[2025] CISM PDF Questions - Perfect Prospect To Go With Prep4King Practice Exam
ISACA CISM Pdf Questions - Outstanding Practice To your Exam
NEW QUESTION # 317
What should be the NEXT course of action when an information security manager has identified a department that is repeatedly not following the security policy?
- A. Report the policy violation to senior management.
- B. Require department users to repeat security awareness training.
- C. Perform a vulnerability assessment on the systems within the department.
- D. Introduce additional controls to force compliance with policy.
Answer: A
NEW QUESTION # 318
Which of the following is the GREATEST concern resulting from the lack of severity criteria in incident classification?
- A. Statistical reports will be incorrect.
- B. Escalation procedures will be ineffective.
- C. Timely detection of attacks will be impossible.
- D. The service desk will be staffed incorrectly.
Answer: B
Explanation:
The greatest concern resulting from the lack of severity criteria in incident classification is that escalation procedures will be ineffective because they rely on severity criteria to determine when and how to escalate an incident to higher levels of authority or responsibility, and what actions or resources are required for resolving an incident. Statistical reports will be incorrect is not a great concern because they do not affect the incident response process directly, but rather provide information or analysis for improvement or evaluation purposes.
The service desk will be staffed incorrectly is not a great concern because it does not affect the incident response process directly, but rather affects the availability or efficiency of one of its components. Timely detection of attacks will be impossible is not a great concern because it does not depend on severity criteria, but rather on monitoring and alerting mechanisms. References: https://www.isaca.org/resources/isaca-journal
/issues/2017/volume-5/incident-response-lessons-learned https://www.isaca.org/resources/isaca-journal/issues
/2018/volume-3/incident-response-lessons-learned
NEW QUESTION # 319
Information security governance is PRIMARILY driven by:
- A. litigation potential.
- B. business strategy.
- C. technology constraints.
- D. regulatory requirements.
Answer: B
Explanation:
Explanation/Reference:
Explanation:
Governance is directly tied to the strategy and direction of the business. Technology constraints, regulatory requirements and litigation potential are all important factors, but they are necessarily in line with the business strategy.
NEW QUESTION # 320
Which of the following is MOST important in increasing the effectiveness of incident responders?
- A. Reviewing the incident response plan annually
- B. Integrating staff with the IT department
- C. Communicating with the management team
- D. Testing response scenarios
Answer: D
NEW QUESTION # 321
Which of the following is a PRIMARY
- A. To provide effective incident mitigation
- B. To provide a business impact assessment
- C. To provide a single point of contact for critical incidents
- D. To provide a risk assessment for zero-day vulnerabilities
Answer: A
NEW QUESTION # 322
In a business proposal, a potential vendor promotes being certified for international security standards as a measure of its security capability.
Before relying on this certification, it is MOST important that the information security manager confirms that the:
- A. certification will remain current through the life of the contract.
- B. current international standard was used to assess security processes.
- C. certification scope is relevant to the service being offered.
- D. certification can be extended to cover the client's business.
Answer: C
Explanation:
Before relying on a vendor's certification for international security standards, such as ISO/IEC 27001, it is most important that the information security manager confirms that the certification scope is relevant to the service being offered. The certification scope defines the boundaries and applicability of the information security management system (ISMS) that the vendor has implemented and audited. The scope should cover the processes, activities, assets, and locations that are involved in delivering the service to the client. If the scope is too narrow, too broad, or not aligned with the service, the certification may not provide sufficient assurance of the vendor's security capability and performance.
The current international standard was used to assess security processes (A) is an important factor, but not the most important one. The information security manager should verify that the vendor's certification is based on the latest version of the standard, which reflects the current best practices and requirements for information security. However, the standard itself is generic and adaptable, and does not prescribe specific security controls or solutions. Therefore, the certification does not guarantee that the vendor has implemented the most appropriate or effective security processes for the service being offered.
The certification will remain current through the life of the contract (B) is also an important factor, but not the most important one. The information security manager should ensure that the vendor's certification is valid and up to date, and that the vendor maintains its compliance with the standard throughout the contract period.
However, the certification is not a one-time event, but a continuous process that requires periodic surveillance audits and recertification every three years. Therefore, the certification does not ensure that the vendor's security capability and performance will remain consistent or satisfactory for the duration of the contract.
The certification can be extended to cover the client's business (D) is not a relevant factor, as the certification is specific to the vendor's ISMS and does not apply to the client's business. The information security manager should not rely on the vendor's certification to substitute or supplement the client's own security policies, standards, or controls. The information security manager should conduct a due diligence and risk assessment of the vendor, and establish a clear and comprehensive service level agreement (SLA) that defines the security roles, responsibilities, expectations, and metrics for both parties.
