Question 881 · 1243 in bank
Which of the following BEST supports information security management in the event of organizational changes in security personnel?
Show answer
Answer: A
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following BEST supports information security management in the event of organizational changes in security personnel?
Answer: A
Which of the following is the BEST tool to monitor the effectiveness of information security governance?
Answer: A
The Balanced Scorecard is a well-known framework that is used to measure the performance and effectiveness of an organization. The Balanced Scorecard framework is used to determine how well an organization can fulfill its mission and strategic objectives and how well it is aligned with overall organizational objectives. Gregory, Peter H.; Gregory, Peter H.. CISM Certified Information Security Manager Bundle (p. 931). McGraw Hill LLC. Kindle Edition.
Source: Adapted from community discussion — CarlPTY07
Management decisions concerning information security investments will be MOST effective when they are based on:
Answer: C
An organization is going through a digital transformation process, which places the IT organization in an unfamiliar risk landscape. The information security manager has been tasked with leading the IT risk management process. Which of the following should be given the HIGHEST priority?
Answer: A
Which of the following change management procedures is MOST likely to cause concern to the information security manager?
Answer: C
In an effective change management process, there should be a clear separation of duties and responsibilities between development and production environments. Allowing the development manager to directly migrate programs into production can bypass necessary security controls, increase the risk of unauthorized changes, and potentially compromise the integrity and availability of the production environment. Hence Option C
Source: Adapted from community discussion — Saisharan
Which is the BEST method to evaluate the effectiveness of an alternate processing site when continuous uptime is required?
Answer: C
OMG, what a badly written question... Is by "when continuous uptime is required" meant that continuous uptime is required during the test (which would make C - parallel test the most appropriate answer) or is continuous uptime required to be achieved/tested (in which case the correct answer here would be A - full interruption test). Since I'm thinking it's the former, I vote C here.
Source: Adapted from community discussion — AlexJacobson
Which of the following should be the MOST important consideration when establishing information security policies for an organization?
Answer: B
When establishing metrics for an information security program, the BEST approach is to identify indicators that:
Answer: D
D. demonstrate the effectiveness of the security program. When establishing metrics for an information security program, the BEST approach is to identify indicators that demonstrate the effectiveness of the security program. These metrics should measure the performance of the security controls in place, such as incident response time, vulnerability management, compliance with standards and regulations, and the overall effectiveness of the security program. By using these metrics, the organization can see how well the security program is working and make necessary adjustments.
Source: Adapted from community discussion — Broesweelies
If civil litigation is a goal for an organizational response to a security incident, the PRIMARY step should be to:
Answer: B
Documenting the chain of custody is crucial because it establishes the chronological history of who had possession of the evidence, when they had it, and how it was stored or handled. This documentation is essential for maintaining the integrity and admissibility of evidence in court. It helps ensure that the evidence collected during the incident response process can be used effectively in any civil litigation that may arise from the incident.
Source: Adapted from community discussion — oluchecpoint
An organization's marketing department wants to use an online collaboration service, which is not in compliance with the information security policy. A risk assessment is performed, and risk acceptance is being pursued. Approval of risk acceptance should be provided by:
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 881. 1243 questions available.
Version 1.0.0. How we source questions