Question 271 · 1243 in bank
When performing a business impact analysis (BIA), which of the following is the MOST important reason to determine the maximum tolerable downtime (MTD)?
Show answer
Answer: B
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
When performing a business impact analysis (BIA), which of the following is the MOST important reason to determine the maximum tolerable downtime (MTD)?
Answer: B
Which of the following processes should remain internal when outsourcing IT operations?
Answer: A
An organization plans to adopt a DevOps approach for innovative application development. Which of the following should be the information security manager's MOST important consideration with regard to the information security strategy?
Answer: A
Which of the following is the MOST important reason to integrate nonrepudiation into the design of user authentication?
Answer: D
A significant risk was identified within a core business function. Budget constraints do not allow for effective remediation. Who should be accountable for selecting the appropriate risk treatment?
Answer: D
Which of the following is the GREATEST benefit of integrating information security program requirements into vendor management?
Answer: C
The correct answer is C- Reducing risk in the supply chain. If you look at the CISM material it is all about risk and this is the answer that has anything to do with risk. Rationale: (A) meeting an industry compliance is great, but compliance for compliance sake is not the goal (B) SLA are target objectives which is great for vendor management, but it's not the most relevant to security (C) Reducing Risk is the greatest benefit and most relevant to security (D) vendor performance is great, but if we wanted it to be measurable we would have gone with (B) setting an SLA.
Source: Adapted from community discussion — dark_3k03r
An information security manager is building a business case to support an investment in a next generation firewall. Which of the following would BEST maximize the effectiveness of the business case?
Answer: B
Who should determine data access requirements for an application hosted at an organization's data center?
Answer: B
Which of the following is the MOST important objective of testing a security incident response plan?
Answer: B
"Exercises and tests should be conducted to determine whether the disaster recovery plan will function as expected... Exercises should test the validity of the plan and the assumptions on which it is based, validate recovery strategies, and ensure the plan reflects the current business impact analysis (BIA) and risk assessment data." - CISM Review Manual, 15th Edition, 2019, page 181.
Source: Adapted from community discussion — [Removed]
Which of the following is the MOST important reason for performing a cost-benefit analysis when implementing a security control?
Answer: A
Performing a cost-benefit analysis when implementing a security control is crucial to ensure that the cost of the mitigation effort does not exceed the value of the asset being protected. This approach ensures that the resources spent on security controls are justified by the value of the asset and the potential risk reduction. It helps organizations allocate their security budget more effectively and avoid overspending on controls that do not provide sufficient benefits relative to their costs.
Source: Adapted from community discussion — HN2025
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 271. 1243 questions available.
Version 1.0.0. How we source questions