[Nov 27, 2024] CISM Dumps PDF and Test Engine Exam Questions - Pass4sures
Verified CISM exam dumps Q&As with Correct 1180 Questions and Answers
NEW QUESTION # 610
Which of the following BEST indicates the effectiveness of the vendor risk management process?
- A. Increase in the percentage of vendors that have reported security breaches
- B. Increase in the percentage of vendors conducting mandatory security training
- C. Increase in the percentage of vendors with a completed due diligence review
- D. Increase in the percentage of vendors certified to a globally recognized security standard
Answer: C
NEW QUESTION # 611
Which of the following should be part of the final phase of an incident response plan?
- A. Updating the risk register
- B. Performing a system rollback
- C. Reviewing lessons learned
- D. Recovering the impacted system
Answer: C
NEW QUESTION # 612
Which of the following is MOST effective in preventing the introduction of vulnerabilities that may disrupt the availability of a critical business application?
- A. A patch management process
- B. Logical access controls
- C. Version control
- D. Change management controls
Answer: A
NEW QUESTION # 613
Which of the following is the BEST way for senior leadership to demonstrate commitment for an effective Information security strategy?
- A. Appointing the top information security role to report to the CEO
- B. Communicating organization risk appetite and tolerance
- C. Allocating adequate resources for information security
- D. Approving a comprehensive risk management program
Answer: C
NEW QUESTION # 614
When supporting an organization's privacy officer, which of the following is the information security manager's PRIMARY role regarding primacy requirements?
- A. Determining data classification
- B. Conducting privacy awareness programs
- C. Ensuring appropriate controls are in place
- D. Monitoring the transfer of private data
Answer: C
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
Explanation/Reference:
NEW QUESTION # 615
The BEST approach in managing a security incident involving a successful penetration should be to:
- A. permit the incident to continue to trace the source.
- B. examine the incident response process for deficiencies.
- C. allow business processes to continue during the response.
- D. allow the security team to assess the attack profile.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Since information security objectives should always be linked to the objectives of the business, it is imperative that business processes be allowed to continue whenever possible. Only when there is no alternative should these processes be interrupted. Although it is important to allow the security team to assess the characteristics of an attack, this is subordinate to the needs of the business. Permitting an incident to continue may expose the organization to additional damage. Evaluating the incident management process for deficiencies is valuable but it, too. is subordinate to allowing business processes to continue.
NEW QUESTION # 616
Which of the following risks is represented in the risk appetite of an organization?
- A. Residual
- B. Control
- C. Audit
- D. Inherent
Answer: A
Explanation:
Residual risk is unmanaged, i.e., inherent risk which remains uncontrolled. This is key to the organization's risk appetite and is the amount of residual risk that a business is living with that affects its viability. Hence, inherent risk is incorrect. Control risk, the potential for controls to fail, and audit risk, which relates only to audit's approach to their work, are not relevant in this context.
NEW QUESTION # 617
Which of the following would BEST help to ensure an organization's security program is aligned with business objectives?
- A. Security policies are reviewed and approved by the chief information officer.
- B. The organization's board of directors includes a dedicated information security specialist.
- C. Project managers receive annual information security awareness training.
- D. The security strategy is reviewed and approved by the organization's executive committee.
Answer: D
NEW QUESTION # 618
An information security manager has been assigned to implement more restrictive preventive controls. By doing so, the net effect will be to PRIMARILY reduce the:
- A. threat.
- B. vulnerability.
- C. probability.
- D. loss.
Answer: B
Explanation:
Implementing more restrictive preventive controls mitigates vulnerabilities but not the threats. Losses and probability of occurrence may not be primarily or directly affected.
NEW QUESTION # 619
When considering the value of assets, which of the following would give the information security manager the MOST objective basis for measurement of value delivery in information security governance?
- A. Number of controls
- B. Effectiveness of controls
- C. Test results of controls
- D. Cost of achieving control objectives
Answer: D
Explanation:
Explanation
Comparison of cost of achievement of control objectives and corresponding value of assets sought to be protected would provide a sound basis for the information security manager to measure value delivery.
Number of controls has no correlation with the value of assets unless the effectiveness of the controls and their cost are also evaluated. Effectiveness of controls has no correlation with the value of assets unless their costs are also evaluated. Test results of controls have no correlation with the value of assets unless the effectiveness of the controls and their cost are also evaluated.
