Question 961 · 1243 in bank
Which of the following is the MOST important reason to implement information security governance?
Show answer
Answer: A
Certified Information Security Manager1,243 questions across 125 pages are complete and free, with no account or card.
1243 questions in this bank
Free access · progress saved on this device
Which of the following is the MOST important reason to implement information security governance?
Answer: A
Which of the following is a PRIMARY objective of an information security governance framework?
Answer: A
ISACA defines this domain as follows: “Establish and/or maintain an information security governance framework and supporting processes to ensure that the information security strategy is aligned with organizational goals and objectives.” Gregory, Peter H.; Gregory, Peter H.. CISM Certified Information Security Manager Bundle (p. 49). McGraw Hill LLC. Kindle Edition.
Source: Adapted from community discussion — CarlPTY07
Which of the following is the BEST way to reduce the risk associated with a bring your own device (BYOD) program?
Answer: C
The best way to reduce the risk associated with a bring your own device (BYOD) program is to implement a mobile device management (MDM) solution. Therefore, the correct answer is option C.
Source: Adapted from community discussion — Souvik124
An information security manager has contracted with a company to design security architecture for an application. Which of the following is accountable for identification associated with this initiative?
Answer: B
Which of the following desired outcomes BEST supports a decision to invest in a new security initiative?
Answer: B
When developing a tabletop test plan for incident response testing, the PRIMARY purpose of the scenario should be to:
Answer: B
The PRIMARY purpose of the scenario in a tabletop test plan for incident response testing is B. provide participants with situations to ensure understanding of their roles. Tabletop exercises are a valuable tool for testing an organization's incident response plan and ensuring that team members understand their roles and responsibilities. By walking through hypothetical incident scenarios, participants can practice their communication, coordination, and decision-making skills under simulated pressure.
Source: Adapted from community discussion — Cyberbug2021
Which of the following is an information security manager’s MOST important consideration when exploring the use of a third-party provider to handle an IT function?
Answer: C
The correct answer is C. The provider’s security processes align with the organization’s. The most important consideration for an information security manager when exploring the use of a third-party provider to handle an IT function is ensuring that the provider's security processes align with the organization's. This means that the provider's security policies, procedures, and controls are consistent with the organization's security objectives, standards, and requirements. This alignment helps to ensure that sensitive information is protected in a manner that is consistent with the organization's security posture and that security risks are minimized.
Source: Adapted from community discussion — Broesweelies
Which of the following MUST be defined in order for an information security manager to evaluate the appropriateness of controls currently in place?
Answer: D
Team, you need the risk apetite even before the selection of the risk framework. Applying a risk management framework in an organization requires a keen understanding of the organization’s mission, objectives, strategies, cultures, practices, structure, financial condition, risk appetite, and level of executive management support. Gregory, Peter H.; Gregory, Peter H.. CISM Certified Information Security Manager Bundle (pp. 172-173). McGraw Hill LLC. Kindle Edition. ISACA defines risk appetite as the level of risk that an organization is willing to accept while in pursuit of its mission, strategy, and objectives, and before action is needed to treat the risk. Gregory, Peter H.; Gregory, Peter H.. CISM Certified Information Security Manager Bundle (pp. 57-58). McGraw Hill LLC. Kindle Edition.
Source: Adapted from community discussion — CarlPTY07
When an organization decides to accept a risk, it should mean the cost to mitigate:
Answer: D
Which of the following is the MOST important reason to conduct interviews as part of the business impact analysis (BIA) process?
Answer: B
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CISM practice, question 961. 1243 questions available.
Version 1.0.0. How we source questions