Dependable CISM Exam Dumps to Become ISACA Certified
Get Ready with CISM Exam Dumps (2023)
ISACA Certified Information Security Manager CISM Exam
ISACA Certified Information Security Manager CISM Exam is related to Certified Information Security Manager CISM certification. This CISM Exam validates the ability to maintain and establish an information security governance framework and supporting processes to ensure that the information security strategy is aligned with organizational goals and objectives. Candidate must have the ability to manage information risk appropriately and program resources are managed responsibly. It also deals with the ability to ensure that organizational goals and objectives are supported by the information security program communicate managements directives and guide the development of standards, procedures, and guidelines and develop business cases to support investments in information security. Security Managers Industry Leaders and Industry Practitioners usually hold or pursue this certification and you can expect the same job roles after completion of this certification.
Passing the CISM certification exam demonstrates that an individual has the knowledge and skills required to manage and oversee information security programs. It also demonstrates a commitment to professional development and a dedication to the information security field. The CISM certification is recognized globally and is highly respected by employers, making it a valuable credential for information security professionals looking to advance their careers.
NEW QUESTION # 137
Which of the following is the MOST effective at preventing an unauthorized individual from following an authorized person through a secured entrance (tailgating or piggybacking)?
- A. Biometric scanners
- B. Awareness training
- C. Photo identification
- D. Card-key door locks
Answer: B
Explanation:
Awareness training would most likely result in any attempted tailgating being challenged by the authorized employee. The other choices are physical controls which by themselves would not be effective against tailgating.
NEW QUESTION # 138
Which of the following is the MAIN reason for integrating an organization's incident response plan with its business continuity process?
- A. Incidents will be reported more timely when categorized as a disaster.
- B. Recovery time objectives (RTOs) need to be determined.
- C. Integration of the plan will reduce resource costs to the organization.
- D. Incidents can escalate into disasters needing proper response
Answer: D
NEW QUESTION # 139
A team developing an interface to a key financial system has identified a security flaw in one of the libraries. Remediating the flaw would require major system redesign. What should the information security manager do NEXT?
- A. Instruct the development team to remediate the flaw.
- B. Conduct a comprehensive source code review.
- C. Hire a consultant to design proper remediation controls.
- D. Confirm the impact with the business owner.
Answer: D
NEW QUESTION # 140
A risk assessment should be conducted:
- A. by external parties to maintain objectivity.
- B. every three to six months for critical business processes.
- C. annually or whenever there is a significant change.
- D. once a year for each business process and subprocess.
Answer: C
Explanation:
Explanation
Risks are constantly changing. Choice D offers the best alternative because it takes into consideration a reasonable time frame and allows flexibility to address significant change. Conducting a risk assessment once a year is insufficient if important changes take place. Conducting a risk assessment every three-to-six months for critical processes may not be necessary, or it may not address important changes in a timely manner. It is not necessary for assessments to be performed by external parties.
NEW QUESTION # 141
A new version of an information security regulation is published that requires an organization's compliance. The information security manager should FIRST
- A. perform a gap analysis against the new regulation.
- B. conduct benchmarking against similar organizations.
- C. perform an audit based on the new version of the regulation
- D. conduct a risk assessment to determine the risk of noncompliance.
Answer: A
NEW QUESTION # 142
Which of the following is the PRIMARY reason for performing an analysis of the threat landscape on a regular basis?
- A. To determine the basis for proposing an increase in security budgets
- B. To determine critical information for executive management
- C. To determine if existing vulnerabilities present a risk
- D. To determine if existing business continuity plans are adequate
Answer: D
NEW QUESTION # 143
Which of the following is MOST appropriate to add to a dashboard for the purpose of illustrating an organization's risk level to senior management?
- A. Budget variance for information security
- B. Results of risk and control testing
- C. Risk heat map
Answer: C
NEW QUESTION # 144
The effectiveness of an information security governance framework will BEST be enhanced if:
- A. consultants review the information security governance framework
- B. risk management is built into operational and strategic activities.
- C. IS auditors are empowered to evaluate governance activities,
- D. a culture of legal and regulatory compliance is promoted by management.
Answer: D
NEW QUESTION # 145
When an organization is using an automated tool to manage and house its business continuity plans, which of the following is the PRIMARY concern?
- A. Ensuring accessibility should a disaster occur
- B. Tracking changes in personnel and plan assets
- C. Broken hyperlinks to resources stored elsewhere
- D. Versioning control as plans are modified
Answer: A
Explanation:
Section: INCIDENT MANAGEMENT AND RESPONSE
Explanation:
If all of the plans exist only in electronic form, this presents a serious weakness if the electronic version is dependent on restoration of the intranet or other systems that are no longer available. Versioning control and tracking changes in personnel and plan assets is actually easier with an automated system. Broken hyperlinks are a concern, but less serious than plan accessibility.
