Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following is MOST important to ensure when an organization is moving portions of its sensitive database to the cloud?
Answer: C
I beg to differ, must be C. Only a data owner could tell which classification is the information and if needs encryption
Source: Adapted from community discussion — Sborrainculo
Which of the following is the BEST way to determine the gap between the present and desired state of an information security program?
Answer: D
The PRIMARY goal of information security governance is to:
Answer: C
C. align with business objectives. The primary goal of information security governance is to align with business objectives. Information security governance is the process of establishing and maintaining a framework that ensures an organization's information security practices and measures are aligned with its overall business goals and objectives. While reducing risk to an acceptable level is an important aspect of information security governance, the ultimate aim is to ensure that security measures support and enhance the organization's broader business objectives. Alignment with business processes and the establishment of a security strategy are also important components of information security governance, but they serve the overarching goal of aligning with business objectives.
Source: Adapted from community discussion — oluchecpoint
An information security manager of an e-commerce business is reviewing the results of a business continuity plan (BCP) review. Which of the following findings should be the MOST immediate concern?
Answer: D
The most immediate concern for an information security manager of an e-commerce business reviewing the results of a business continuity plan (BCP) review should be if the recovery time objective (RTO) was not met during a recent power outage. The recovery time objective (RTO) is the amount of time within which a critical business function must be restored following a disruption. If the RTO was not met, it means that the business continuity plan did not effectively enable the organization to recover critical systems and processes in a timely manner. This could have serious consequences for the organization, such as loss of revenue, reputation damage, or regulatory fines. The other findings may also be important, but they would not have the immediate impact on the organization's ability to continue operating as a missed RTO does.
Source: Adapted from community discussion — Broesweelies
If an organization does not have an information security governance framework in place, which of the following would BEST facilitate the adoption of a future governance program?
Answer: D
Which of the following would provide the GREATEST assurance to management that information security incidents will be detected and contained in a timely manner without jeopardizing the organization’s mission?
Answer: D
It's great to have a fully functioning SIEM but if there's no one to monitor and manage it then is it the greatest assurance? My vote is for the SOC.
Source: Adapted from community discussion — Dravidian
Which of the following should be done FIRST when selecting performance metrics to report on the vendor risk management process?
Answer: C
Identifying the intended audience is crucial because different stakeholders may have different interests and priorities when it comes to vendor risk management. Understanding who will receive the metrics helps in tailoring the metrics to meet the specific needs and expectations of the audience. This ensures that the reported metrics are relevant, meaningful, and useful for the intended recipients. While other factors, such as selecting the data source (option A), reviewing confidentiality requirements (option B), and identifying the data owner (option D), are important considerations, determining the intended audience should be the initial step to guide the selection of appropriate performance metrics.
Source: Adapted from community discussion — Viperhunter
Which of the following would BEST provide stakeholders with information to determine the appropriate response to a disaster?
Answer: C
A business impact analysis (BIA) is used to identify an organization’s business processes, the interdependencies between processes, the resources required for process operation, and the impact on the organization if any business process is incapacitated for a time. A BIA is a cornerstone of a business continuity and disaster recovery Gregory, Peter H.; Gregory, Peter H.. CISM Certified Information Security Manager Bundle (p. 124). McGraw Hill LLC. Kindle Edition.
Source: Adapted from community discussion — CarlPTY07
Which of the following provides the BEST guidance when establishing a security program?
Answer: D
D. Information security framework provides the best guidance when establishing a security program. An information security framework sets out the foundational structure and guidelines for implementing an effective security program. It helps organizations in identifying and addressing potential risks, establishing security controls, and ensuring compliance with industry standards and regulations.
Source: Adapted from community discussion — koala_lay
Which of the following should be of MOST concern to an information security manager reviewing the organization’s disaster recovery plan (DRP)?
Answer: D
This question concerns the documentation of the DRP. Therefore, it is very important that DRP documentation is up-to-date, and that is the most important concern. On the other hand, organization-wide DR training, while important, is a lower priority than updating documentation, and without proper documentation, the training itself will not be effective. Therefore, D should be given higher priority.
Source: Adapted from community discussion — Tsubasa1234
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 771. 1243 questions available.
Version 1.0.0. How we source questions