Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following is BEST to include in a business case when the return on investment (ROI) for an information security initiative is difficult to calculate?
Answer: D
Business case is the key word here. Business case should contain risk tagged with the Business so that senior management makes appropriate decisions based on that.
Source: Adapted from community discussion — SSP_Secure
Which of the following is the MOST important consideration to support potential legal action when responding to a security incident?
Answer: C
An incident response team has established that an application has been breached. Which of the following should be done NEXT?
Answer: C
** Checked wrong box for answer in previous post. C. Isolate the impacted systems from the rest of the network. Containment follows detection. https://www.isaca.org/resources/isaca-journal/issues/2022/volume-1/cybersecurity-incident-response-exercise-guidance
Source: Adapted from community discussion — 6and0
A daily monitoring report reveals that an IT employee made a change to a firewall rule outside of the change control process. The information security manager's FIRST step in addressing the issue should be to:
Answer: A
A- You've got to first establish if the change is causing an issue, everything else is secondary. The only thing I wonder is if it's the information manager that would check this.
Source: Adapted from community discussion — AaronS1990
Which of the following BEST facilitates the reporting of useful information about the effectiveness of the information security program?
Answer: C
Which of the following BEST mitigates the risk or information loss caused by a cloud service provider becoming insolvent?
Answer: C
C. Contractual provisions for data repatriation The best option for mitigating the risk of information loss caused by a cloud service provider becoming insolvent is to have contractual provisions for data repatriation. This means that in the event of the cloud service provider's insolvency or other issues, the contract should include provisions that allow you to retrieve your data and applications from the provider's infrastructure and bring them back in-house or transfer them to another service provider.
Source: Adapted from community discussion — oluchecpoint
An information security team has been tasked with identifying confidential data within the organization to formalize its asset classification scheme. The MOST relevant input would be provided by:
Answer: A
Which of the following is the PRIMARY reason to conduct a post-incident review?
Answer: C
Which of the following is the BEST way to protect against unauthorized access to an encrypted file sent via email?
Answer: C
Utilizing a separate distribution channel for the password means sending the password through a different communication method (e.g., a text message, phone call, or a different email) rather than including it in the same email. This ensures that even if the email is intercepted, the password is not readily available to the unauthorized party, adding an extra layer of security.
Source: Adapted from community discussion — oluchecpoint
The PRIMARY purpose of implementing information security governance metrics is to:
Answer: D
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 1121. 1243 questions available.
Version 1.0.0. How we source questions