An automated control in an application blocks payments above an approval limit. It was tested and worked correctly last year. What is the MOST efficient basis for continued reliance on it this year?

Confirming that change management over the application has been effective since the last test

Which statement BEST describes defense in depth in a security architecture?

Multiple independent layers of controls, so one failure does not expose the asset

A critical supplier refuses to allow the organization to audit its security controls. What is the BEST alternative?

Obtaining independent assurance reports plus contractual security commitments

During ISO/IEC 27001 implementation, an external party asks why several Annex A controls are excluded. Which document should provide the answer?

The Statement of Applicability, which records each control's inclusion or exclusion with justification

Who should receive information security awareness training?

All employees and relevant contractors with access to information

Which activity BEST raises senior executives' understanding of their role in a cyber crisis?

An executive tabletop exercise based on a realistic scenario affecting the business

An organization must show conformity with three overlapping security frameworks, and control owners complain about answering the same questions repeatedly. Which approach is MOST effective?

Map one common control set to all three frameworks and test once

A business owner has formally accepted a significant security risk to meet a product launch date. What should the information security manager ensure next?

The decision, rationale, conditions and review date are recorded and communicated

Free CISM Domain 3 Practice Questions with Answers

2026-10-19

These five CISM Domain 3 questions are drawn from Auditor Path's bank. Each follows ISACA's item-writing style: a scenario, four plausible options and one BEST answer. Read the explanation even when you get it right — it names the judgment the exam is testing.

Domain 3, Information Security Program, is 33% of the CISM exam.

Question 1: Information Security Policies, Procedures and Guidelines

Which content is MOST appropriate to include in a high-level information security policy?

A. Step-by-step instructions for resetting user passwords at the service desk
B. Approved firewall rule sets for each network zone and the review schedule for them
C. A list of preferred security products, versions and approved suppliers
D. Management intent, scope and security responsibilities

Answer: D. A high-level policy sets direction, scope and accountability. Technical details and operational steps are placed in standards and procedures so the policy remains stable.

Exam mindset: Policy says what and who, not how.

Question 2: Information Security Program Communications and Reporting

The executive committee says the monthly security dashboard, which lists counts of blocked attacks and patches applied, is unhelpful. What is the BEST change?

A. Reduce the report frequency from monthly to annually to focus on long-term trends
B. Add more technical metrics so executives have a complete picture of security operations
C. Replace the dashboard with a narrative written by the security operations team
D. Report key risk indicators and trends against thresholds set from the risk appetite

Answer: D. Executives need to know whether risk is within appetite and trending in the right direction. Key risk indicators tied to appetite support decisions, whereas activity counts do not.

Exam mindset: Report risk, not activity.

Question 3: Information Security Program Resources (e.g., People, Tools, Technologies)

An information security manager has limited staff. Which approach BEST ensures the most important security activities are performed?

A. Prioritizing activities by risk and staffing the highest-risk areas first
B. Spreading staff evenly across the activities in the security program
C. Focusing staff on the activities in scope for the next external audit
D. Postponing new activities until additional security headcount is approved

Answer: A. With constrained resources, focusing effort where risk is greatest delivers the most protection for the business.

Exam mindset: Allocate scarce resources by risk.

Question 4: Information Security Program Metrics

A metric shows that patching compliance is 98%, yet several breaches exploited unpatched systems. What is the MOST likely explanation?

A. The compliance target of 98% is set too low for the organization's risk appetite
B. Attackers exploited zero-day vulnerabilities for which no vendor patches had yet been released
C. The patching metric is reported to the steering committee only once each quarter
D. The metric excludes some critical systems or does not track risk-relevant patches

Answer: D. Metrics can mislead when their scope or definition does not match the actual risk. Validation of metric design is required.

Exam mindset: A good-looking metric can hide risk.

Question 5: Information Security Control Implementation and Integrations

Which factor MOST increases the chance that a new security control will be adopted successfully by the business?

A. Involving business stakeholders and fitting the control into existing processes
B. Implementing it quickly by executive mandate with minimal business consultation
C. Configuring it with the strictest available settings from day one of rollout
D. Assigning implementation to the vendor under a fixed-price services contract

Answer: A. Controls that fit existing workflows and have stakeholder buy-in are more likely to be used correctly.

Exam mindset: Integrate controls into how work is done.

Keep practising

The quiz below draws more questions from every CISM Domain 3 subtopic. Sign in to practise the full bank, take timed 150-question mocks and see your readiness by domain.