legal review
Public relations
Show Answer
✅ Correct Answer: Rapid response
100. What is the PRIMARY purpose of incident eradication?
To eliminate the root cause
To restore systems
To document events
To assign responsibility
Show Answer
✅ Correct Answer: To eliminate the root cause
101. Which of the following is MOST important for incident recovery?
Business process restoration
System patching
Vendor notifications
Legal filings
Show Answer
✅ Correct Answer: Business process restoration
102. What is the PRIMARY purpose of lessons learned from incidents?
To improve future response
To assign blame
To document details
To justify budgets
Show Answer
✅ Correct Answer: To improve future response
103. Which of the following is MOST critical for security control selection?
Risk-based approach
Cost effectiveness
Ease of implementation
Vendor reputation
Show Answer
✅ Correct Answer: Risk-based approach
104. What is the PRIMARY purpose of control implementation?
To reduce risk to acceptable levels
To comply with regulations
To standardize processes
To document procedures
Show Answer
✅ Correct Answer: To reduce risk to acceptable levels
105. Which of the following is MOST important for control monitoring?
Ongoing effectiveness assessment
Detailed reporting
Advanced tools
Large team
Show Answer
✅ Correct Answer: Ongoing effectiveness assessment
106. What is the PRIMARY purpose of control documentation?
To provide evidence of operation
To train staff
To standardize processes
To satisfy auditors
Show Answer
✅ Correct Answer: To provide evidence of operation
107. Which of the following is MOST critical for access control?
Principle of least privilege
Complex passwords
Biometric authentication
Detailed logging
Show Answer
✅ Correct Answer: Principle of least privilege
108. What is the PRIMARY purpose of security awareness?
To modify employee behavior
To document compliance
To evaluate staff
To promote security team
Show Answer
✅ Correct Answer: To modify employee behavior
109. Which of the following is MOST important for physical security?
Layered defenses
Security guard count
Camera resolution
Fence height
Show Answer
✅ Correct Answer: Layered defenses
110. What is the PRIMARY purpose of encryption?
To protect data confidentiality
To improve performance
To reduce storage
To simplify access
Show Answer
✅ Correct Answer: To protect data confidentiality
111. Which of the following is MOST critical for network security?
Segmentation
Firewall brand
Monitoring tools
Logging details
Show Answer
✅ Correct Answer: Segmentation
112. What is the PRIMARY purpose of vulnerability management?
To reduce attack surface
To document weaknesses
To evaluate staff
To justify budgets
Show Answer
✅ Correct Answer: To reduce attack surface
113. Which of the following is MOST important for patch management?
Risk-based prioritization
Automated deployment
Comprehensive testing
Detailed documentation
Show Answer
✅ Correct Answer: Risk-based prioritization
114. What is the PRIMARY purpose of logging?
To support investigations
To improve performance
To reduce storage
To document configurations
Show Answer
✅ Correct Answer: To support investigations
115. Which of the following is MOST critical for backup management?
Regular testing
Storage capacity
Backup frequency
Media type
Show Answer
✅ Correct Answer: Regular testing
116. What is the PRIMARY purpose of disaster recovery planning?
To restore critical operations
To document procedures
To train staff
To justify budgets
Show Answer
✅ Correct Answer: To restore critical operations
117. Which of the following is MOST important for business continuity?
Critical process identification
Alternate site quality
Recovery team size
Exercise frequency
Show Answer
✅ Correct Answer: Critical process identification
118. What is the PRIMARY purpose of security assessments?
To evaluate control effectiveness
To find vulnerabilities
To test staff
To document configurations
Show Answer
✅ Correct Answer: To evaluate control effectiveness
119. Which of the following is MOST critical for security audits?
Independent perspective
Technical depth
Frequency
Report length
Show Answer
✅ Correct Answer: Independent perspective
120. What is the PRIMARY purpose of security certifications?
To validate security knowledge
To promote individuals
To satisfy regulators
To justify salaries
Show Answer
✅ Correct Answer: To validate security knowledge
121. Which of the following is MOST important for security training?
Role-specific content
Training frequency
Instructor qualifications
Facility quality
Show Answer
✅ Correct Answer: Role-specific content
122. What is the PRIMARY purpose of security policies?
To establish organizational expectations
To document procedures
To train staff
To satisfy auditors
Show Answer
✅ Correct Answer: To establish organizational expectations
123. Which of the following is MOST critical for security standards?
Implementation specificity
Comprehensiveness
Update frequency
Approval level
Show Answer
✅ Correct Answer: Implementation specificity
124. What is the PRIMARY purpose of security procedures?
To provide step-by-step guidance
To state requirements
To document configurations
To train staff
Show Answer
✅ Correct Answer: To provide step-by-step guidance
125. Which of the following is MOST important for security guidelines?
Flexibility in implementation
Technical detail
Comprehensiveness
Approval level
Show Answer
✅ Correct Answer: Flexibility in implementation
126. What is the PRIMARY purpose of security baselines?
To establish minimum requirements
