Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following roles is PRIMARILY responsible for developing an information classification framework based on business needs?
Answer: C
For classifying the data I agree that Information Owner is responsible, but for designing the framework? I would say Information Security Manager.
Source: Adapted from community discussion — iacini
Which of the following should an information security manager do FIRST when a legacy application is not compliant with a regulatory requirement, but the business unit does not have the budget for remediation?
Answer: D
An information security manager should assess the consequences of noncompliance against the cost of remediation first when a legacy application is not compliant with a regulatory requirement but the business unit does not have the budget for remediation. This allows the manager to fully understand the potential risks and consequences of noncompliance, and to make an informed decision about the best course of action. By comparing the cost of remediation with the potential consequences of noncompliance, the manager can determine the level of risk that the organization is willing to accept and make a case for funding or alternative measures to address the compliance issue. This information can also be used to prioritize future remediation efforts based on the level of risk and the urgency of the issue. In any case, it is important for the information security manager to keep senior management informed about the noncompliance issue and to work with them to develop a plan to address the issue and ensure compliance with relevant regulations.
Source: Adapted from community discussion — ccKane
If the inherent risk of a business activity is higher than the acceptable risk level, the information security manager should FIRST:
Answer: C
C. assess the gap between the current and acceptable level of risk. Assessing the gap between the current level of risk and the acceptable level of risk is the initial step in understanding the nature and magnitude of the risk exposure. This assessment will help the information security manager make informed decisions about how to proceed. Once the gap has been assessed, the information security manager can then consider various risk management options, such as implementing controls to mitigate the risk to an acceptable level (option D), transferring the risk to a third party (option A), or recommending that management avoid the business activity (option B). However, understanding the gap is essential before determining which risk management strategy is most appropriate for the specific situation.
Source: Adapted from community discussion — oluchecpoint
Which of the following should be done FIRST when developing an information security strategy?
Answer: A
leaning towards A for this one. we won't be able to determine the desired state before establishing the strategy. The steering committee is required is drive the strategy and align towards business strategies.
Source: Adapted from community discussion — yottabyte
A business impact analysis (BIA) should be periodically executed PRIMARILY to:
Answer: D
While responding to a high-profile security incident, an information security manager observed several deficiencies in the current incident response plan. When would be the BEST time to update the plan?
Answer: B
ChatGPT says B, not D. oluch.. has as much a right as any of us to post his responses, both right and wrong. So long as his comments not personal and are sticking to the guidelines......I'll just say thank you, oluch and good luck with your CISM. And no, I am not looking for a fight....just wanted to support all participants who are here to learn.
Source: Adapted from community discussion — CISSPST
Which of the following BEST enables an information security manager to demonstrate the effectiveness of the information security and risk program to senior management?
Answer: D
Which of the following would BEST justify spending for a compensating control?
Answer: D
The best justification for spending on a compensating control would be option D: Risk analysis. Risk analysis involves identifying and assessing potential risks and their potential impact on an organization's assets. By conducting a risk analysis, organizations can determine the most critical risks and prioritize their mitigation efforts. If a risk analysis reveals significant vulnerabilities or threats that cannot be fully mitigated by existing controls, investing in compensating controls becomes necessary to reduce the overall risk to an acceptable level. Root cause analysis (option A) helps in identifying the underlying causes of incidents, while emerging risk trends (option B) and vulnerability assessments (option C) provide valuable insights, but they do not directly justify spending on compensating controls.
Source: Adapted from community discussion — koala_lay
Which or the following is the BEST way to monitor for advanced persistent threats (APT) in an organization?
Answer: C
C: C. Search for anomalies in the environment is generally the better approach. Here’s why: Anomaly Detection: APTs are designed to evade traditional security measures and blend in with regular network activity. By searching for anomalies—unusual patterns or behaviors in network traffic, system usage, or data access—you can identify potential signs of an APT that might not fit established patterns of normal activity. This proactive monitoring helps in detecting sophisticated threats that are specifically crafted to evade standard detection methods.
Source: Adapted from community discussion — Infosecnerd
In response to recent ransomware threats, an organization deployed a new endpoint detection and response (EDR) solution in its employee laptops. Of the following, who should be accountable for reviewing the solution to verify it has been properly deployed and configured?
Answer: C
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 1131. 1243 questions available.
Version 1.0.0. How we source questions