References = CISM Review Manual, 16th Edition, Chapter 3: Information Security Program Development and Management, Section: Information Security Program Management, Subsection: Procurement and Vendor Management, page 142-1431
NEW QUESTION # 323
Requiring all employees and contractors to meet personnel security/suitability requirements commensurate with their position sensitivity level and subject to personnel screening is an example of a security:
- A. baseline.
- B. policy.
- C. guideline
- D. strategy.
Answer: B
Explanation:
Explanation
A security policy is a general statement to define management objectives with respect to security. The security strategy addresses higher level issues. Guidelines are optional actions and operational tasks. A security baseline is a set of minimum requirements that is acceptable to an organization.
NEW QUESTION # 324
To inform a risk treatment decision, which of the following should the information security manager compare with the organization's risk appetite?
- A. Gap analysis results
- B. Level of risk treatment
- C. Configuration parameters
- D. Level of residual risk
Answer: D
Explanation:
Level of residual risk is the amount of risk that remains after applying risk treatment options, such as avoidance, mitigation, transfer, or acceptance. The information security manager should compare the level of residual risk with the organization's risk appetite, which is the amount of risk that the organization is willing to accept in pursuit of its objectives. The comparison will help to determine whether the risk treatment options are sufficient, excessive, or inadequate, and whether further actions are needed to align the risk level with the risk appetite.
Reference =
CISM Review Manual, 16th Edition, ISACA, 2020, p. 49: "Residual risk is the risk that remains after risk treatment." CISM Review Manual, 16th Edition, ISACA, 2020, p. 43: "Risk appetite is the amount of risk, on a broad level, that an entity is willing to accept in pursuit of value." CISM Review Manual, 16th Edition, ISACA, 2020, p. 50: "The information security manager should compare the residual risk with the risk appetite and determine whether the risk treatment options are sufficient, excessive, or inadequate."
NEW QUESTION # 325
Which of the following would be MOST useful when determining the business continuity strategy for a large organization's data center?
- A. Incident root cause analysis
- B. Business impact analysis (BIA)
- C. Stakeholder feedback analysis
- D. Business continuity risk analysis
Answer: B
Explanation:
According to the CISM Review Manual, a business impact analysis (BIA) is the most useful tool when determining the business continuity strategy for a large organization's data center, as it helps to identify and prioritize the critical business processes and resources that depend on the data center, and the impact of their disruption or loss. A BIA also provides the basis for defining the recovery time objectives (RTOs) and recovery point objectives (RPOs) for the data center, which guide the selection of the appropriate business continuity strategy.
References = CISM Review Manual, 27th Edition, Chapter 3, Section 3.5.2, page 1511.
NEW QUESTION # 326
The PRIMARY purpose for continuous monitoring of security controls is to ensure:
- A. system availability.
- B. alignment with compliance requirements.
- C. control gaps are minimized.
- D. effectiveness of controls.
Answer: D
Explanation:
The primary purpose for continuous monitoring of security controls is to ensure that the controls are effective in achieving the desired security objectives and mitigating the identified risks. Continuous monitoring provides ongoing assurance that the planned and implemented security controls are aligned with the organizational risk tolerance and can respond to changes in the threat environment, the system, or the business processes. Continuous monitoring also helps to identify and address any control weaknesses or gaps in a timely manner. (From CISM Review Manual 15th Edition and NIST Special Publication 800-1371) References: CISM Review Manual 15th Edition, page 181, section 4.3.2.4; NIST Special Publication 800-
1371, page 1, section 1.1.
NEW QUESTION # 327
Which of the following would BEST help an information security manager prioritize remediation activities to meet regulatory requirements?
- A. A capability maturity model matrix
- B. Alignment with the IT strategy
- C. Cost of associated controls
- D. Annual toss expectancy (ALE) of noncompliance
Answer: D
NEW QUESTION # 328
When developing an escalation process for an incident response plan, the information security manager should PRIMARILY consider the:
- A. media coverage.
- B. availability of technical resources.
- C. incident response team.
- D. affected stakeholders.
Answer: C
Explanation:
Section: INCIDENT MANAGEMENT AND RESPONSE
NEW QUESTION # 329
Which of the following is the BEST approach to make strategic information security decisions?
- A. Establish regular information security status reporting.
- B. Establish periodic senior management meetings.
- C. Establish an information security steering committee.
- D. Establish business unit security working groups.