To document configurations
To train staff
To satisfy auditors
Show Answer
✅ Correct Answer: To establish minimum requirements
127. Which of the following is MOST critical for security architecture?
Defense in depth
Standardization
Documentation
Tool integration
Show Answer
✅ Correct Answer: Defense in depth
128. What is the PRIMARY purpose of security models?
To guide control implementation
To document requirements
To train staff
To satisfy auditors
Show Answer
✅ Correct Answer: To guide control implementation
129. Which of the following is MOST important for security frameworks?
Alignment with business needs
Comprehensiveness
Industry acceptance
Regulatory approval
Show Answer
✅ Correct Answer: Alignment with business needs
130. What is the PRIMARY purpose of security principles?
To guide decision making
To document requirements
To train staff
To satisfy auditors
Show Answer
✅ Correct Answer: To guide decision making
131. Which of the following is MOST critical for security governance?
Executive support
Detailed policies
Large staff
Advanced tools
Show Answer
✅ Correct Answer: Executive support
132. What is the PRIMARY purpose of security committees?
To provide cross-functional oversight
To make technical decisions
To manage projects
To review incidents
Show Answer
✅ Correct Answer: To provide cross-functional oversight
133. Which of the following is MOST important for security budgeting?
Risk-based allocation
Historical spending
Industry benchmarks
Regulatory requirements
Show Answer
✅ Correct Answer: Risk-based allocation
134. What is the PRIMARY purpose of security roles and responsibilities?
To clarify accountabilities
To document skills
To set salaries
To track certifications
Show Answer
✅ Correct Answer: To clarify accountabilities
135. Which of the following is MOST critical for security strategy?
Alignment with business objectives
Technical sophistication
Budget size
Staff size
Show Answer
✅ Correct Answer: Alignment with business objectives
136. What is the PRIMARY purpose of security program assessment?
To evaluate effectiveness
To document compliance
To justify budgets
To compare with peers
Show Answer
✅ Correct Answer: To evaluate effectiveness
137. Which of the following is MOST important for security culture?
Employee awareness and commitment
Security team size
Training frequency
Policy comprehensiveness
Show Answer
✅ Correct Answer: Employee awareness and commitment
138. What is the PRIMARY purpose of security communication?
To promote awareness and understanding
To document incidents
To train staff
To satisfy auditors
Show Answer
✅ Correct Answer: To promote awareness and understanding
139. Which of the following is MOST critical for security third-party management?
Contractual security requirements
Vendor location
Provider size
Service cost
Show Answer
✅ Correct Answer: Contractual security requirements
140. What is the PRIMARY purpose of security regulatory compliance?
To meet legal obligations
To improve security
To document procedures
To train staff
Show Answer
✅ Correct Answer: To meet legal obligations
141. Which of the following is MOST important for security risk assessment?
Asset valuation
Assessment frequency
Methodology
Reporting format
Show Answer
✅ Correct Answer: Asset valuation
142. What is the PRIMARY purpose of security risk treatment?
To modify risk to acceptable levels
To eliminate all risk
To document controls
To assign responsibility
Show Answer
✅ Correct Answer: To modify risk to acceptable levels
143. Which of the following is MOST critical for security incident response?
Clear escalation procedures
Advanced forensic tools
Large response team
Detailed technical playbooks
Show Answer
✅ Correct Answer: Clear escalation procedures
144. What is the PRIMARY purpose of security incident classification?
To prioritize response efforts
To assign blame
To track staff performance
To calculate insurance premiums
Show Answer
✅ Correct Answer: To prioritize response efforts
145. Which of the following is MOST important for security incident detection?
Monitoring and alerting capabilities
Large security team
Advanced forensic tools
Detailed documentation
Show Answer
✅ Correct Answer: Monitoring and alerting capabilities
146. What is the PRIMARY purpose of security incident testing?
To validate response capabilities
To identify new vulnerabilities
To train technical staff
To document procedures
Show Answer
✅ Correct Answer: To validate response capabilities
147. Which of the following is MOST critical for security incident communication?
Predefined stakeholder notification plans
Technical details
Legal review of all communications
Marketing approval
Show Answer
✅ Correct Answer: Predefined stakeholder notification plans
148. What is the PRIMARY purpose of post-incident reviews?
To improve future response
To assign responsibility
To document technical details
To justify security investments
Show Answer
✅ Correct Answer: To improve future response
149. Which of the following is MOST important for business continuity during security incidents?
Alternative processing capabilities
Detailed technical documentation
Large response team
Advanced forensic tools
Show Answer
✅ Correct Answer: Alternative processing capabilities
150. What is the PRIMARY purpose of security incident severity levels?
To determine appropriate response resources
To track security staff performance
To calculate financial losses
To compare with industry peers
Show Answer
✅ Correct Answer: To determine appropriate response resources