CISM Practice Exams and Training Solutions for Certifications
Dumps Free Test Engine Player Verified Answers
NEW QUESTION # 400
An information security manager learns of a new standard related to an emerging technology the organization wants to implement. Which of the following should the information security manager recommend be done FIRST?
- A. Perform a risk assessment on the new technology.
- B. Review industry specialists' analyses of the new standard.
- C. Obtain legal counsel's opinion on the standard's applicability to regulations,
- D. Determine whether the organization can benefit from adopting the new standard.
Answer: D
Explanation:
Explanation
= The first step that the information security manager should recommend when learning of a new standard related to an emerging technology is to determine whether the organization can benefit from adopting the new standard. This involves evaluating the business objectives, needs, and requirements of the organization, as well as the potential advantages, disadvantages, and challenges of implementing the new technology and the new standard. The information security manager should also consider the alignment of the new standard with the organization's existing policies, procedures, and standards, as well as the impact of the new standard on the organization's information security governance, risk management, program, and incident management. By conducting a preliminary analysis of the feasibility, suitability, and desirability of the new standard, the information security manager can provide a sound basis for further decision making and planning.
References = CISM Review Manual, 16th Edition, Chapter 1: Information Security Governance, Section:
Information Security Standards, page 391; CISM Review Questions, Answers & Explanations Manual, 10th Edition, Question 43, page 412.
NEW QUESTION # 401
In business critical applications, where shared access to elevated privileges by a small group is necessary, the BEST approach to implement adequate segregation of duties is to:
- A. create service accounts that can only be used by authorized team members.
- B. enforce manual procedures ensuring separation of conflicting duties.
- C. implement role-based access control in the application.
- D. ensure access to individual functions can be granted to individual users only.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Role-based access control is the best way to implement appropriate segregation of duties. Roles will have to be defined once and then the user could be changed from one role to another without redefining the content of the role each time. Access to individual functions will not ensure appropriate segregation of duties. Giving a user access to all functions and implementing, in parallel, a manual procedure ensuring segregation of duties is not an effective method, and would be difficult to enforce and monitor. Creating service accounts that can be used by authorized team members would not provide any help unless their roles are properly segregated.
NEW QUESTION # 402
Which of the following is MOST important to include in monthly information security reports to the board?
- A. Risk assessment results
- B. Threat intelligence
- C. Root cause analysis of security incidents
- D. Trend analysis of security metrics
Answer: D
Explanation:
Explanation
The most important information to include in monthly information security reports to the board is the trend analysis of security metrics. Security metrics are quantitative and qualitative measures that indicate the performance and effectiveness of the information security program and the alignment with the business objectives. Trend analysis is the process of comparing and evaluating the changes and patterns of security metrics over time. Trend analysis can help to identify the strengths and weaknesses of the information security program, the progress and achievements of the security goals and initiatives, the gaps and opportunities for improvement, and the impact and value of the information security investments. Trend analysis can also help to communicate the current and future security risks and challenges, and the recommended actions and strategies to address them. Trend analysis can provide the board with a clear and concise overview of the information security status and direction, and enable informed and timely decision making.
References =
CISM Review Manual 15th Edition, page 1631
The CISO's Guide to Reporting Cybersecurity to the Board2
CISM 2020: Information Security Metrics and Reporting, video 13
NEW QUESTION # 403
Which of the following is the PRIMARY goal of business continuity management?
- A. Implement controls to prevent disaster.
- B. Increase survivability of the organization.
- C. Establish incident response procedures.
- D. Assess the impact to business processes.
Answer: B
NEW QUESTION # 404
A business unit manager wants to adopt an emerging technology that may affect the organization. Which of the following would be the information security manager's BEST course of action?
- A. Perform a threat analysis.
- B. Perform a business impact analysis (BIA).
- C. Review the business case.
- D. Review vendor documentation.
Answer: C
NEW QUESTION # 405
Measuring which of the following is the MOST accurate way to determine the alignment of an information security strategy with organizational goals?
