Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
An information security risk analysis BEST assists an organization in ensuring that:
Answer: B
CISM - AIO 2nd - The risk analyst studies different event scenarios and determines the impact of each. This may be expressed in quantitative terms (dollars or other currency) or qualitative terms (high/medium/low or a numeric scale of 1 to 5 or of 1 to 10). Sounds like B to me
Source: Adapted from community discussion — MSKid
Which of the following is the MOST effective way to address an organization's security concerns during contract negotiations with a third party?
Answer: C
Ensuring security is involved in the procurement process is the most effective way to address an organization's security concerns during contract negotiations with a third party. Involving security personnel in the procurement process allows the organization to identify and address potential security risks early on, before a contract is signed. This helps ensure that security requirements are included in the contract and that the third-party vendor is aware of and committed to meeting the organization's security standards. By having security involved in the procurement process, the organization can also ensure that the third-party vendor has adequate security controls in place to protect sensitive information and critical assets. This can include reviewing the vendor's security policies, conducting security assessments, and verifying that the vendor is in compliance with relevant laws and regulations.
Source: Adapted from community discussion — ccKane
Which of the following would BEST enable effective decision-making?
Answer: C
A consistent process to analyze new and historical information risk is also an important factor in enabling effective decision-making. It provides a structured approach for evaluating risk and ensures that all relevant information is taken into account when making decisions. However, without the formalized acceptance of risk analysis by business management, the risk analysis process may not be integrated into the decision-making process of the organization and may not have the necessary influence on decision-making. Therefore D: Formalized acceptance of risk analysis by business management would BEST enable effective decision-making because it ensures that the risk analysis process is integrated into the decision-making process of the organization and that risk is taken into account when making decisions. This helps to ensure that decisions are made with a full understanding of the potential risks and consequences, leading to better and more informed decision-making.
Source: Adapted from community discussion — ccKane
Which of the following is the BEST option to lower the cost to implement application security controls?
Answer: D
Which of the following is the GREATEST benefit of effective information security governance?
Answer: A
The correct answer is A. Choosing D would be a big and fat incorrect answer as implies the opposite. Information strategy should be aligned to business not the other way around.
Source: Adapted from community discussion — acf4e9a
The ability to integrate information security governance into corporate governance is PRIMARILY driven by:
Answer: D
Which of the following presents the GREATEST challenge for protecting Internet of Things (IoT) devices?
Answer: B
Which of the following parameters is MOST helpful when designing a disaster recovery strategy?
Answer: A
When designing a disaster recovery strategy, the parameter that is most helpful is the Maximum Tolerable Downtime (MTD), option A. MTD refers to the maximum amount of time a system or service can be offline or unavailable before it starts negatively impacting the organization's operations or causing significant financial loss. By determining the MTD, organizations can prioritize their recovery efforts and allocate resources accordingly to minimize downtime and ensure business continuity. The other parameters mentioned, such as Mean Time Between Failures (MTBF), Allowable Interruption Window (AIW), and Recovery Point Objective (RPO), are also important considerations but may not be as directly related to designing the overall disaster recovery strategy.
Source: Adapted from community discussion — koala_lay
An IT service desk was not adequately prepared for a recent ransomware attack on user workstations. Which of the following should be given HIGHEST priority by the information security team when creating an action plan to improve service desk readiness?
Answer: C
Option C: Updating the information security incident response manual when creating an action plan to improve service desk readiness. While all the options mentioned are important, updating the information security incident response manual is crucial in this scenario. The manual serves as a guide for the service desk team on how to respond effectively in the event of a security incident such as a ransomware attack. By updating the manual, the team can ensure that they have the most up-to-date and relevant procedures, techniques, and best practices to follow during such incidents.
Source: Adapted from community discussion — koala_lay
After a risk has been identified, analyzed, and evaluated, which of the following should be done NEXT?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 1. 1243 questions available.
Version 1.0.0. How we source questions