Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
An organization's information security manager reads on social media that a recently purchased vendor product has been compromised and customer data has been posted online. What should the information security manager do FIRST?
Answer: B
I beg to differ. You cannot just respond to an incident whose information you just read online. Verify first, then respond accordingly.
Source: Adapted from community discussion — cosmo4ng
Which of the following analyses will BEST identify the external influences to an organization's information security?
Answer: A
Which of the following would provide the MOST value to senior management when presenting the results of a risk assessment?
Answer: B
Which of the following is the MOST effective approach to ensure IT processes are performed in compliance with the information security policies?
Answer: A
The correct answer is A. Ensuring that key controls are embedded in the processes. Explanation: The most effective approach to ensure IT processes are performed in compliance with information security policies is to ensure that key controls are embedded in the processes. Here's why this option is the most effective: A. Ensuring that key controls are embedded in the processes: Embedding key controls directly into the IT processes ensures that security measures are integrated into the workflows. These controls align the processes with information security policies and guidelines, making adherence to security requirements a natural part of performing the processes.
Source: Adapted from community discussion — Hugo1717
The chief information security officer (CISO) has developed an information security strategy, but is struggling to obtain senior management commitment for funds to implement the strategy. Which of the following is the MOST likely reason?
Answer: B
According to the CISM Review Manual, 15th Edition, Page 437, Paragraph 3, the MOST likely reason for the struggle of the chief information security officer (CISO) to obtain senior management commitment for funds to implement the information security strategy is There was a lack of engagement with the business during development.
Source: Adapted from community discussion — shervin2s
An organization's human resources (HR) department is planning to migrate a legacy application to a new application in the cloud. What is the BEST way for the information security manager to support this effort?
Answer: D
What is the PRIMARY goal of an incident management program?
Answer: C
Which of the following backup methods requires the MOST time to restore data for an application?
Answer: C
The key word here is RESTORE. Time to restore a backup is different from time to create a backup. Creating a full backup takes longer than creating an incremental backup. However, restoring a full backup is quicker than restoring incremental backups Here's a breakdown: Full Backup: A full backup captures all data at a specific point in time. When restoring data from a full backup, you only need to restore that single backup. While creating a full backup may take more time and storage space, the restore process is usually faster because you're working with a complete dataset. Incremental Backup: An incremental backup only captures data that has changed since the last backup (which could be a full or a previous incremental backup). When restoring data from incremental backups, you need to restore the last full backup and then apply each incremental backup in the order they were created. The restore process can be time-consuming, especially if there are many incremental backups in the chain. I too was initially confused and i selected Full backup instead of Incremental backup.
Source: Adapted from community discussion — Soleandheel
The PRIMARY advantage of performing black-box control tests as opposed to white-box control tests is that they:
Answer: C
The PRIMARY advantage of performing black-box control tests as opposed to white-box control tests is that they simulate real-world attacks. Black-box testing is conducted with no prior knowledge of the system under test, simulating the perspective of an external attacker. This approach provides a realistic assessment of an organization's security posture and identifies vulnerabilities that might not be uncovered through other testing methods. In contrast, white-box testing is performed with full knowledge of the system's architecture, design, and source code, making it less realistic and less able to detect external threats.
Source: Adapted from community discussion — Abhey
Which of the following is the GREATEST inherent risk when performing a disaster recovery plan (DRP) test?
Answer: D
D. Disruption to the production environment. The greatest inherent risk when performing a disaster recovery plan test is the potential disruption to the production environment. If the DRP test is not well-planned and executed, it can result in unintended consequences such as data loss, system outages, or other disruptions to critical business processes. This can have a significant impact on the organization and its customers, potentially leading to lost revenue, damaged reputation, and other negative outcomes. For this reason, it is important to minimize the risk of disruption during DRP testing by thoroughly planning and testing the procedures in a controlled environment, and ensuring that all stakeholders are aware of the test and its potential impact.
Source: Adapted from community discussion — Broesweelies
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 521. 1243 questions available.
Version 1.0.0. How we source questions