- A. Trends in the number of identified threats to the business
- B. Number of blocked intrusion attempts
- C. Number of business cases reviewed by senior management
- D. Percentage of controls integrated into business processes
Answer: D
Explanation:
Measuring the percentage of controls integrated into business processes is the most accurate way to determine the alignment of an information security strategy with organizational goals, as this reflects the extent to which the information security program supports and enables the business objectives and activities, and reduces the friction and resistance from the business stakeholders. The percentage of controls integrated into business processes also indicates the maturity and effectiveness of the information security program, and the level of awareness and acceptance of the information security policies and standards among the business users. Number of blocked intrusion attempts, number of business cases reviewed by senior management, and trends in the number of identified threats to the business are not the most accurate ways to determine the alignment of an information security strategy with organizational goals, as they do not measure the impact and value of the information security program on the business performance and outcomes, and may not reflect the business priorities and expectations. References = CISM Review Manual 2023, page 291; CISM Review Questions, Answers & Explanations Manual 2023, page 372; ISACA CISM - iSecPrep, page 223; CISM Exam Overview - Vinsys4
NEW QUESTION # 406
Which of the following would present the GREATEST risk to information security?
- A. Critical patches are applied within 24 hours of their release
- B. Security access logs are reviewed within five business days
- C. Security incidents are investigated within five business days
- D. Virus signature files updates are applied to all servers every day
Answer: C
Explanation:
Explanation
Security incidents are configured to capture system events that are important from the security perspective; they include incidents also captured in the security access logs and other monitoring tools. Although, in some instances, they could wait for a few days before they are researched, from the options given this would have the greatest risk to security. Most often, they should be analyzed as soon as possible. Virus signatures should be updated as often as they become available by the vendor, while critical patches should be installed as soon as they are reviewed and tested, which could occur in 24 hours.
NEW QUESTION # 407
A risk profile supports effective security decisions PRIMARILY because it:
- A. describes security threats.
- B. defines how to best mitigate future risks.
- C. enables comparison with industry best practices.
- D. identifies priorities for risk reduction.
Answer: D
Explanation:
Section: INFORMATION RISK MANAGEMENT
Explanation/Reference:
NEW QUESTION # 408
The department head of application development has decided to accept the risks identified in a recent assessment. No recommendations will be implemented, even though the recommendations are required by regulatory oversight. What should the information security manager do NEXT?
- A. Perform a risk reassessment.
- B. Review the risk monitoring plan.
- C. Formally document the decision.
- D. Implement the recommendations.
Answer: C
NEW QUESTION # 409
Which of the following is an information security manager's FIRST priority after a high-profile system has been compromised?
- A. Implement improvements to prevent recurrence.
- B. Preserve incident-related data.
- C. Identify the malware that compromised the system.
- D. Restore the compromised system.
Answer: D
NEW QUESTION # 410
An organization is planning to open a new office in another country. Sensitive data will be routinely sent between the two offices. What should be the information security manager s FIRST course of action?
- A. Identify applicable regulatory requirements to establish security policies
- B. Encrypt the data for transfer to the head office based on security manager approval
- C. Update privacy policies to include the other country's laws and regulations.
- D. Apply the current corporate security policies to the new office.
Answer: C
NEW QUESTION # 411
The advantage of Virtual Private Network (VPN) tunneling for remote users is that it:
- A. increases security between multi-tier systems.
- B. eliminates the need for secondary authentication.
- C. allows passwords to be changed less frequently.
- D. helps ensure that communications are secure.
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Virtual Private Network (VPN) tunneling for remote users provides an encrypted link that helps ensure secure communications. It does not affect password change frequency, nor does it eliminate the need for secondary authentication or affect security within the internal network.
NEW QUESTION # 412
Risk identification, analysis, and mitigation activities can BEST be integrated into business life cycle processes by linking them to:
- A. continuity planning
- B. configuration management
- C. change management
- D. compliance testing
Answer: B
NEW QUESTION # 413
Which of the following BEST minimizes information security risk in deploying applications to the production environment?
- A. Verifying security during the testing process
- B. Having a well-defined change process
- C. Integrating security controls in each phase of the life cycle
- D. Conducting penetration testing post implementation
Answer: C
Explanation:
= Integrating security controls in each phase of the life cycle is the best way to minimize information security risk in deploying applications to the production environment. This ensures that security requirements are defined, designed, implemented, tested, and maintained throughout the development process. Conducting penetration testing post implementation, having a well-defined change process, and verifying security during the testing process are all important activities, but they are not sufficient to address all the potential risks that may arise during the application life cycle. Penetration testing may reveal some vulnerabilities, but it cannot guarantee that all of them are identified and fixed. A change process may help to control and document the modifications made to the application, but it does not ensure that the changes are secure and do not introduce new risks. Verifying security during the testing process may help to validate the functionality and performance of the security controls, but it does not ensure that the security requirements are complete and consistent with the business objectives and the risk appetite of the organization. References = CISM Review Manual, 16th Edition, page 1121; CISM Review Questions, Answers & Explanations Manual, 10th Edition, page 1462
NEW QUESTION # 414
Following a recent acquisition, an information security manager has been requested to address the outstanding risk reported early in the acquisition process. Which of the following is the manager s BEST course of action?