Answer: C
Explanation:
= According to the CISM Review Manual (Digital Version), page 9, an information security steering committee is a group of senior managers from different business units and functions who provide guidance and oversight for the information security program. An information security steering committee is the best approach to make strategic information security decisions because it can:
Ensure alignment of information security strategy with business objectives and risk appetite1 Facilitate communication and collaboration among different stakeholders and promote information security awareness and culture2 Provide direction and support for information security initiatives and projects3 Monitor and review the performance and effectiveness of the information security program4 Resolve conflicts and issues related to information security policies and practices5 Establishing regular information security status reporting, business unit security working groups, and periodic senior management meetings are useful activities for information security management, but they are not sufficient to make strategic information security decisions without the involvement and guidance of an information security steering committee. Reference = 1: CISM Review Manual (Digital Version), page 9 2: 1 3: 2 4: 3 5: 4 An Information Security Steering Committee is a group of stakeholders responsible for providing governance and guidance to the organization on all matters related to information security. The committee provides oversight and guidance on security policies, strategies, and technology implementation. It also ensures that the organization is in compliance with relevant laws and regulations. Additionally, it serves as a forum for discussing security-related issues and ensures that security is taken into account when making strategic decisions.
NEW QUESTION # 330
What is an appropriate frequency for updating operating system (OS) patches on production servers?
- A. During scheduled rollouts of new applications
- B. Concurrently with quarterly hardware maintenance
- C. According to a fixed security patch management schedule
- D. Whenever important security patches are released
Answer: D
Explanation:
Patches should be applied whenever important security updates are released. They should not be delayed to coincide with other scheduled rollouts or maintenance. Due to the possibility of creating a system outage, they should not be deployed during critical periods of application activity such as month-end or quarter-end closing.
NEW QUESTION # 331
Which of the following provides the linkage to ensure that procedures are correctly aligned with information security policy requirements?
- A. Guidelines
- B. Standards
- C. Security metrics
- D. IT governance
Answer: B
Explanation:
Standards are the bridge between high-level policy statements and the "how to" detailed formal of procedures. Security metrics and governance would not ensure correct alignment between policies and procedures. Similarly, guidelines are not linkage documents but rather provide suggested guidance on best practices.
NEW QUESTION # 332
Which of the following will have the MOST negative impact to the effectiveness of incident response processes?
- A. High organizational risk tolerance
- B. Manual incident reporting processes
- C. Ambiguous severity criteria
- D. Decentralized incident monitoring
Answer: C
NEW QUESTION # 333
Which of the following is MOST important to include in a report to key stakeholders regarding the effectiveness of an information security program?
- A. Security incident details
- B. Security metrics
- C. Security risk exposure
- D. Security baselines
Answer: B
NEW QUESTION # 334
While classifying information assets an information security manager notices that several production databases do not have owners assigned to them What is the BEST way to address this situation?
- A. Prepare a report of the databases for senior management.
- B. Assign responsibility to the database administrator (DBA).
- C. Review the databases for sensitive content.
- D. Assign the highest classification level to those databases.
Answer: B
Explanation:
Information asset classification is the process of identifying, labeling, and categorizing information assets based on their value, sensitivity, and criticality to the organization. Information asset classification helps to establish appropriate security controls, policies, and procedures for protecting the information assets from unauthorized access, use, disclosure, modification, or destruction. One of the key elements of information asset classification is assigning owners to each information asset. Owners are responsible for managing the information asset throughout its lifecycle, including defining its security requirements, implementing security controls, monitoring its usage and performance, reporting any incidents or breaches, and ensuring compliance with legal and regulatory obligations. Therefore, assigning responsibility to the database administrator (DBA) is the best way to address the situation where several production databases do not have owners assigned to them. Reference = CISM Review Manual 15th Edition1, page 256; Information Asset and Security Classification Procedure2.
NEW QUESTION # 335
The MAIN reason for an information security manager to monitor industry level changes in the business and IT is to:
- A. identify changes in the risk environment.
- B. change business objectives based on potential impact.
- C. update information security policies in accordance with the changes.
- D. evaluate the effect of the changes on the levels of residual risk.
Answer: A
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
NEW QUESTION # 336
Which of the following is the BEST way to obtain support for a new organization-wide information security program?
- A. Benchmark against similar industry organizations
- B. Establish an information security strategy committee.
- C. Publish an information security RACI chart.
- D. Deliver an information security awareness campaign.
Answer: B
Explanation:
= Establishing an information security strategy committee is the best way to obtain support for a new organization-wide information security program because it involves the participation and collaboration of key stakeholders from different business functions and levels who can provide input, guidance, and endorsement for the security program. An information security strategy committee is a governance body that oversees the development, implementation, and maintenance of the security program and aligns it with the organization's strategic objectives, risk appetite, and culture. An information security strategy committee can help to obtain support for the security program by:
Communicating the vision, mission, and goals of the security program to the organization and demonstrating its value and benefits.
Establishing roles and responsibilities for the security program and ensuring accountability and ownership.
Securing adequate resources and budget for the security program and allocating them appropriately.
Resolving conflicts and issues that may arise during the security program execution and ensuring alignment with other business processes and initiatives.
Monitoring and evaluating the performance and effectiveness of the security program and ensuring continuous improvement and adaptation.