NEW QUESTION # 620
An organization has identified an increased threat of external brute force attacks in its environment. Which of the following is the MOST effective way to mitigate this risk to the organization's critical systems?
- A. Increase the frequency of log monitoring and analysis.
- B. Implement multi-factor authentication (MFA).
- C. Increase the sensitivity of intrusion detection systems.
- D. Implement a security information and event management system (SIEM).
Answer: D
NEW QUESTION # 621
The FIRST step in a risk assessment for a business application is to:
- A. rank the threats to the application
- B. identify the threats to the application
- C. identify the vulnerabilities of the application
- D. identify the assets used by the application.
Answer: A
NEW QUESTION # 622
Which of the following should an information security manager do FIRST to address the risk associated with a new third-party cloud application that will not meet organizational security requirements?
- A. Include security requirements in the contract.
- B. Restrict application network access temporarily.
- C. Update the risk register.
- D. Consult with the business owner.
Answer: D
Explanation:
Explanation
Consulting with the business owner is the FIRST course of action that the information security manager should take to address the risk associated with a new third-party cloud application that will not meet organizational security requirements, because it helps to understand the business needs and expectations for using the application, and to communicate the security risks and implications. The information security manager and the business owner should work together to evaluate the trade-offs between the benefits and the risks of the application, and to determine the best course of action, such as modifying the requirements, finding an alternative solution, or accepting the risk.
References =
CISM Review Manual, 16th Edition, ISACA, 2020, p. 41: "The information security manager should consult with the business owners to understand their needs and expectations for using third-party services, and to communicate the security risks and implications." CISM Review Manual, 16th Edition, ISACA, 2020, p. 42: "The information security manager and the business owners should collaborate to evaluate the trade-offs between the benefits and the risks of using third-party services, and to determine the best course of action, such as modifying the requirements, finding an alternative solution, or accepting the risk." Best Practices to Manage Risks in the Cloud - ISACA: "The information security manager should work with the business owner to define the security requirements for the cloud service, such as data protection, access control, incident response, and compliance."
NEW QUESTION # 623
When performing a business impact analysis (BIA), who should be responsible for determining the initial recovery time objective (RTO)?
- A. External consultant
- B. Information security manager
- C. Information owners
- D. Business continuity coordinator
Answer: C
Explanation:
Explanation
Information owners are responsible for determining the initial recovery time objective (RTO) for their information assets and processes, as they are the ones who understand the business requirements and impact of a disruption. An external consultant may assist in conducting the business impact analysis (BIA), but does not have the authority to decide the RTO. An information security manager may provide input on the security aspects of the RTO, but does not have the business perspective to determine the RTO. A business continuity coordinator may facilitate the BIA process and ensure the alignment of the RTO with the business continuity plan, but does not have the ownership of the information assets and processes. References = CISM Review Manual 15th Edition, page 202.
When performing a business impact analysis (BIA), it is the responsibility of the business continuity coordinator to determine the initial recovery time objective (RTO). The RTO is a critical component of the BIA and should be determined in cooperation with the information owners. The RTO should reflect the maximum tolerable period of disruption (MTPD) and should be used to guide the development of the recovery strategy.
NEW QUESTION # 624
Which of the following would provide the MOST essential input for the development of an information security strategy?
- A. Availability of capable information security resources
- B. Results of a technology risk assessment
- C. Results of an information security gap analysis
- D. Measurement of security performance against IT goals
Answer: C
NEW QUESTION # 625
An employee has just reported the loss of a personal mobile device containing corporate information. Which of the following should the information security manager do FIRST?
- A. Initiate incident response.
- B. Initiate a device reset.
- C. Disable remote
- D. Conduct a risk assessment.
Answer: A
Explanation:
Explanation
Initiating incident response is the first course of action for an information security manager when an employee reports the loss of a personal mobile device containing corporate information. This will help to contain the incident, assess the impact, and take appropriate measures to prevent or mitigate further damage. According to ISACA, incident management is one of the key processes for information security governance. Initiating a device reset, disabling remote access, and conducting a risk assessment are possible subsequent actions, but they should be part of the incident response plan. References: 1: Find, lock, or erase a lost Android device - Google Account Help 2: Find, lock, or erase a lost Android device - Android Help 3: Lost or Stolen Mobile Device Procedure - Information Security Office : CISM Practice Quiz | CISM Exam Prep | ISACA : 200 CISM Exam Prep Questions | Free Practice Test | Simplilearn : CISM practice questions to prep for the exam | TechTarget
NEW QUESTION # 626
The MOST important reason for formally documenting security procedures is to ensure:
- A. processes are repeatable and sustainable.