NEW QUESTION # 146
The BEST reason for an organization to have two discrete firewalls connected directly to the Internet and to the same DMZ would be to:
- A. prevent a denial-of-service attack.
- B. provide in-depth defense.
- C. permit traffic load balancing.
- D. separate test and production.
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Having two entry points, each guarded by a separate firewall, is desirable to permit traffic load balancing.
As they both connect to the Internet and to the same demilitarized zone (DMZ), such an arrangement is not practical for separating test from production or preventing a denial-of-service attack.
NEW QUESTION # 147
Which of the following is MOST important for a successful information security program?
- A. Open communication with key process owners
- B. Adequate training on emerging security technologies
- C. Executive management commitment
- D. Adequate policies, standards and procedures
Answer: C
Explanation:
Sufficient executive management support is the most important factor for the success of an information security program. Open communication, adequate training, and good policies and procedures, while important, are not as important as support from top management; they will not ensure success if senior management support is not present.
NEW QUESTION # 148
The PRIMARY consideration when defining recovery time objectives (RTOs) for information assets is:
- A. regulatory' requirements.
- B. financial value.
- C. business requirements.
- D. IT resource availability.
Answer: C
Explanation:
Section: INCIDENT MANAGEMENT AND RESPONSE
Explanation:
The criticality to business should always drive the decision. Regulatory requirements could be more flexible than business needs. The financial value of an asset could not correspond to its business value. While a consideration, IT resource availability is not a primary factor.
NEW QUESTION # 149
What is the BEST way to ensure that contract programmers comply with organizational security policies?
- A. Have the contractors acknowledge in writing the security policies
- B. Explicitly refer to contractors in the security standards
- C. Create penalties for noncompliance in the contracting agreement
- D. Perform periodic security reviews of the contractors
Answer: D
Explanation:
Explanation/Reference:
Explanation:
Periodic reviews are the most effective way of obtaining compliance. None of the other options detects the failure of contract programmers to comply.
NEW QUESTION # 150
An information security manager has been asked to develop a change control process. What is the FIRST thing the information security manager should do?
- A. Research best practices
- B. Meet with stakeholders
- C. Establish change control procedures
- D. Identify critical systems
Answer: B
Explanation:
No new process will be successful unless it is adhered to by all stakeholders; to the extent stakeholders have input, they can be expected to follow the process. Without consensus agreement from the stakeholders, the scope of the research is too wide; input on the current environment is necessary to focus research effectively. It is premature to implement procedures without stakeholder consensus and research. Without knowing what the process will be the parameters to baseline are unknown as well.
NEW QUESTION # 151
Security technologies should be selected PRIMARILY on the basis of their:
- A. benefits in comparison to their costs.
- B. use of new and emerging technologies.
- C. ability to mitigate business risks.
- D. evaluations in trade publications.
Answer: C
Explanation:
Explanation
The most fundamental evaluation criterion for the appropriate selection of any security technology is its ability to reduce or eliminate business risks. Investments in security technologies should be based on their overall value in relation to their cost; the value can be demonstrated in terms of risk mitigation. This should take precedence over whether they use new or exotic technologies or how they are evaluated in trade publications.
NEW QUESTION # 152
An information security manager finds that a soon-to-be deployed online application will increase risk beyond acceptable levels, and necessary controls have not been included. Which of the following is the BEST course of action for the information security manager?
- A. Instruct IT to deploy controls based on urgent business needs.
- B. Present a business case for additional controls to senior management.
- C. Recommend a different application.
- D. Solicit bids for compensating control products.
Answer: B
Explanation:
Section: INFORMATION RISK MANAGEMENT
NEW QUESTION # 153
An organization's quality process can BEST support security management by providing:
- A. a repository for security systems documentation.
- B. guidance for security strategy.
- C. assurance that security requirements are met.
- D. security configuration controls.
Answer: C
Explanation:
Explanation
An organization's quality process can BEST support security management by providing assurance that security requirements are met. This means that the quality process can be used to ensure that security controls are being implemented as intended and that they are achieving the desired results. This helps to ensure that the organization is properly protected and that it is in compliance with security regulations and standards.
NEW QUESTION # 154
The BEST way to identify the criticality of systems to the business is through:
- A. an impact assessment.
- B. a threat assessment.
- C. a vulnerability assessment.
- D. an asset classification.
Answer: D
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
NEW QUESTION # 155
......
Download Exam CISM Practice Test Questions with 100% Verified Answers: https://examcollection.actualcollection.com/CISM-exam-questions.html