Best Quality CISM Exam Questions ISACA Test To Gain Brilliante Result!
Preparations of CISM Exam 2024 Isaca Certification Unlimited 672 Questions
NEW QUESTION # 61
Which of the following should be the PRIMARY basis for determining risk appetite?
- A. Independent audit results
- B. Organizational objectives
- C. Senior management input
- D. Industry benchmarks
Answer: C
NEW QUESTION # 62
An organization is considering moving to a cloud service provider for the storage of sensitive dat a. Which of the following should be considered FIRST?
- A. Requirements for data encryption
- B. Right to terminate clauses in the contract
- C. Results of the cloud provider's control report
- D. A destruction-of-data clause in the contract
Answer: C
NEW QUESTION # 63
Which of the following is MOST important for an information security manager to communicate to senior management regarding the security program?
- A. User roles and responsibilities
- B. Security architecture changes
- C. Potential risks and exposures
- D. Impact analysis results
Answer: D
NEW QUESTION # 64
A risk assessment should be conducted:
- A. every three to six months for critical business processes.
- B. by external parties to maintain objectivity.
- C. annually or whenever there is a significant change.
- D. once a year for each business process and subprocess.
Answer: C
Explanation:
Section: INFORMATION RISK MANAGEMENT
Explanation:
Risks are constantly changing. Choice D offers the best alternative because it takes into consideration a reasonable time frame and allows flexibility to address significant change. Conducting a risk assessment once a year is insufficient if important changes take place. Conducting a risk assessment every three-to-six months for critical processes may not be necessary, or it may not address important changes in a timely manner. It is not necessary for assessments to be performed by external parties.
NEW QUESTION # 65
What task should be performed once a security incident has been verified?
- A. Determine the root cause of the incident.
- B. Identify the incident.
- C. Contain the incident.
- D. Perform a vulnerability assessment.
Answer: C
Explanation:
Identifying the incident means verifying whether an incident has occurred and finding out more details about the incident. Once an incident has been confirmed (identified), the incident management team should limit further exposure. Determining the root cause takes place after the incident has been contained. Performing a vulnerability assessment takes place after the root cause of an incident has been determined, in order to find new vulnerabilities.
NEW QUESTION # 66
Several identified risks have been mitigated to an acceptable level with appropriate controls. Which of the following activities would BEST help to maintain acceptable risk levels?
- A. Frequent assessments of risk action plans
- B. Periodic reviews of changes to the environment
- C. Periodic cost-benefit analyses of the implemented controls
- D. Frequent assessments of inherent risks
Answer: D
Explanation:
Section: INFORMATION RISK MANAGEMENT
NEW QUESTION # 67
An information security manager is developing a business case for an investment in an information security control. The FIRST step should be to:
- A. demonstrate increased productivity of security staff
- B. research vendor pricing to show cost efficiency
- C. gain audit buy-in for the security control
- D. assess potential impact to the organization
Answer: D
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION # 68
If the inherent risk of a business activity is higher than the acceptable risk level, the information security manager should FIRST:
- A. assess the gap between current and acceptable level of risk.
- B. transfer risk to a third party to avoid cost of impact.
- C. implement controls to mitigate the risk to an acceptable level.
- D. recommend that management avoid the business activity
Answer: A
NEW QUESTION # 69
A serious vulnerability is reported in the firewall software used by an organization. Which of the following should be the immediate action of the information security manager?
- A. Ensure that all OS patches are up-to-date
- B. Commission a penetration test
- C. Block inbound traffic until a suitable solution is found
- D. Obtain guidance from the firewall manufacturer
Answer: D
Explanation:
Explanation
The best source of information is the firewall manufacturer since the manufacturer may have a patch to fix the vulnerability or a workaround solution. Ensuring dial all OS patches are up-to-date is a best practice, in general, but will not necessarily address the reported vulnerability. Blocking inbound traffic may not be practical or effective from a business perspective. Commissioning a penetration test will take too much time and will not necessarily provide a solution for corrective actions.