- B. alignment with business objectives.
- C. auditability by regulatory agencies.
- D. objective criteria for the application of metrics.
Answer: A
Explanation:
Explanation/Reference:
Explanation:
Without formal documentation, it would be difficult to ensure that security processes are performed in the proper manner every time that they are performed. Alignment with business objectives is not a function of formally documenting security procedures. Processes should not be formally documented merely to satisfy an audit requirement. Although potentially useful in the development of metrics, creating formal documentation to assist in the creation of metrics is a secondary objective.
NEW QUESTION # 627
Which of the following is MOST critical for the successful implementation and maintenance of a security policy?
- A. Management support and approval for the implementation and maintenance of a security policy
- B. Enforcement of security rules by providing punitive actions for any violation of security rules
- C. Stringent implementation, monitoring and enforcing of rules by the security officer through access control software
- D. Assimilation of the framework and intent of a written security policy by all appropriate parties
Answer: D
Explanation:
Section: INCIDENT MANAGEMENT AND RESPONSE
Explanation
Explanation:
Assimilation of the framework and intent of a written security policy by the users of the system is critical to the successful implementation and maintenance of the security policy. A good password system may exist, but if the users of the system keep passwords written on their desk, the password is of little value. Management support and commitment is no doubt important, but for successful implementation and maintenance of security policy, educating the users on the importance of security is paramount. The stringent implementation, monitoring and enforcing of rules by the security officer through access control software, and provision for punitive actions for violation of security rules, is also required, along with the user's education on the importance of security.
NEW QUESTION # 628
Which of the following metrics is the BEST indicator of an abuse of the change management process that could compromise information security?
- A. Percentage of changes that include post-approval supplemental add-ons
- B. Large percentage decrease in monthly change requests
- C. Small number of change request
- D. High ratio of lines of code changed to total lines of code
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation/Reference:
NEW QUESTION # 629
Which of the following BEST supports investments in an information security program?
- A. Gap analysis results
- B. Business cases
- C. Risk assessment results
- D. Business impact analysis (BIA)
Answer: B
NEW QUESTION # 630
The PRIMARY purpose of using risk analysis within a security program is to:
- A. justify the security expenditure.
- B. help businesses prioritize the assets to be protected.
- C. assess exposures and plan remediation.
- D. inform executive management of residual risk value.
Answer: C
Explanation:
Explanation
Risk analysis explores the degree to which an asset needs protecting so this can be managed effectively. Risk analysis indirectly supports the security expenditure, but justifying the security expenditure is not its primary purpose. Helping businesses prioritize the assets to be protected is an indirect benefit of risk analysis, but not its primary purpose. Informing executive management of residual risk value is not directly relevant.
NEW QUESTION # 631
Meeting which of the following security objectives BEST ensures that information is protected against unauthorized modification?
- A. Authenticity
- B. Integrity
- C. Confidentiality
- D. Availability
Answer: B
NEW QUESTION # 632
What is the PRIMARY role of the information security manager in the process of information classification within an organization?
- A. Securing information assets in accordance with their classification
- B. Defining and ratifying the classification structure of information assets
- C. Deciding the classification levels applied to the organization's information assets
- D. Checking if information assets have been classified properly
Answer: B
Explanation:
Defining and ratifying the classification structure of information assets is the primary role of the information security manager in the process of information classification within the organization. Choice B is incorrect because the final responsibility for deciding the classification levels rests with the data owners. Choice C is incorrect because the job of securing information assets is the responsibility of the data custodians. Choice D may be a role of an information security manager but is not the key role in this context.
NEW QUESTION # 633
When determining an acceptable risk level, which of the following is the MOST important consideration?
- A. Risk matrices
- B. System criticality
- C. Vulnerability scores
- D. Threat profile
Answer: D
NEW QUESTION # 634
......
ISACA CISM Test Engine PDF - All Free Dumps: https://www.pass4sures.top/Isaca-Certification/CISM-testking-braindumps.html
Get New CISM Certification – Valid Exam Dumps Questions: https://drive.google.com/open?id=1xj6FwZZCH4wQb6yWBc3xMA4PFGHIv4BO