- A. Re-assess the outstanding risk of the acquired company.
- B. Add the outstanding risk to the acquiring organization's risk registry
- C. Re-evaluate the risk treatment plan for the outstanding risk.
- D. Perform a vulnerability assessment of the acquired company s infrastructure.
Answer: A
NEW QUESTION # 415
Which of the following is MOST important to consider when developing a business continuity plan (BCP)?
- A. Incident management requirements
- B. Business impact analysis (BIA)
- C. Disaster recovery plan (DRP)
- D. Business communication plan
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION # 416
Which of the following is the PRIMARY
- A. Complying with regulatory requirements
- B. Reducing escalations to management
- C. Enabling incident reporting
- D. Increasing response efficiency
Answer: D
NEW QUESTION # 417
Which of the following is MOST important to the successful implementation of an information security program?
- A. Conducting periodic risk assessments
- B. Understanding current and emerging technologies
- C. Establishing key performance indicators (KPIs)
- D. Obtaining stakeholder input
Answer: A
NEW QUESTION # 418
To reduce the possibility of service interruptions, an entity enters into contracts with multiple Internet service providers (ISPs). Which of the following would be the MOS T important item to include?
- A. Service level agreements (SLAs)
- B. Spam filtering services
- C. Right to audit clause
- D. Intrusion detection system (IDS) services
Answer: A
Explanation:
Service level agreements (question As) will be most effective in ensuring that Internet service providers (ISPs) comply with expectations for service availability. Intrusion detection system (IDS) and spam filtering services would not mitigate (as directly) the potential for service interruptions. A right-to-audit clause would not be effective in mitigating the likelihood of a service interruption.
NEW QUESTION # 419
An employee is found to be using an external cloud storage service to share corporate information with a third-party consultant, which is against company policy. Which of the following should be the information security manager s FIRST course of action?
- A. Inform higher management of a security breach
- B. Seek business justification from the employee
- C. Determine the classification level of the information
- D. Block access to the cloud storage service.
Answer: C
NEW QUESTION # 420
Which of the following BEST facilitates the effectiveness of cybersecurity incident response?
- A. Continuously updating signatures of the anti-malware solution.
- B. Utilizing a security information and event management (SIEM) tool.
- C. Increasing communication with all incident response stakeholders.
- D. Utilizing industry-leading network penetration testing tools.
Answer: C
Explanation:
Communication is a key factor for the effectiveness of cybersecurity incident response, as it ensures that all relevant parties are informed, coordinated, and aligned on the incident status, impact, actions, and responsibilities. Communication also helps to maintain trust, confidence, and transparency among the stakeholders, such as senior management, business units, customers, regulators, law enforcement, and media. Reference = CISM Review Manual, 16th Edition, Chapter 5, Section 5.4.2.11
NEW QUESTION # 421
As part of an international expansion plan, an organization has acquired a company located in another jurisdiction. Which of the following would be the BEST way to maintain any effective information security program?
- A. Implement the current information security program in the acquired company
- B. Merge the two information security programs to establish continuity
- C. Ensure information security is included in any change control efforts
- D. Determine new factors that could influence the information security strategy
Answer: D
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION # 422
Which of the following is the BEST method to ensure the overall effectiveness of a risk management program?
- A. Assignment of risk within the organization
- B. User assessments of changes
- C. Comparison of the program results with industry standards
- D. Participation by all members of the organization
Answer: D
Explanation:
Explanation
Effective risk management requires participation, support and acceptance by all applicable members of the organization, beginning with the executive levels. Personnel must understand their responsibilities and be trained on how to fulfill their roles.
NEW QUESTION # 423
When supporting a large corporation's board of directors in the development of governance, which of the following is the PRIMARY function of the information security manager?
- A. Developing a balanced scorecard
- B. Preparing the security budget
- C. Gaining commitment of senior management
- D. Providing advice and guidance
Answer: A
NEW QUESTION # 424
Which of the following BEST demonstrates the performance of the information security program to Key stakeholders?
- A. Disaster recovery testing results
- B. Risk heat map
- C. Security dashboard
- D. Security risk register
Answer: C
NEW QUESTION # 425
......
Q&As with Explanations Verified & Correct Answers: https://www.passleader.top/ISACA/CISM-exam-braindumps.html
CISM Dumps with Free 365 Days Update Fast Exam Updates: https://drive.google.com/open?id=1YXUONDfUdDkU6yGROKtUyu1u85r4vmuK