Benchmarking against similar industry organizations is a useful technique to compare and improve the security program, but it is not the best way to obtain support for a new organization-wide information security program. Benchmarking involves measuring and analyzing the security program's processes, practices, and outcomes against those of other organizations that have similar characteristics, objectives, or challenges. Benchmarking can help to identify gaps, strengths, weaknesses, opportunities, and threats in the security program and to adopt best practices and standards that can enhance the security program's performance and maturity. However, benchmarking alone does not guarantee the support or acceptance of the security program by the organization, as it may not reflect the organization's specific needs, risks, or culture.
Delivering an information security awareness campaign is a vital component of the security program, but it is not the best way to obtain support for a new organization-wide information security program. An information security awareness campaign is a set of activities and initiatives that aim to educate and inform the organization's workforce and other relevant parties about the security program's policies, standards, procedures, and guidelines, as well as the security risks, threats, and incidents that may affect the organization. An information security awareness campaign can help to increase the security knowledge, skills, and behaviors of the organization's members and to foster a security risk-aware culture. However, an information security awareness campaign is not sufficient to obtain support for the security program, as it may not address the strategic, operational, or financial aspects of the security program or the expectations and interests of the different stakeholders.
Publishing an information security RACI chart is a helpful tool to define and communicate the security program's roles and responsibilities, but it is not the best way to obtain support for a new organization-wide information security program. A RACI chart is a matrix that assigns the level of involvement and accountability for each task or activity in the security program to each role or stakeholder. RACI stands for Responsible, Accountable, Consulted, and Informed, which are the four possible levels of participation. A RACI chart can help to clarify the expectations, obligations, and authority of each role or stakeholder in the security program and to avoid duplication, confusion, or conflict. However, a RACI chart does not ensure the support or commitment of the roles or stakeholders for the security program, as it may not address the benefits, challenges, or resources of the security program or the feedback and input of the roles or stakeholders. Reference = CISM Review Manual 15th Edition, pages 97-98, 103-104, 107-108, 111-112 Information Security Governance: Guidance for Boards of Directors and Executive Management, 2nd Edition - ISACA1 Information Security Strategy: The Key to Success - ISACA2 Deliver an information security awareness campaign is the BEST approach to obtain support for a new organization-wide information security program. An information security awareness campaign is a great way to raise awareness of the importance of information security and the impact it can have on an organization. It helps to ensure that all stakeholders understand the importance of information security and are aware of the risks associated with it. Additionally, an effective awareness campaign can help to ensure that everyone in the organization is aware of the cybersecurity policies, procedures, and best practices that must be followed.
NEW QUESTION # 337
An organization has decided to conduct a postmortem analysis after experiencing a loss from an information security attack. The PRIMARY purpose of this analysis should be to:
- A. document lessons learned.
- B. evaluate the impact.
- C. update information security policies,
- D. prepare for criminal prosecution.
Answer: A
NEW QUESTION # 338
Which of the following BEST facilitates effective strategic alignment of security initiatives?
- A. Procedures and standards are approved by department heads.
- B. Organizational units contribute to and agree on priorities
- C. Periodic security audits are conducted by a third-party.
- D. The business strategy is periodically updated
Answer: B
Explanation:
Explanation
Organizational units contribute to and agree on priorities is the best way to facilitate effective strategic alignment of security initiatives because it ensures that the security initiatives are aligned with the business goals and objectives, supported by relevant stakeholders, and prioritized based on risk and value. The business strategy is periodically updated is not sufficient to facilitate effective strategic alignment of security initiatives because it does not involve collaboration or communication between different organizational units. Procedures and standards are approved by department heads is not sufficient to facilitate effective strategic alignment of security initiatives because it does not reflect the strategic direction or vision of the organization. Periodic security audits are conducted by a third-party is not sufficient to facilitate effective strategic alignment of security initiatives because it does not address the planning or implementation of security initiatives.
References:
https://www.isaca.org/resources/isaca-journal/issues/2016/volume-2/how-to-align-security-initiatives-with-busin
https://www.isaca.org/resources/isaca-journal/issues/2015/volume-1/how-to-measure-the-effectiveness-of-inform
NEW QUESTION # 339
Which of the following is the PRIMARY reason to perform regular reviews of the cybersecurity threat landscape?
- A. To train information security professionals to mitigate new threats
- B. To communicate worst-case scenarios to senior management
- C. To compare emerging trends with the existing organizational security posture
- D. To determine opportunities for expanding organizational information security
Answer: C
NEW QUESTION # 340
......
Online Questions - Outstanding Practice To your CISM Exam: https://www.prep4king.com/CISM-exam-prep-material.html
Practice To CISM - Prep4King Remarkable Practice On your Certified Information Security Manager Exam: https://drive.google.com/open?id=1BQ4BFgfeFb6-XHR58x7vPqdwz3n_06sa