NEW QUESTION # 70
Which of the following will BEST provide an organization with ongoing assurance of the information security services provided by a cloud provider?
- A. Continuous monitoring of an information security risk profile
- B. Requiring periodic self-assessments by the provider
- C. Ensuring the provider's roles and responsibilities are established
- D. Evaluating the provider's security incident response plan
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
NEW QUESTION # 71
Which of the following threats is prevented by using token-based authentication?
- A. Password sniffing attack on the network
- B. Denial of service attack over the network
- C. Session eavesdropping attack on the network
- D. Main-in-the middle attack on the client
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
NEW QUESTION # 72
Which of the following is the PRIMARY objective of incident triage?
- A. Mitigation of vulnerabilities
- B. Categorization of events
- C. Containment of threats
- D. Coordination of communications
Answer: B
Explanation:
Explanation
Incident triage is the process of quickly assessing an incident and determining its severity in order to prioritize the response. This involves categorizing the events based on their potential impact, which helps to determine the right response and the most effective use of resources. It also helps to identify potential threats and vulnerabilities, and to coordinate communications and response activities.
NEW QUESTION # 73
A third party was engaged to develop a business application. Which of the following would an information security manager BEST test for the existence of back doors?
- A. System monitoring for traffic on network ports
- B. Security code reviews for the entire application
- C. Running the application from a high-privileged account on a test system
- D. Reverse engineering the application binaries
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Security' code reviews for the entire application is the best measure and will involve reviewing the entire source code to detect all instances of back doors. System monitoring for traffic on network ports would not be able to detect all instances of back doors and is time consuming and would take a lot of effort. Reverse engineering the application binaries may not provide any definite clues. Back doors will not surface by running the application on high-privileged accounts since back doors are usually hidden accounts in the applications.
NEW QUESTION # 74
Which of the following characteristics is MOST important when looking at prospective candidates for the role of chief information security officer (CISO)?
- A. Knowledge of information technology platforms, networks and development methodologies
- B. Ability to understand and map organizational needs to security technologies
- C. Knowledge of the regulatory environment and project management techniques
- D. Ability to manage a diverse group of individuals and resources across an organization
Answer: B
Explanation:
Section: INFORMATION SECURITY GOVERNANCE
Explanation:
Information security will be properly aligned with the goals of the business only with the ability to understand and map organizational needs to enable security technologies. All of the other choices are important but secondary to meeting business security needs.
NEW QUESTION # 75
What of the following is MOST important to include in an information security policy?
- A. Best practices
- B. Baselines
- C. Maturity levels
- D. Management objectives
Answer: D
NEW QUESTION # 76
Which of the following BEST demonstrates effective information security management within an organization?
- A. Employees support decisions made by information security management.
- B. Information security governance is incorporated into organizational governance.
- C. Control ownership is assigned to parties who can accept losses related to control failure.
- D. Excessive risk exposure in one department can be absorbed by other departments.
Answer: B
NEW QUESTION # 77
Which of the following is MOST important to the effectiveness of an information security program?
- A. Organizational culture
- B. Risk management
- C. IT governance
- D. Security metrics
Answer: B
Explanation:
Explanation
Risk management is the most important factor for the effectiveness of an information security program, as it provides a systematic and consistent approach to identify, assess, treat, and monitor the information security risks that could affect the organization's objectives. Risk management also helps to align the security program with the business strategy, prioritize the security initiatives and resources, and communicate the value of security to the stakeholders.
References = CISM Review Manual 2022, page 3071; CISM Exam Content Outline, Domain 4, Knowledge Statement 4.1
NEW QUESTION # 78
Deciding the level of protection a particular asset should be given is BEST determined by:
- A. a threat assessment.
- B. corporate risk appetite.
- C. a risk analysis.
- D. a vulnerability assessment
Answer: C
NEW QUESTION # 79
Which of the following is the MOST important incident management consideration for an organization subscribing to a cloud service?
