100% Real CISM dumps - Brilliant CISM Exam Questions PDF
CISM Exam PDF [2024] Tests Free Updated Today with Correct 672 Questions
NEW QUESTION # 143
During an annual security review of an organizations servers, it was found that the customer service team's file server, which contains sensitive customer data, is accessible to all user IDs in the organization. Which of the following should the information security manager do FIRST?
- A. Report The situation to the data owner.
- B. Remove access privileges to the folder containing the data.
- C. Train the customer service team on properly controlling file permissions.
- D. Isolate the server from the network.
Answer: A
NEW QUESTION # 144
Which of the following provides the BEST means of ensuring business units outside of IT have their information security concerns addressed?
- A. Targeted user security awareness programs for business units outside of IT
- B. A comprehensive list of business processes performed by each business unit
- C. Inclusion of business unit management In the Information security steering committee
- D. Involvement of senior management in information security policy development
Answer: A
NEW QUESTION # 145
Which of the following should be the FIRST step in developing an information security strategy?
- A. Perform a gap analysis based on the current state
- B. Create a roadmap to identify security baselines and controls
- C. Determine acceptable levels of information security risk
- D. Identify key stakeholders to champion information security
Answer: D
Explanation:
Explanation
The first step in developing an information security strategy is to identify key stakeholders who can provide support, guidance and resources for information security initiatives. These stakeholders may include senior management, business unit leaders, legal counsel, audit and compliance officers and other relevant parties. By engaging these stakeholders early on, an information security manager can ensure that the strategy aligns with business objectives and expectations, as well as gain buy-in and commitment from them. Determining acceptable levels of risk, creating a roadmap and performing a gap analysis are all important steps in developing an information security strategy, but they should follow after identifying key stakeholders.
NEW QUESTION # 146
At what stage of the applications development process should the security department initially become involved?
- A. At detail requirements
- B. When requested
- C. At testing
- D. At programming
Answer: A
Explanation:
Information security has to be integrated into the requirements of the application's design. It should also be part of the information security governance of the organization. The application owner may not make a timely request for security involvement. It is too late during systems testing, since the requirements have already been agreed upon. Code reviews are part of the final quality assurance process.
NEW QUESTION # 147
Which of the following is MOST effective in preventing the introduction of a code modification that may reduce the security of a critical business application?
- A. Patch management
- B. Change management
- C. Version control
- D. Security metrics
Answer: B
Explanation:
Explanation
Change management controls the process of introducing changes to systems. Failure to have good change management may introduce new weaknesses into otherwise secure systems. Patch management corrects discovered weaknesses by applying a correction to the original program code. Security metrics provide a means for measuring effectiveness. Version control is a subset of change management.
NEW QUESTION # 148
Which of the following is the PRIMARY reason for conducting post-incident reviews?
- A. To determine the level of required remediation
- B. To ensure regulatory compliance
- C. To review lessons learned
- D. To establish the cost of remediation
Answer: C
NEW QUESTION # 149
Which of the following is MOST important to consider when developing a business continuity plan (BCP)?
- A. Disaster recovery plan (DRP)
- B. Business impact analysis (BIA)
- C. Incident management requirements
- D. Business communication plan
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM DEVELOPMENT
NEW QUESTION # 150
To determine the selection of controls required to meet business objectives, an information security manager should:
- A. focus on automated controls.
- B. restrict controls to only critical applications.
- C. prioritize the use of role-based access controls.
- D. focus on key controls.
Answer: D
Explanation:
Section: INFORMATION RISK MANAGEMENT
Explanation:
Key controls primarily reduce risk and are most effective for the protection of information assets. The other choices could be examples of possible key controls.
NEW QUESTION # 151
Risk identification, analysis, and mitigation activities can BEST be integrated into business life cycle processes by linking them to:
- A. change management
- B. configuration management
- C. compliance testing
- D. continuity planning
Answer: B
NEW QUESTION # 152
During a security assessment, an information security manager finds a number of security patches were not installed on a server hosting a critical business application. The application owner did not approve the patch installation to avoid interrupting the application.
Witch of the following should be the information security manager's FIRST course of action?
- A. Communicate the potential impact to the application owner.
- B. Escalate the risk to senior management.
- C. Determine mitigation options with IT management
- D. Report the risk to the information security steering committee.
Answer: A
NEW QUESTION # 153
A new regulation has been announced that requires mandatory reporting of security incidents that affect personal client information. Which of the following should be the information security manager's FIRST course of action?
- A. Review the current security policy.
- B. Inform senior management of the new regulation.
- C. Update the security incident management process.
- D. Determine impact to the business.
Answer: A
NEW QUESTION # 154
When a critical system incident is reported, the FIRST step of the incident handler should be to:
- A. notify the appropriate parties.
- B. determine the scope of the incident.
- C. power off the system.
- D. validate the incident.
Answer: D
NEW QUESTION # 155
What is the MOST important factor in the successful implementation of an enterprise wide information security program?
- A. Realistic budget estimates
- B. Recalculation of the work factor
- C. Security awareness
- D. Support of senior management
Answer: D
Explanation:
Without the support of senior management, an information security program has little chance of survival. A company's leadership group, more than any other group, will more successfully drive the program. Their authoritative position in the company is a key factor. Budget approval, resource commitments, and companywide participation also require the buy-in from senior management. Senior management is responsible for providing an adequate budget and the necessary resources. Security awareness is important, but not the most important factor. Recalculation of the work factor is a part of risk management.
NEW QUESTION # 156
Meeting which of the following security objectives BEST ensures that information is protected against unauthorized modification?
- A. Confidentiality
- B. Integrity
- C. Availability
- D. Authenticity
Answer: B
Explanation:
Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation
NEW QUESTION # 157
Which of the following is MOST effective in preventing the introduction of a code modification that may reduce the security of a critical business application?
- A. Patch management
- B. Change management
- C. Version control
- D. Security metrics
Answer: B
Explanation:
Change management controls the process of introducing changes to systems. Failure to have good change management may introduce new weaknesses into otherwise secure systems. Patch management corrects discovered weaknesses by applying a correction to the original program code. Security metrics provide a means for measuring effectiveness. Version control is a subset of change management.
NEW QUESTION # 158
......
To be eligible to take the CISM certification exam, candidates must have at least five years of experience in information security management, with a minimum of three years of experience in the role of information security manager. Alternatively, candidates can substitute experience with relevant education and other certifications. Once the candidate passes the CISM exam, they must adhere to the ISACA Code of Professional Ethics, maintain their certification through continuing education, and adhere to the ISACA Certification Maintenance Policy.
Verified & Correct CISM Practice Test Reliable Source Mar 22, 2024 Updated: https://www.vcedumps.com/CISM-examcollection.html
ISACA CISM Exam Preparation Guide and PDF Download: https://drive.google.com/open?id=1HevN6uo47h7AymXq40wdTzgAq58oIhEB