- A. Implementation of a SIEM in the organization
- B. An agreement on the definition of a security incident
- C. Decision on the classification of cloud-hosted data
- D. Expertise of personnel providing incident response
Answer: B
NEW QUESTION # 80
Which of the following is the BEST indication of an effective information security awareness training program?
- A. An increase in the frequency of phishing tests
- B. An increase in positive user feedback
- C. An increase in the speed of incident resolution
- D. An increase in the identification rate during phishing simulations
Answer: D
Explanation:
Explanation
An effective information security awareness training program should aim to improve the knowledge, skills and behavior of the employees regarding information security. One of the ways to measure the effectiveness of such a program is to conduct phishing simulations, which are mock phishing attacks that test the employees' ability to identify and report phishing emails. An increase in the identification rate during phishing simulations indicates that the employees have learned how to recognize and avoid phishing attempts, which is one of the common threats to information security. Therefore, this is the best indication of an effective information security awareness training program among the given options.
The other options are not as reliable or relevant as indicators of an effective information security awareness training program. An increase in the frequency of phishing tests does not necessarily mean that the employees are learning from them or that the tests are aligned with the learning objectives of the program. An increase in positive user feedback may reflect the satisfaction or engagement of the employees with the program, but it does not measure the actual learning outcomes or behavior changes. An increase in the speed of incident resolution may be influenced by other factors, such as the availability and efficiency of the incident response team, the severity and complexity of the incidents, or the tools and processes used for incident management.
Moreover, the speed of incident resolution does not reflect the prevention or reduction of incidents, which is a more desirable goal of an information security awareness training program. References = CISM Review Manual, 16th Edition, ISACA, 2022, pp. 201-202, 207-208.
CISM Questions, Answers & Explanations Database, ISACA, 2022, QID 1001.
NEW QUESTION # 81
Which of the following is the BEST reason to perform a business impact analysis (BIA)?
- A. To help determine the current state of risk
- B. To satisfy regulatory requirements
- C. To budget appropriately for needed controls
- D. To analyze the effect on the business
Answer: A
Explanation:
The BIA is included as part of the process to determine the current state of risk and helps determine the acceptable levels of response from impacts and the current level of response, leading to a gap analysis. Budgeting appropriately may come as a result, but is not the reason to perform the analysis. Performing an analysis may satisfy regulatory requirements, bill is not the reason to perform one. Analyzing the effect on the business is part of the process, but one must also determine the needs or acceptable effect or response.
NEW QUESTION # 82
The effectiveness of an information security governance framework will BEST be enhanced if:
- A. a culture of legal and regulatory compliance is promoted by management.
- B. risk management is built into operational and strategic activities.
- C. consultants review the information security governance framework
- D. IS auditors are empowered to evaluate governance activities,
Answer: A
NEW QUESTION # 83
Information security should be:
- A. defined by the board of directors.
- B. a balance between technical and business requirements.
- C. focused on eliminating all risks.
- D. driven by regulatory requirements.
Answer: B
Explanation:
Section: INFORMATION SECURITY GOVERNANCE
Explanation:
Information security should ensure that business objectives are met given available technical capabilities, resource constraints and compliance requirements. It is not practical or feasible to eliminate all risks.
Regulatory requirements must be considered, but are inputs to the business considerations. The board of directors does not define information security, but provides direction in support of the business goals and objectives.
NEW QUESTION # 84
An information security manager has identified and implemented mitigating controls according to industry best practices. Which of the following is the GREATEST risk associated with this approach?
- A. The security program may not be aligned with organizational objectives.
- B. Important security controls may be missed without senior management input.
- C. The mitigation measures may not be updated in a timely manner.
- D. The cost of control implementation may be too high.
Answer: A
NEW QUESTION # 85
......
Focus on CISM All-in-One Exam Guide For Quick Preparation: https://www.realvce.com/CISM_free-dumps.html
CISM All-in-One Exam Guide For Quick Preparation: https://drive.google.com/open?id=1NgjHVrkUp6AmF8fptRbn7Tn7HzGuCrqH